oeltayeb.com · Configuration Manager (SCCM) Toolkit

Checklist

Cloud management gateway checklist

Based on the article: Cloud management gateway: deploying a CMG and fixing client connectivity · 5 min read

A cloud management gateway (CMG) lets Configuration Manager clients on the internet reach your management points and software update points without a VPN, and without publishing anything on-premises. In this post I'll deploy one on an Azure virtual machine scale set, show what healthy looks like at both ends, and track down clients that won't connect.

How it works and prerequisites

Clients reach the CMG in Azure over HTTPS on port 443.

  • Deployment model: a virtual machine scale set. Version 2203 removed the cloud service (classic) option.
  • Azure: a subscription and a Subscription Owner account for the wizard.
  • Microsoft Entra integration: connect the site to your tenant under Administration › Cloud Services › Azure Services (Cloud Management). This registers a server app and a client app.
  • Server authentication certificate: a .pfx file that includes the private key. Its common name becomes the CMG service name and must be globally unique in Azure.
MethodSuitsNotes
Microsoft Entra ID tokenEntra joined and hybrid joined devicesThe management point needs HTTPS or Enhanced HTTP
PKI client certificateEstates that already issue client certificatesAdd the trusted root chain to the CMG. Publish a CRL, or turn off revocation checking
Bulk registration tokenDevices that can't use either of the aboveIssued by the site and passed to ccmsetup at install time

+1 more points in the full article.

Checklist

  1. 1

    Get the server authentication certificate

    A public CA certificate is trusted by Windows out of the box and uses your own name, such as contosocmg.contoso.com. You then need a DNS CNAME that points that name at the deployment name: the same prefix plus the region's Azure domain, here contosocmg.westeurope.cloudapp.azure.com.

  2. 2

    Create the CMG

    • At the top-level site, go to Administration › Cloud Services › Cloud Management Gateway and select Create Cloud Management Gateway.
    • On General, choose the Azure environment and your Microsoft Entra tenant, sign in as Subscription Owner and pick the subscription.
    • On Settings, browse to the .pfx file. The service and deployment names come from its common name; with a wildcard certificate, replace the asterisk with your prefix. Choose a region and a resource group. An existing resource group must be in the same region, or the deployment fails.
    • For the VM size, Standard (A2_v2) is the default, Large (A4_v2) carries more clients per VM, and Lab (B2s) is for tests only. You can run from one VM instance (the default) up to 16.
    • Add trusted roots only for PKI client certificates, and keep Verify Client Certificate Revocation only if your CRL is published on the internet. Keep Enforce TLS 1.2, plus the cloud distribution point option if clients need content.

    Watch the Status column until the CMG is ready. CloudMgr.log on the site server tracks the deployment, and CMGSetup.log covers the setup in Azure.

    +1 more in the full article.

  3. 3

    Add the CMG connection point

    Under Administration › Site Configuration › Servers and Site System Roles, select a server, choose Add Site System Roles, select Cloud management gateway connection point and pick your CMG. With PKI client authentication, this server needs a client certificate too.

  4. 4

    Allow CMG traffic on the client-facing roles

    For each management point and software update point that serves internet clients, open its properties and select Allow Configuration Manager cloud management gateway traffic. With PKI client certificates, also set the primary site's Communication Security tab to Use PKI client certificate (client authentication) when available.

  5. 5

    Bring clients onto the CMG

    In client settings, set Cloud Services › Enable clients to use a cloud management gateway to Yes. Existing clients learn about the CMG from their management point while they're on the intranet, then use it when they leave. Devices that have never been on the network need an internet install, for example with a bulk registration token:

    cmd
    REM Site server (bin\x64 folder): create a token
BulkRegistrationTokenTool.exe /new

REM Device: install via the CMG (use your CMG's exact path)
ccmsetup.exe /mp:https://contosocmg.contoso.com/CCM_Proxy_MutualAuth/<ID> CCMHOSTNAME=contosocmg.contoso.com/CCM_Proxy_MutualAuth/<ID> SMSSiteCode=<site code> /regtoken:<token>

Verify

On the server side:

  • SMS_Cloud_ProxyConnector.log on the connection point shows connections to the CMG being set up without repeated failures. CMGService.log records the service side in Azure.
  • The CMG Connection analyzer on the ribbon tests a Microsoft Entra user or a client certificate end to end.
  • LocationServices.log and ClientLocation.log list the CMG as an internet management point, with a path containing CCM_Proxy_MutualAuth or CCM_Proxy_ServerAuth.
  • CcmMessaging.log shows policy requests to the CMG succeeding. For new installs, ClientIDManagerStartup.log shows the client registering.
  • A machine policy cycle completes, and Software Center lists the expected deployments.

Tips & gotchas

SymptomLikely causeWhere to look
Deployment fails or never becomes readyResource group in another region, name already taken, account not Subscription Owner, or a required resource provider (compute, network, storage, key vault) not registeredCloudMgr.log
CMG is ready, but the connection point won't connectA proxy or firewall blocks outbound traffic, or the PKI client certificate is missingSMS_Cloud_ProxyConnector.log
Client never tries the CMGClient setting off, management point not allowed for CMG traffic, or the client hasn't been on the intranet since the CMG was createdLocationServices.log
Client reaches the CMG but authentication failsCertificate root not trusted, revocation checking on without a public CRL, device not Entra joined or hybrid joined (token auth), or management point not on HTTPS or Enhanced HTTPCcmMessaging.log, ClientIDManagerStartup.log, Connection analyzer
Policy works but content doesn't downloadContent isn't enabled on the CMG or isn't on it. The management point only offers the CMG when it holds the contentDistribute content to the CMG
  • Track the server certificate's expiry date, because an expired certificate cuts off every internet client at once. The CMG also lets Intune-enrolled devices get the client in a co-management rollout.

Microsoft Learn references