Skip to main content
An Apple device only receives MDM commands through the Apple Push certificate it enrolled under. When a company creates a new certificate instead of renewing the existing one, or renews it with another Apple Account, the devices enrolled before keep the old certificate and stop receiving commands. These pages explain how to recognize the problem, choose the certificate to keep, and move each device onto it. To renew a certificate the right way, see Renew your APNs certificate.

Diagnose

Confirm which devices sit on another certificate by comparing their APNs topic with the installed one.

Choose a certificate

Decide between keeping the new certificate and returning to the original one.

Renew the original

Renew the original certificate with its Apple Account and install it in Fleet.

Move devices

Move each Mac, iPhone, and iPad onto the kept certificate, and check that it arrived.

Migration agent

Let Primo AI follow the migration, open the tickets, and report progress.

Troubleshooting

Unblock a device that does not move, and answer the common questions.

​
Key concepts

  • Apple Push certificate topic: the identifier of a certificate, in the form com.apple.mgmt.External.<uuid>. Each device keeps the topic of the certificate it enrolled under, and only receives MDM commands under that topic.
  • Installed certificate: the certificate Primo uses to send commands. Its topic shows in MDM > Settings, in the Apple window, next to Installed certificate topic.
  • Kept certificate: the certificate every device ends up on. It is either the new certificate, already installed, or the original one, installed again.
  • Enrollment profile cache: the enrollment profiles and packages Primo keeps ready. They carry the topic of the certificate installed when they were built. See Purge the enrollment profile cache.
  • Turn off MDM: removes the MDM profile from a device. On a Mac, the Primo agent stays installed and keeps reporting. This is not the cockpit’s Unenroll action, which also removes the Primo agent: never use Unenroll for this migration.

​
Follow the order of operations

Every migration follows the same order, whichever certificate you keep.
1

Install the kept certificate

If you keep the new certificate, it is already installed. If you return to the original one, renew it and install it in Fleet.
2

Purge the enrollment profile cache

The next enrollment then rebuilds the profiles with the kept certificate. See Purge the enrollment profile cache.
3

Turn off MDM on the devices to move

Only on the devices whose APNs topic differs from the installed certificate topic.
4

Re-enroll each device

Each type of device re-enrolls in its own way. See Move devices to the kept certificate.
Never turn off MDM before the kept certificate is installed and the cache is purged. A device turned off too early re-enrolls on the certificate you are giving up, and you have to move it a second time.
This order has a cost. A Turn off MDM command sent to a device on another certificate cannot reach it through Apple Push: it waits in the queue until the device connects by itself. Turning off MDM therefore takes longer to reach the devices, and some may need an action from the employee.

​
Next steps

Diagnose

Start by counting the devices on each certificate.

Choose a certificate

Then pick the certificate that moves the fewest devices.