Choose which Apple Push certificate to keep - Primo Documentation

Every device must end up on one certificate. Whichever you keep, the devices on the other one have to move. Before choosing, count the devices on each certificate: see Diagnose devices on another Apple Push certificate.

By option

Option	Requires	Certificate change	Devices to move
Keep the new certificate	Nothing	None: the new certificate is already installed	The devices on the original certificate
Return to the original certificate	Access to the Apple Account that created the original certificate	Renew the original certificate and install it in Fleet	The devices on the new certificate

Check access to the original Apple Account

This is the first criterion. The original certificate can only be renewed with the Apple Account that created it. If nobody can sign in with that account anymore, keeping the new certificate is the only option.

Weigh the devices to move

If you still have access to the original Apple Account, compare what each option moves. Moving a device costs more or less depending on its type, from the heaviest to the lightest:

Device	What moving it takes
iPhone or iPad, zero-touch deployment	An erase of the device: the employee loses what is not backed up, and Activation Lock asks for their Apple Account
iPhone or iPad, manual enrollment	The employee removes the MDM profile and installs the new one
Mac, zero-touch deployment	MDM turned off, then the employee accepts the re-enrollment window
Mac, manual enrollment	The MDM profile removed, then a guided re-enrollment where the employee types their administrator password

Choose the option that moves the fewest heavy devices. For example, if the original certificate still holds most of your zero-touch iPhones, returning to it avoids erasing them, even if it means moving more Macs.

When you return to the original certificate, an alternative to erasing zero-touch iPhones and iPads exists in Apple Business. It is not the recommended route. See Unassign and reassign devices in Apple Business.

Next steps

Renew the original

If you return to the original certificate, install it first.

Move devices

If you keep the new certificate, purge the cache and move the devices.