The Problem
Microsoft Intune does not provide native alerting or automated notifications for Apple enrollment token and APNs certificate expiration events. This means administrators must manually log in to the Intune portal to check expiry dates — and if no one remembers, expired tokens go unnoticed until something stops working.
⚠ Potential Impact
Expired Apple tokens can cause: failure of new iOS/iPadOS device enrollments · inability to assign or distribute VPP applications · interruption of Intune management for all Apple devices · loss of mobile access to Microsoft 365, Wi-Fi, VPN, and corporate resources · reactive troubleshooting and increased operational overhead.
This guide implements an automated monitoring and email notification solution using Azure Automation and Microsoft Graph API — so your team gets a weekly report on token and certificate health before expiry causes a service disruption.
Glossary
APNs
Apple Push Notification service — Apple's cloud infrastructure for delivering MDM commands to Apple devices. Intune sends a "nudge" through APNs, which wakes the device and tells it to check in with the MDM server.
DEP
Device Enrollment Program — Apple's original name for Automated Device Enrollment (ADE), now managed through Apple Business Manager (ABM).
VPP
Volume Purchase Program — Apple's original name for ABM Apps and Books. The mechanism for purchasing and distributing apps in bulk to managed devices without requiring personal Apple IDs.
Automation Account
An Azure service that runs automated PowerShell or Python scripts in the cloud on a schedule or triggered by events — without needing a dedicated VM.
Runbook
A script that lives inside an Azure Automation Account and gets executed by it. The Automation Account is the container; the Runbook is the unit of work that actually runs.
How to Manually Check Token Status
Before automating, it helps to know where these tokens live in the Intune portal. Here's how to find each one.
Checking the Apple DEP Token
| # | Action |
|---|
| 1 | Sign in to the Microsoft Intune admin center (intune.microsoft.com) |
| 2 | Navigate to Devices |
| 3 | Select Enrollment |
| 4 | Under Apple, select Apple Mobile |
| 5 | Click Enrollment Program Tokens |
| 6 | Select the Apple server entry |
| 7 | Review the Expiration Date field |
Checking the Apple VPP Token
| # | Action |
|---|
| 1 | Sign in to the Microsoft Intune admin center |
| 2 | Navigate to Tenant Administration |
| 3 | Select Connectors and Tokens |
| 4 | Click Apple VPP Tokens |
| 5 | Select the Apple server entry and review the token expiration |
Checking the Apple APNs Certificate
| # | Action |
|---|
| 1 | Sign in to the Microsoft Intune admin center |
| 2 | Navigate to Devices |
| 3 | Select Enrollment |
| 4 | Under Apple, select Apple Mobile |
| 5 | Click Apple MDM Push Certificate and review the expiry |
Azure Setup
Azure Resource Group
As additional Microsoft 365 and Intune automation solutions are expected to be added over time, it's recommended to create a dedicated Azure Resource Group to centrally manage automation resources, reporting, access control, and Azure costs.
Create the Resource Group
| # | Action |
|---|
| 1 | Sign in to the Azure Portal (portal.azure.com) |
| 2 | In the search bar, type Resource Groups and select it |
| 3 | Click + Create |
| 4 | Enter the values from the table below, then click Review + Create → Create |
| Parameter | Value |
|---|
| Name | pandh-m365 |
| Region | Canada East or Canada Central |
Provision Resource Group Roles
Assign Contributor or Owner roles to the designated administrators who will manage automation resources within this group.
