Intune Apple Enrollment Program Tokens Test

Apple Enrollment Program Token (EPT) serves as a bridge between organization's Intune account and Apple Business Manager or Apple School Manager portal. EPT enables you to enroll Apple devices (such as iPhones, iPads, and Mac books) into organization's management system seamlessly.

Microsoft Intune uses EPT to authenticate and enroll Apple devices into the Intune service. These tokens are specifically designed for scenarios where bulk enrollment is required or when direct user credentials might not be available or suitable for enrollment. EPT centralizes device management and ensures consistent configurations across the enrolled devices within the Intune environment. The tokens come with expiration dates or limited usage quotas and are required to be renewed/replaced before they expire to ensure seamless enrollment and management of the Apple devices. This is why, administrators should know when the tokens are about to expire or have reached their usage limits. The Intune Apple Enrollment Program Tokens test helps administrators in this regard!

This test auto-discovers the enrollment tokens used by Intune for enrolling and managing Apple devices and captures the expiry status and type of each token. In addition, this test also reveals how many days are left for each token to be expired. This way, the test proactively alerts administrators if any token is nearing expiry. This test also reports the count of Apple devices that are enrolled using each token and the error codes (if any) thrown during enrollment process. By analyzing these details, administrators can find out if any token reached its maximum number of device enrollments and arrive at potential solutions for the errors encountered during the enrollment process.

Target of the Test: Microsoft Azure Intune

Agent deploying the test: A remote agent

Output of the test: One set of results for each enrollment program token used by the Azure Intune

Configurable parameters for the test
Parameters	Description
Test Period	How often should the test be executed.
Host	The host for which the test is to be configured.
Tenant ID	Specify the Directory ID of the Azure AD tenant to which the target subscription belongs. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API.
Client ID, Client Password, and Confirm Password	To connect to the target subscription, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.
ProxyHost and ProxyPort	In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the ProxyHost and ProxyPort parameters. By default, these parameters are set to none, indicating that the eG agent is not configured to communicate via a proxy, by default.
ProxyUsername, ProxyPassword, Confirm Password	If the proxy server requires authentication, then, specify a valid proxy user name and password in the Proxy Username and Proxy Password parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box. If no proxy server is used, or if the proxy server used does not require authentication, then the default setting - none - of these parameters, need not be changed.
DD Frequency	Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.
Detailed Diagnosis	To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled: The eG manager license should allow the detailed diagnosis capability Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measurement

Description

Measurement Unit

Interpretation

Token expiration status

Indicates the current state of the expiration of this enrollment token that was used to enroll dedicated Apple devices.

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value	Numeric Value
Good	0
Warning	1
Error	2
Critical	3

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the current expiration state of this token. The graph of this measure however, is represented using the numeric equivalents only - 0 to 3.

Token type

Indicates the type of this token that was used to enroll dedicated Apple devices.

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value	Numeric Value
Not available	0
Dep	1
Apple School Manager	2

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the type of each token. The graph of this measure however, is represented using the numeric equivalents only - 0 or 2.

Days until expiration

Indicates the number of days left for the expiry of this enrollment token that was used to enroll dedicated Apple devices.

Number

A high value is desired for this measure.

A very low value for this measure indicates that the token is nearing expiry. You may have to request for a license extension if you want to continue using the token.

Synced devices count

Indicates the number of Apple devices that were enrolled using this token.

Number

Compare the value of this measure across tokens to identify the token using which maximum number of devices were synced.

Last sync error code

Indicates the error code reported while enrolling the devices using this token during the last measurement period.

Number

Error codes can indicate various issues encountered during the enrollment process.

0x80180014 - This error occurs when the enrollment token used for device enrollment has reached its expiration date. It's important to generate a new token with an updated expiration date and re-enroll the device.

0x80180015 - This error typically indicates that the enrollment token used during device enrollment is incorrect or has been revoked. Double-check the token used and ensure it hasn't been deleted or invalidated in the Intune console.

0x80180016 - This error suggests that the enrollment token has reached its maximum limit of device enrollments. Generating a new token or increasing the maximum number of uses for the existing token might be necessary.

0x80180017 - This error occurs when trying to use an enrollment token before its scheduled start date. Ensure that the token is valid for use at the current time and date.

0x80180018 - This error may indicate that the device requires user authentication in addition to the enrollment token. Ensure that the device setup process includes the necessary user authentication steps.

0x80180019 - This error might occur if the device type or the method used for enrollment is not supported by the token. Verify the compatibility of the token with the device type and enrollment method.

Administrators can troubleshoot these errors by reviewing the Intune console logs or event viewer logs on the device. It provides more specific details about the error and potential solutions. Additionally, checking the validity, settings, and usage limits of the enrollment token within the Intune console can help resolve many of these issues.