Profile Manager-Router Ports

Port 1640 is strictly for certificate retrival; not profiles. It's barely used in most cases. It is worthless without combined access to 443 externally.

APNS is just a signally system. It just tells devices that there is a new profile for them to get from the server via 443. It does not deliver profiles themselves. So if you want devices on the Internet and not your local internal network to get profile changes then you must open both 443 and 1640.

APNS can send lock, remote wipe and messages to devices though. Just none of the other profile changes you might make.

So you cannot avoid having the Profile Manager interface exposed to the Internet if you want devices to retrieve changed profiles from the Internet as they share the same port; 443.

Crud. Thanks for the information, albeit not what I was hoping for. I think it's crazy to enable a web-based adminstrative interface and any TBD vulnerabilites to the billions of users on the Internet. Not to mention the risk, which I can't control, of administrators using personal insecure/comprimized systems to login to said interface, exposing administrative credentials to our network.

There are several popular and highly regarded public cloud-based MDM systems which take the responsibility away from you. One that's free is Cisco's Meraki. You may wish to look at this instead of Profile Manager if you feel that you cannot trust it. Meraki is hugely popular and very trusted. You do not need to allow any inbound contact to your private network with such a solution.