Setup guide · from scratch

Create the Apple MDM Push certificate (required for all Apple management)

The MDM Push certificate is the master key that lets Intune manage ANY iPhone, iPad or Mac. Download a request from Intune, sign it at Apple's push portal, upload it back. Renew yearly with the SAME Apple ID or every device re-enrols.

one-time human step · Apple Push Certificates Portal (identity.apple.com/pushcert) + Intuneassisted guide — Decolla walks you through this

This is a one-time human step. It runs through Apple Push Certificates Portal (identity.apple.com/pushcert) + Intune, which requires an interactive sign-in no MDM or API can perform for you. Decolla keeps it frictionless: the wizard shows these exact steps at the moment you need them, and flags what to bring back (a token, a file, an ID).

Step 1. In Intune (intune.microsoft.com) go to Devices > Enrollment > Apple tab > Apple MDM Push Certificate.

Screenshot: Apple MDM Push Certificate pane in Intune (captured during a live customer build — coming to this page)

Step 2. Tick 'I agree', then click 'Download your CSR' to save the .csr file locally.

Screenshot: 'Download your CSR' link (captured during a live customer build — coming to this page)

Step 3. Go to https://identity.apple.com/pushcert and sign in with the organisation Apple ID.

Screenshot: Apple push portal sign-in (redact the ID) (captured during a live customer build — coming to this page)

Step 4. Click 'Create a Certificate', accept the terms, choose the .csr file, then click Upload.

Screenshot: 'Create a Certificate' CSR upload screen (captured during a live customer build — coming to this page)

Step 5. On the confirmation screen click 'Download' to get the .pem certificate.

Screenshot: Certificate download confirmation (captured during a live customer build — coming to this page)

Step 6. Back in Intune, enter the same Apple ID, browse to the .pem, and click Upload.

Screenshot: Intune push cert upload with Apple ID field (captured during a live customer build — coming to this page)

Step 7. Confirm Status = Active with a 1-year expiry date shown.

Screenshot: Push cert pane showing Status Active + expiry (captured during a live customer build — coming to this page)

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access