diff --git a/server/service/apple_mdm_test.go b/server/service/apple_mdm_test.go
index 727af30281..e21773967a 100644
--- a/server/service/apple_mdm_test.go
+++ b/server/service/apple_mdm_test.go
@@ -159,8 +159,6 @@ func TestAppleMDMAuthorization(t *testing.T) {
 		checkAuthErr(t, err, shouldFailWithAuth)
 		_, err = svc.ListMDMAppleDEPDevices(ctx)
 		checkAuthErr(t, err, shouldFailWithAuth)
-		_, err = svc.NewMDMAppleDEPKeyPair(ctx)
-		checkAuthErr(t, err, shouldFailWithAuth)
 		_, _, err = svc.EnqueueMDMAppleCommand(ctx, &fleet.MDMAppleCommand{Command: &mdm.Command{}}, nil, false)
 		checkAuthErr(t, err, shouldFailWithAuth)
 	}
@@ -185,4 +183,8 @@ func TestAppleMDMAuthorization(t *testing.T) {
 	require.NoError(t, err)
 	_, err = svc.GetMDMAppleInstallerDetailsByToken(ctx, "foo")
 	require.NoError(t, err)
+	// Generating a new key pair does not actually make any changes to fleet, or expose any
+	// information. The user must configure fleet with the new key pair and restart the server.
+	_, err = svc.NewMDMAppleDEPKeyPair(ctx)
+	require.NoError(t, err)
 }