> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network whitelisting

> Which Primo MDM and Apple endpoints must be reachable for enrollment, policy delivery, and push notifications to work when devices are behind a firewall or proxy.

Primo MDM communicates with managed devices over HTTPS. When devices sit behind a corporate firewall or proxy, the endpoints below must be reachable outbound for enrollment, policy delivery, and push notifications to function.

## Primo MDM server

Every Primo account has a dedicated MDM server URL:

```
[company slug].mdm.getprimo.com
```

Managed devices connect to this host for enrollment and to receive MDM commands. Allow outbound **TCP 443** to this hostname.

## Platform-specific endpoints

<Tabs>
  <Tab title="macOS / iOS / iPadOS">
    Apple MDM relies on the Apple Push Notification service (APNs) to wake devices when a command is pending. Without APNs access, devices do not receive MDM commands in real time.

    | Host                         | Ports     | Purpose                                      |
    | ---------------------------- | --------- | -------------------------------------------- |
    | `*.push.apple.com`           | 443, 2197 | Push notifications (APNs)                    |
    | `albert.apple.com`           | 443       | Device activation                            |
    | `deviceenrollment.apple.com` | 443       | Automated Device Enrollment (via ABM or ASM) |
    | `mdmenrollment.apple.com`    | 443       | MDM enrollment                               |
    | `iprofiles.apple.com`        | 443       | Configuration profile delivery               |

    <Info>
      Older networks that block non-standard HTTPS ports also require TCP 5223 outbound to `*.push.apple.com`. If you are unsure, allow it.
    </Info>

    For a complete and up-to-date list of Apple hosts and ports, see [Use Apple products on enterprise networks](https://support.apple.com/en-gb/101555).
  </Tab>

  <Tab title="Windows">
    The Primo agent communicates outbound on port 443 exclusively to your Primo MDM server. No additional endpoints are required.
  </Tab>

  <Tab title="Linux">
    The Primo agent communicates outbound on port 443 exclusively to your Primo MDM server. No additional endpoints are required.
  </Tab>

  <Tab title="Android">
    The Primo agent communicates outbound on port 443 exclusively to your Primo MDM server. No additional endpoints are required.
  </Tab>
</Tabs>

## Summary

| Endpoint                          | Port      | Required for                 |
| --------------------------------- | --------- | ---------------------------- |
| `[company slug].mdm.getprimo.com` | 443       | All platforms                |
| `*.push.apple.com`                | 443, 2197 | Apple MDM push notifications |
| `albert.apple.com`                | 443       | Apple device activation      |
| `deviceenrollment.apple.com`      | 443       | Apple automated enrollment   |
| `mdmenrollment.apple.com`         | 443       | Apple MDM enrollment         |
| `iprofiles.apple.com`             | 443       | Apple profile delivery       |

All connections are **outbound HTTPS** from managed devices. No inbound firewall rules are required on the device side.

## Advanced: specific routes

If you use a reverse proxy or firewall with path-level rules and prefer not to allowlist an entire domain, use the route-level allowlist below.

### Devices roaming outside VPN or intranet

To manage devices that travel outside your VPN or intranet, expose only the osquery endpoints:

```
/api/osquery/*
/api/v1/osquery/*
```

<Tabs>
  <Tab title="macOS">
    | Route                                                                                                 | Purpose                                                                                      |
    | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
    | `/mdm/apple/scep`                                                                                     | Devices obtain a SCEP certificate                                                            |
    | `/mdm/apple/mdm`                                                                                      | Devices communicate using the MDM protocol                                                   |
    | `/api/mdm/apple/enroll`                                                                               | Devices fetch an enrollment profile (automated enrollment)                                   |
    | `/api/*/fleet/device/*`                                                                               | End users access their device page (manual enrollment profile, disk encryption key rotation) |
    | `/mdm/sso`, `/api/*/fleet/mdm/sso`, `/mdm/sso/callback`, `/api/*/fleet/mdm/sso/callback`, `/assets/*` | End user IdP authentication during out-of-the-box setup (if required)                        |
    | `/api/*/fleet/mdm/setup/eula/*`                                                                       | End user EULA agreement during out-of-the-box setup (if required)                            |
    | `/api/*/fleet/mdm/bootstrap`                                                                          | Bootstrap package installation during out-of-the-box setup (if applicable)                   |

    <Info>
      `/mdm/apple/scep` and `/mdm/apple/mdm` sit outside the `/api` path because they implement non-RESTful Apple MDM protocols, not standard API endpoints.
    </Info>
  </Tab>

  <Tab title="Windows">
    | Route                           | Purpose                                                                       |
    | ------------------------------- | ----------------------------------------------------------------------------- |
    | `/api/mdm/microsoft/management` | Devices receive MDM commands and profiles                                     |
    | `/api/mdm/microsoft/discovery`  | Devices discover MDM server information                                       |
    | `/api/mdm/microsoft/policy`     | Enrollment policies for identity certificate issuance                         |
    | `/api/mdm/microsoft/enroll`     | WS-Trust X.509v3 token enrollment (MS-WSTEP)                                  |
    | `/api/mdm/microsoft/tos`        | Terms of Service agreement during out-of-the-box setup (automated enrollment) |
    | `/api/mdm/microsoft/auth`       | End user authentication during out-of-the-box setup (automated enrollment)    |
  </Tab>

  <Tab title="iOS and iPadOS">
    | Route                                         | Purpose                                                                |
    | --------------------------------------------- | ---------------------------------------------------------------------- |
    | `/enroll`                                     | End users access the enrollment page to download an enrollment profile |
    | `/api/*/fleet/enrollment_profiles/ota`        | Devices download an enrollment profile                                 |
    | `/api/*/fleet/software/titles/*/in_house_app` | In-house app (`.ipa`) deployment                                       |
  </Tab>

  <Tab title="Android">
    | Route                                              | Purpose                                                                            |
    | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
    | `/enroll`                                          | End users access the enrollment page                                               |
    | `/api/*/fleet/android_enterprise/enrollment_token` | Primo receives the Android Management API enrollment token                         |
    | `/api/*/fleet/android_enterprise/pubsub`           | Primo receives enrollment and status notifications from the Android Management API |
    | `/api/fleetd/*`                                    | Certificate deployment for Wi-Fi/VPN connectivity                                  |
  </Tab>
</Tabs>

### SCEP proxy

If you use Primo as a SCEP proxy:

```
/mdm/scep/proxy/*
```

### mTLS

The `/api/*/fleet/*` routes used by the Primo agent support mutual TLS (mTLS) using the certificate provided during agent packaging.

The `/mdm/apple/mdm` and `/api/mdm/apple/enroll` endpoints support mTLS using the SCEP certificate issued by the Primo server.

The following endpoints do **not** use mTLS:

```
/mdm/apple/scep
/api/mdm/microsoft/discovery
/api/mdm/microsoft/auth
/api/mdm/microsoft/policy
/api/mdm/microsoft/enroll
/api/mdm/microsoft/management
/api/mdm/microsoft/tos
```

For macOS and Windows, the MDM client sends the client certificate in a request header. The Primo server then verifies this certificate independently.