Skip to main content
Primo MDM communicates with managed devices over HTTPS. When devices sit behind a corporate firewall or proxy, the endpoints below must be reachable outbound for enrollment, policy delivery, and push notifications to function.

​
Primo MDM server

Every Primo account has a dedicated MDM server URL:
Managed devices connect to this host for enrollment and to receive MDM commands. Allow outbound TCP 443 to this hostname.

​
Platform-specific endpoints

Apple MDM relies on the Apple Push Notification service (APNs) to wake devices when a command is pending. Without APNs access, devices do not receive MDM commands in real time.
Older networks that block non-standard HTTPS ports also require TCP 5223 outbound to *.push.apple.com. If you are unsure, allow it.
For a complete and up-to-date list of Apple hosts and ports, see Use Apple products on enterprise networks.

​
Summary

All connections are outbound HTTPS from managed devices. No inbound firewall rules are required on the device side.

​
Advanced: specific routes

If you use a reverse proxy or firewall with path-level rules and prefer not to allowlist an entire domain, use the route-level allowlist below.

​
Devices roaming outside VPN or intranet

To manage devices that travel outside your VPN or intranet, expose only the osquery endpoints:
/mdm/apple/scep and /mdm/apple/mdm sit outside the /api path because they implement non-RESTful Apple MDM protocols, not standard API endpoints.

​
SCEP proxy

If you use Primo as a SCEP proxy:

​
mTLS

The /api/*/fleet/* routes used by the Primo agent support mutual TLS (mTLS) using the certificate provided during agent packaging. The /mdm/apple/mdm and /api/mdm/apple/enroll endpoints support mTLS using the SCEP certificate issued by the Primo server. The following endpoints do not use mTLS:
For macOS and Windows, the MDM client sends the client certificate in a request header. The Primo server then verifies this certificate independently.