Endpoint integration with ABM - All devices now non compliant

[km1990199]

In June we updated an expired certificate and now it's not allowing devices to connect to Endpoint Manager or receive any form of commands or application updates. Majority of devices are now showing as non-compliant. 

1 - Apple Business Manager and Endpoint Manager sync is correct and token is the latest but I assume this only affects enrolment. 

2) Devices can be enrolled but wanted to show this step was covered. 

3) Apple VPP Token properties is showing as below. It shows the correct Apple ID also at this point. 

4) MDM Push Certificate has been updated also, but I don't know if this would affect the devices connecting to InTune and reporting to Endpoint manager. 

I'm really confused because all of the signs inside of Endpoint Manager look correct, I've followed full re-installation guides step by step and I feel like I'm missing something? 

Anyone experience this before? 

Regards,

Kurtis

[#2]

@km1990199 

Never see this before, first i would see what are not compliant, you should be able to see it and click on device who is not compliant or in grace period on each device you should see like this

If nothing there you should raise a ticket at Microsoft.

[#3]

@Mathg76 Thanks for the reply, I think we know what's causing it. The cert was generated as new from Apple Business Manager/Apple Cert manager instead of renewing the old cert. 

Problem is getting back into the correct cert manager. Struggling with that currently. 

[#4]

Hi.
Well those certs drive me nuts sometimes but its a safe way to see if device is ok in the system.
Thanks for the news! i appreciate it!

[#5]

If the certificates have been expired and you generate a new cert you need to re-enroll the devices to be able to manage those again.

In some cases Apple can re-activate the old certificate based on how many devices that are affected and when in time it expired.

Good luck, been there and needed to re-enroll all devices.

[#6]

@Martin Front Yeah that looks the way, unfortunately the original configurators decided to use a personal phone for 2FA into the cert system. So now Apple won't allow us back into that system to renew the cert and re-upload it. 

[#7]

I assume we´re talking about the APN-certificate here (what you refer to as MDM Push certificate). That´s the most crucial certificate to manage.

If you don´t get any help from Apple you need to re-enroll all devices, you have two options there:
1. Do a full reset of the device and go through the automated enrollment again to have it in supervised mode.

2. Re-enroll the devices manually with company portal, it will not be supervised but at least you can manage the devices in some way and the users don´t need to reset their devices.

And over time you can reset the devices when it comes in for change or whatever. But you do lose the supervised features.