Glossary
APNs
APNs, the Apple Push Notification service, is the channel every Apple MDM uses to wake up a managed device. The MDM server can't talk to an iPhone directly: it sends a push through APNs, and the device then contacts the server to fetch its commands. Each MDM needs an APNs certificate, renewed every year.
How it works
Apple's MDM protocol is pull-based. The server never opens a connection to the device. Instead it queues a command (install this app, lock the screen, report the installed profiles), then asks APNs to notify the device. The device keeps a persistent connection to Apple's push servers, receives the notification, and checks in with the MDM over HTTPS to collect what's waiting.
That push channel needs a certificate. The MDM vendor generates a signed request, you upload it to the Apple Push Certificates Portal with an Apple Account belonging to your organization, and Apple returns a certificate valid for 365 days. The MDM uses it to authenticate to APNs on your behalf. Push traffic itself leaves your network on TCP port 5223 toward Apple's 17.0.0.0/8 range, with 443 as fallback.
There's a detail that trips people up. The certificate is tied to the Apple Account that created it. Renew it with the same account and devices keep working. Create a brand new certificate with another account and every device has to be re-enrolled.
Why it matters for a fleet
If APNs is unreachable, your MDM goes silent. Commands queue on the server but nothing reaches the device. The two usual causes are a firewall that blocks port 5223 (common on guest Wi-Fi and some industrial sites) and an expired certificate that nobody renewed.
The expiry case is painful. Devices already enrolled stop responding to new commands, and the fix is to renew the certificate in the portal and upload it back to the MDM. Apple sends reminder emails 30 days out, but they go to whoever created the certificate, sometimes an admin who left two years ago. Use a shared IT mailbox for that account and put the renewal date in your calendar.
APNs is not the same as app notifications. Your business apps use the same service, but with their own certificates managed by the developer, not by the MDM.
How Appaloosa handles it
Appaloosa walks you through the APNs setup during onboarding: download the signing request from the console, upload it to Apple's portal, bring the certificate back. The console shows the expiry date and warns you ahead of time. Once the certificate is in place, commands sent from Appaloosa reach devices within seconds, which is what makes remote lock, wipe and silent app updates practical on the iOS and iPadOS fleet.
Explore
See the full platform
Enrollment, apps, security, remote support: all in one place.
Explore Appaloosa →See Appaloosa run on your fleet Book a demo