When managed devices sit behind a corporate firewall or proxy, certain endpoints have to be reachable or enrolment, policy delivery and push notifications stop working. This article lists what to allow, per platform, and the route-level detail for teams that cannot allowlist a whole domain.
Overview
All traffic is outbound HTTPS from the device. No inbound firewall rules are needed on the device side.
Every account has its own MDM server:
[company slug].mdm.getprimo.com
Devices connect to that host to enrol and to receive commands. Allow outbound TCP 443 to it.
Windows, Linux and Android need nothing else. Apple needs more, because Apple devices are woken by Apple's own push service.
The short version
| Endpoint | Port | Needed for |
| [company slug].mdm.getprimo.com | 443 | Every platform |
| *.push.apple.com | 443, 2197 | Apple push notifications |
| albert.apple.com | 443 | Apple device activation |
| deviceenrollment.apple.com | 443 | Apple automated enrolment |
| mdmenrollment.apple.com | 443 | Apple MDM enrolment |
| iprofiles.apple.com | 443 | Apple profile delivery |
How to use — Apple
Apple MDM depends on the Apple Push Notification service to wake a device when a command is waiting. Block APNs and devices simply never hear about commands.
Allow the five Apple hosts in the table above, plus your MDM server.
On older networks that block non-standard HTTPS ports, also allow TCP 5223 outbound to *.push.apple.com. If you are not sure whether yours does, allow it.
Apple maintains the full list at Use Apple products on enterprise networks (https://support.apple.com/en-gb/101555).
How to use — Windows, Linux and Android
The agent talks outbound on port 443 to your MDM server and nothing else. There are no extra endpoints.
Route-level allowlisting:
If you run a reverse proxy or a firewall with path rules and would rather not allow a whole domain, allow these routes instead.
Devices that roam outside the VPN or intranet need only the osquery endpoints:
/api/osquery/*
/api/v1/osquery/*
macOS
| Route | Purpose |
| /mdm/apple/scep | Device obtains a SCEP certificate |
| /mdm/apple/mdm | Device speaks the MDM protocol |
| /api/mdm/apple/enroll | Device fetches an enrolment profile |
| /api//fleet/device/ | Employee device page: manual enrolment, key rotation |
| /mdm/sso, /api//fleet/mdm/sso, /mdm/sso/callback, /api//fleet/mdm/sso/callback, /assets/* | Employee identity provider sign-in during setup |
| /api//fleet/mdm/setup/eula/ | Employee accepts the EULA during setup |
| /api/*/fleet/mdm/bootstrap | Bootstrap package installation |
/mdm/apple/scep and /mdm/apple/mdm sit outside /api because they implement Apple's MDM protocols rather than a REST API.
Windows
| Route | Purpose |
| /api/mdm/microsoft/management | Device receives commands and profiles |
| /api/mdm/microsoft/discovery | Device discovers MDM server details |
| /api/mdm/microsoft/policy | Enrolment policies for certificate issuance |
| /api/mdm/microsoft/enroll | WS-Trust X.509v3 token enrolment (MS-WSTEP) |
| /api/mdm/microsoft/tos | Terms of Service during automated enrolment |
| /api/mdm/microsoft/auth | Employee authentication during automated enrolment |
iOS and iPadOS
| Route | Purpose |
| /enroll | Employee reaches the enrolment page |
| /api/*/fleet/enrollment_profiles/ota | Device downloads an enrolment profile |
| /api//fleet/software/titles//inhouseapp | In-house .ipa deployment |
Android
| Route | Purpose |
| /enroll | Employee reaches the enrolment page |
| /api/*/fleet/androidenterprise/enrollmenttoken | Enrolment token from the Android Management API |
| /api/*/fleet/android_enterprise/pubsub | Enrolment and status notifications |
| /api/fleetd/* | Certificate deployment for Wi-Fi and VPN |
SCEP proxy — if you use Factorial IT as a SCEP proxy, also allow /mdm/scep/proxy/*.
Mutual TLS
The /api//fleet/ routes support mTLS using the certificate issued when the agent was packaged. /mdm/apple/mdm and /api/mdm/apple/enroll support mTLS using the SCEP certificate issued by the server.
These endpoints do not use mTLS:
/mdm/apple/scep
/api/mdm/microsoft/discovery
/api/mdm/microsoft/auth
/api/mdm/microsoft/policy
/api/mdm/microsoft/enroll
/api/mdm/microsoft/management
/api/mdm/microsoft/tos
On macOS and Windows the client sends its certificate in a request header, and the server verifies it independently.
Tips and best practices
- Allow the Apple hosts before your first Mac enrolment, not after it fails. APNs being blocked looks exactly like a broken MDM, and it is the single most common cause of "commands do nothing".
- Allow TCP 5223 if you are unsure about your network. It costs nothing and removes a whole class of intermittent failure on older networks.
- Prefer domain-level allowlisting where your security team permits it. The route list changes as the product does; a domain rule does not.
- Cover devices that leave the office. Home and café networks are outside your firewall, so exposing the osquery endpoints is what keeps roaming devices reporting.
Troubleshooting and FAQ
Troubleshooting
- Apple devices enrol but never act on commands. APNs is blocked. Allow *.push.apple.com on 443 and 2197, and add 5223 if your network restricts non-standard ports.
- Enrolment fails on Apple during device setup. One of the enrolment hosts is unreachable. Check deviceenrollment.apple.com, mdmenrollment.apple.com and iprofiles.apple.com.
- A Windows or Linux device installs the agent then reports nothing. The device cannot reach your MDM server on 443. That host is the only endpoint those platforms need, so start there.
- Devices report only from the office. The osquery endpoints are not reachable from outside the network. Allow /api/osquery/ and /api/v1/osquery/.
FAQ
-
Do we need inbound firewall rules?
No. Every connection is outbound from the device.
-
Which platform needs the most endpoints?
Apple. Windows, Linux and Android only need your MDM server.
-
Can we allowlist routes instead of whole domains?
Yes — the route tables above cover it. Just be aware routes change as the product does.
-
Do we still need port 5223?
Only on older networks that block non-standard HTTPS ports. Allowing it is harmless.