Created by Claude - please verify

Apple certificates and tokens - DEP token data comes from a beta Graph endpoint.

Required Microsoft Graph permissions

DeviceManagementServiceConfig.Read.All DeviceManagementApps.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoints: GET /v1.0/deviceManagement/applePushNotificationCertificate · GET /beta/deviceManagement/depOnboardingSettings · GET /v1.0/deviceAppManagement/vppTokens

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Apple MDM Certificate & Token Expiry

Intune manages Apple devices through a push certificate and enrollment/app tokens that Apple lets expire every year. If the APNs certificate lapses, every iPhone, iPad and Mac stops receiving policy - and renewing it with a different Apple ID forces every device to re-enroll. DEP and VPP tokens stop new enrollments and app deployments.

Apple device management is not set up in this tenant (no APNs certificate, DEP or VPP token).