> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Move devices to the kept Apple Push certificate

> Move each Mac, iPhone, and iPad from the certificate you give up to the kept Apple Push certificate, by type of device and enrollment, then check that it arrived.

This article moves the devices whose **APNs topic** differs from the installed certificate topic. Each type of device moves in its own way. To find these devices, see [Diagnose devices on another Apple Push certificate](https://docs.getprimo.com/mdm/guides/apple-push/diagnose.md).

## Check the prerequisites

* The kept certificate is installed: **Installed certificate topic**, in **MDM > Settings** > **Apple**, shows its topic.
* The enrollment profile cache was purged after the certificate was installed. See [Purge the enrollment profile cache](https://docs.getprimo.com/mdm/settings#purge-the-enrollment-profile-cache).
* You have the list of devices to move, split by type and enrollment.

> [!WARNING]
>
> Never use the cockpit's **Unenroll** action for this migration. It also removes the Primo agent, which Macs need to re-enroll. Only **Turn off MDM** applies here.

## Move each device

**Turn off MDM** removes the MDM profile and keeps the Primo agent on Macs. The [migration agent](https://docs.getprimo.com/mdm/guides/apple-push/migration-agent.md) cannot send it yet: ask [Primo support](mailto:support@getprimo.com) to turn off MDM on the devices to move, with their serial numbers.

> [tab] Mac, manual
>
> **1. Remove the MDM profile**
>
> Remove the MDM profile locally, with a script run by the Primo agent, or wait for **Turn off MDM** to arrive. **\[À CONFIRMER : le script de retrait local n'est pas encore dans la bibliothèque de scripts. En attendant, demander au support Primo.]**
>
> **2. Re-enroll the Mac**
>
> The employee follows the guided re-enrollment: they click **Install** and type their administrator password. **\[À CONFIRMER : le script de réenrôlement guidé n'est pas encore dans la bibliothèque de scripts.]**
>
> If the employee has no administrator rights on their Mac, your IT team does this step with them.

> [tab] Mac, zero-touch
>
> **1. Turn off MDM**
>
> The command waits in the queue until the Mac connects by itself. It may arrive later, and nothing guarantees that it reaches a Mac on another certificate. **\[À CONFIRMER : qu'un Mac zero-touch sur l'ancien topic reçoive bien son Turn off MDM.]**
>
> **2. Accept the re-enrollment window**
>
> Once MDM is off, the Primo agent shows a re-enrollment window on the Mac. The employee accepts it, and the Mac enrolls on the installed certificate.
>
> **3. Restart the Mac if nothing changes**
>
> If the Mac has not moved after a few days, ask the employee to restart it. If it still does not move, see [Troubleshoot an Apple Push certificate migration](https://docs.getprimo.com/mdm/guides/apple-push/troubleshooting.md).

> [tab] iPhone or iPad, manual
>
> **1. Remove the MDM profile**
>
> The employee goes to **Settings > General > VPN & Device Management**, opens the MDM profile, and removes it.
>
> **2. Install the new profile**
>
> Send the employee an enrollment link: see [Employee enrollment](https://docs.getprimo.com/mdm/rollout/invite-employees.md). They open it on the device and install the profile, which carries the installed certificate.

> [tab] iPhone or iPad, zero-touch
>
> > [!WARNING]
> >
> > An iPhone or iPad enrolled through zero-touch deployment must be erased to move. Everything that is not backed up is lost.
>
> **1. Back up the device**
>
> Ask the employee to back up their data first, and to check what their authenticator apps need to move to a new device.
>
> **2. Prepare Activation Lock**
>
> After the erase, Activation Lock asks for the Apple Account of the employee. Make sure they know it, or that you can bypass the lock. See [Activation Lock bypass code escrow](https://docs.getprimo.com/mdm/guides/activation-lock-bypass.md).
>
> **3. Erase the device**
>
> The employee goes to **Settings > General > Transfer or Reset iPhone > Erase All Content and Settings**. If erasing is restricted on the device, erase it with Apple Configurator on a Mac.
>
> **4. Set up the device**
>
> The device restarts on Setup Assistant and enrolls through zero-touch deployment, on the installed certificate.
>
> When you return to the original certificate, an alternative to the erase exists in Apple Business. It is not the recommended route. See [Unassign and reassign devices in Apple Business](https://docs.getprimo.com/mdm/guides/apple-push/apple-business.md).

## Verify that a device is migrated

* In **Devices**, its **APNs topic** matches **Installed certificate topic**. A device is migrated only then.
* After **Turn off MDM** and before re-enrollment, its MDM status shows **Deactivated**.
* On a Mac, before re-enrollment, `profiles status -type enrollment` in Terminal shows `MDM enrollment: No`.

The migration is over when no device shows a topic other than the installed one.

## Contact

If a device does not move, contact [support@getprimo.com](mailto:support@getprimo.com) with:

* its serial number, type, and enrollment method
* its **APNs topic** and the installed certificate topic
* what was done on it, and when

## Related articles

* [Apple Push certificate migration overview](https://docs.getprimo.com/mdm/guides/apple-push/overview.md)
* [Troubleshoot an Apple Push certificate migration](https://docs.getprimo.com/mdm/guides/apple-push/troubleshooting.md)
* [Wiping devices](https://docs.getprimo.com/mdm/guides/wiping-devices.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.