Intune Apple Token Audit

Read-only PowerShell script that lists the Intune Apple push certificate, ADE and VPP tokens with expiry dates, days left and the Apple ID behind each.

Send me the scriptView on GitHub

What it does

  • Reads the Apple MDM push certificate, every ADE enrolment program token and every Apps and Books (VPP) token from Intune through Microsoft Graph, with your own account
  • Shows the expiry date, days left and the Apple ID behind each one, with where to renew it
  • Notes whether an expired push certificate is still inside Microsoft's 30-day grace period
  • Flags personal Apple IDs (Gmail, iCloud, Outlook and similar) and VPP tokens Intune reports as invalid or assigned to another MDM
  • Counts the iPhones, iPads and Macs that depend on the push certificate
  • Exports a CSV and exits 1 when anything is expired, invalid or inside the warning window, so it can run on a schedule
  • Read-only: it changes nothing in your tenant and renews nothing. Apple renewals need an interactive sign-in with the right Apple ID

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath        = Join-Path $env:USERPROFILE 'Desktop\Atliso-AppleTokens.csv'
$WarnDays          = 60     # flag anything that expires within this many days
$CriticalDays      = 14
$CountAppleDevices = $true  # count the Apple devices that depend on the push certificate
$LogPath           = Join-Path $env:LOCALAPPDATA 'Atliso\AppleTokenAudit.log'
# ==================

Run it

It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:

PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
.\Atliso-AppleTokenAudit.ps1
# MSPs: run once per customer tenant
.\Atliso-AppleTokenAudit.ps1 -TenantId contoso.onmicrosoft.com

Full walkthrough, including how to renew each one without forcing every device to re-enrol: Apple MDM push certificate expired in Intune? Check all 3 Apple dates

Get Intune Apple Token Audit

We'll send the script, and updates when Apple or Microsoft change how the renewals work. No spam.