Tenant attach: managing Configuration Manager devices from the Intune admin center

Tenant attach uploads your Configuration Manager devices to the Microsoft Intune admin center. Service desk and security teams can then see them and run actions without the Configuration Manager console, and without enrolling the devices in Intune. In this post I'll cover the prerequisites, how to switch tenant attach on (with or without co-management), what you can do afterwards, and how to fix the usual problems.

Prerequisites#

• Onboarding account: a Microsoft Entra Global Administrator signs in once while you enable it. Onboarding creates an app registration and a service principal in your tenant.
• Admins who run actions: accounts synced from on-premises Active Directory, found by Microsoft Entra user discovery or Active Directory user discovery, with the Intune permission Remote tasks › Initiate Configuration Manager action. Cloud-only admin accounts only work if you turn off Configuration Manager RBAC enforcement (see step 1).
• Network: the service connection point needs outbound HTTPS to https://aka.ms/configmgrgateway, https://*.manage.microsoft.com and https://dc.services.visualstudio.com. If your proxy restricts it, also allow the Microsoft and DigiCert CRL/OCSP addresses. It holds a long-running connection to the notification service, so the proxy mustn't drop idle outbound connections too quickly. Microsoft recommends allowing three minutes.
• SMS Provider: actions run through the site's administration service, so the SMS Provider must be healthy.

Step-by-step#

1. Enable the device upload#

If co-management is already enabled, edit the existing policy rather than running the wizard again:

1. Go to Administration › Overview › Cloud Services › Cloud Attach, select the production co-management policy (CoMgmtSettingsProd by default) and choose Properties.
2. On Configure upload, select Upload to Microsoft Endpoint Manager admin center. The console still uses the older product name.
3. Keep All my devices managed by Microsoft Endpoint Configuration Manager, or pick one collection (its child collections are included).
4. Choose the optional settings: Endpoint analytics, Enforce Role-based Access Control for the devices uploading to cloud service (on by default), and uploading Microsoft Defender for Endpoint data for endpoint security reports.
5. Select Apply, sign in as a Global Administrator and accept the Create Microsoft Entra Application prompt.

If co-management isn't enabled, run Configure Cloud Attach from the same node and choose custom settings. Leave automatic client enrollment for co-management switched off, then make the same choices on Configure upload. Only devices that show Yes in the Client column are uploaded.

2. Set up RBAC on both sides#

By default, Intune RBAC and Configuration Manager RBAC are both enforced, so an admin needs permissions in each:

• Intune: a role that can read managed devices and includes Remote tasks › Initiate Configuration Manager action. A custom role is the cleanest way to give the service desk only that. See Intune RBAC and scope tags.
• Configuration Manager: a security role and scope on the device's collection that covers the action, such as Run Script for scripts or Run CMPivot for CMPivot queries.

Scope tags work differently from co-managed devices. Tenant-attached devices always carry the Default scope tag, and you can't assign other tags to them. Removing Default hides the device completely. To keep a role from seeing tenant-attached devices, such as servers, use a custom role whose assignment doesn't include the Default scope tag.

3. Work with the devices#

In the Intune admin center, open Devices › All devices. Uploaded devices show ConfigMgr in the Managed by column, and co-managed devices show Co-managed. From a device's pages you can:

• run the actions Sync Machine Policy, Sync User Policy and App Evaluation Cycle
• run approved PowerShell scripts from Configuration Manager
• install Configuration Manager applications
• query the device in real time with CMPivot
• view a timeline of events from the device

The upload also feeds Endpoint analytics and, if you enabled it, the Defender for Endpoint data behind endpoint security reports.

Verify#

• In the Intune admin center, Tenant administration › Connectors and tokens › Microsoft Endpoint Configuration Manager lists your hierarchy and its connector status. Select it to see details and a Recommendations tab with site health insights.
• Devices from the upload scope appear under Devices › All devices.
• On the service connection point, CMGatewaySyncUploadWorker.log shows uploads completing, and CMGatewayNotificationWorker.log shows actions arriving from the cloud.
• Run Sync Machine Policy on a test device. CcmNotificationAgent.log on the client records the notification, followed by a policy request.

Tips & gotchas#

• To offboard a healthy site, clear Upload to Microsoft Endpoint Manager admin center in the co-management properties. Deleting the connector from the admin center is for sites that no longer exist.
• If you import your own Microsoft Entra app instead of letting the wizard create one, the console won't warn you before its secret expires, so track the expiry yourself. Don't share one app across hierarchies.
• Tenant attach doesn't enroll anything in Intune. To apply Intune policies to these devices, you need co-management. See enabling co-management for existing clients.

References#

• Enable Microsoft Intune tenant attach: Device sync and device actions
• Microsoft Intune tenant attach: Prerequisites
• Enable cloud attach for Configuration Manager