M365 Setup
M365 Admin Center — Notification Group
Create a Microsoft 365 Group that the automation runbook will use as the sender address for all notification emails. This group acts as a shared mailbox for automation alerts.
| # | Action |
|---|
| 1 | Sign in to the Microsoft 365 Admin Center (admin.cloud.microsoft) |
| 2 | In the left navigation, click Show All, then expand Teams & Groups |
| 3 | Click Active Teams & Groups, then click Add a Team |
| 4 | Enter the configuration below, then click Next → Add Team |
| Field | Value |
|---|
| Name | P&H M365 Automation |
| Description | Shared mailbox for Intune and M365 automation notifications |
| Team Email | pandh-m365-automation@pandh.ca |
| Privacy | Public |
Azure Automation
Azure Automation Account
Create the Automation Account
| # | Action |
|---|
| 1 | Sign in to the Azure Portal (portal.azure.com) |
| 2 | Search for Automation Accounts and click Create |
| 3 | Configure the account with the parameters below |
| 4 | Click Review + Create, then Create |
| Parameter | Value |
|---|
| Account Name | pandh-m365-automation |
| Resource Group | pandh-m365 |
| Region | Canada East or Canada Central |
| Identity | System-assigned Managed Identity |
| Connectivity | Public |
Assign Graph API Permissions
The Automation Account's Managed Identity needs two Microsoft Graph API permissions to read token data and send notification emails.
| # | Action |
|---|
| 1 | Open PowerShell 7 as a local administrator. Install from aka.ms/powershell if not present. |
| 2 | Run the attached script: PandH_Azure_Automation_Permissions.ps1 |
| 3 | When prompted, authenticate with your Work or School account |
| 4 | The script will assign the required Graph API permissions to the pandh-m365-automation Managed Identity |
| Graph API Permission | Purpose |
|---|
| DeviceManagementServiceConfig.Read.All | Read DEP / VPP / APNs token data from Intune |
| Mail.Send | Send notification emails via Microsoft Graph |
Set Up Automation Account Variables
| # | Action |
|---|
| 1 | In the Azure Portal, navigate to the pandh-m365-automation Automation Account |
| 2 | Under Shared Resources, click Variables |
| 3 | Click + Add a variable and create the two variables below |
| Variable Name | Type | Value | Encrypted |
|---|
AppleMonitor-MailSenderUPN | String | Email address of the sender — use the group email created above (e.g., pandh-m365-automation@pandh.ca) | No |
AppleMonitor-Recipients | String | Comma-separated list of recipient email addresses to receive alerts (e.g., admin@pandh.ca, helpdesk@pandh.ca) | No |
Create the Runbook
📎 Before you start
Steps 4 and 5 require the PowerShell script file Apple Monitor RunBook PowerShell.ps1. This script is provided separately by Cantabria Consulting alongside this guide. Make sure you have it open and ready before continuing.
| # | Action |
|---|
| 1 | Navigate to the pandh-m365-automation Automation Account in the Azure Portal |
| 2 | Click Runbooks, then Create a Runbook |
| 3 | Set Runbook name = PandH-AppleMonitor and Type = PowerShell 7.2 |
| 4 | Open the provided file Apple Monitor RunBook PowerShell.ps1 and copy the entire script contents |
| 5 | Paste the script into the Runbook editor and click Save |
| 6 | Click Test Pane → Start to execute a test run |
| 7 | Confirm the run completes with a green Completed status and the output report is visible in the pane |
| 8 | Check the recipient inboxes to confirm the notification email was received |
| 9 | Return to the Runbook editor and click Publish to make the Runbook production-ready |
Create a Schedule
| # | Action |
|---|
| 1 | In the Runbook, click Schedules, then + Add a schedule |
| 2 | Click Link a schedule to your Runbook, then Create a new schedule |
| 3 | Set the recurrence to Weekly — recommended: every Monday at 08:00 local time — then click Create |
| 4 | Azure will automatically present a Parameters and run settings dialog. Leave the defaults as-is (the runbook reads its settings from the variables you created earlier) and click OK |
Results
What You Get
Once deployed, the AppleMonitor Runbook executes automatically on your configured schedule and sends email notifications to your designated recipients.
✓ Automated Email Report Includes
Apple ADE/DEP token expiration date and remaining days to expiry · Apple VPP token expiration date and remaining days to expiry · Apple APNs certificate expiration date and remaining days to expiry.
This automation reduces operational risk by providing proactive visibility into Apple token and certificate health before a service interruption occurs — no more manual portal checks, no more surprised admins.