The APNS (Apple Push Notification Service) certificate gives MaaS360 certain permissions over enrolled devices that allow for implementing policy and pushing configurations remotely. This is also required for certain features such as marking devices lost and clearing activation lock.