How to Setup SCCM Cloud Management Gateway

In this post I will cover the steps to setup a cloud management gateway (CMG) in SCCM. I have got Configuration Manager 1902 in my setup and I will use the same to configure the CMG.

Setting up the cloud management gateway in Configuration Manager 1902 is very easy. If you are using earlier versions of SCCM such as SCCM 1802 or SCCM 1806 you might not see some options that are included in SCCM 1902.

What is Cloud Management Gateway in SCCM

The cloud management gateway also known as CMG, that provides a simple way to manage Configuration Manager clients on the internet. When you deploy the CMG as a cloud service in Microsoft Azure, you can manage internet clients without additional infrastructure.

The biggest advantage of cloud management gateway in SCCM is you don’t need to expose your on-premises infrastructure to the internet. If you are planning to use CMG, I would suggest you to read this article by Microsoft.

The CMG uses Azure Cloud Services as PaaS, this service uses virtual machines (VMs) that will involve compute costs. By default the CMG uses a Standard A2 V2 VM.

When you create a CMG, you select how many VM instances support the CMG. By default it 1 and 16 is the maximum. But the question is how many such VM’s do you actually require ?. That’s answered here.

CMG Ports and Data Flow

When you plan to setup CMG, you don’t need to open any inbound ports to your on-premises network. The service connection point and CMG connection point are the ones that initiate all communication with Azure and the CMG.

The service connection point deploys and monitors the service in Azure, hence it must be in online mode. The CMG connection point connects to the CMG to manage communication between the CMG and on-premises site system roles.

For complete information about cloud management gateway ports, read this article.

SCCM Cloud Management Gateway Setup Requirements / Prerequisites

Here are the important requirements or prerequisites for SCCM CMG :-

• First of all you need an Azure Subscription to host the cloud management gateway.
• If you are deploying CMG, you need a Subscription Admin. To integrate the site with Azure AD for deploying the CMG using Azure Resource Manager, you need a Global Admin.
• Ensure the SCCM service connection point is in online mode.
• Integration with Azure AD for deploying the service with Azure Resource Manager.
• If you ask me use at-least SCCM 1806 and above if you are creating a CMG in your setup. I will explain the reason for this in next section.
• You need at-least one on-prem Windows Server to host the CMG.

Certificates for Configuration Manager Cloud Management Gateway

One thing that you must really work on is the CMG certificates. I have not included this info under CMG prerequisites section because this topic is quite complex. However I will try my best to make it easy for you.

• CMG server authentication certificate
• CMG trusted root certificate to clients
• Server authentication certificate issued by public provider / Enterprise PKI
• Client Authentication Certificate
• Client trusted root certificate to CMG
• HTTPS certs for Management Points
• Azure Management Certificate

CMG Server Authentication Certificate

The CMG server authentication certificate is required while creating the CMG in the Configuration Manager console. When you setup a CMG, it basically creates a HTTPS service to which your internet clients connect.

For a valid CMG server auth cert, you can either acquire a certificate from a public provider or issue it from your public key infrastructure (PKI). In this post, I will be issuing the cert from my PKI.

If you are using SCCM 1802 and above, you can use a wildcard certificates as CMG server cert. Before you create this certificate, ensure the Azure domain name that you use is unique.

CMG trusted root certificate to clients

This certificate is for clients that must trust the CMG server authentication certificate. There are two methods to accomplish this :-

• Use a certificate from a public and globally trusted certificate provider.
• Use a certificate issued by an enterprise CA from your public key infrastructure (PKI).

Client trusted root certificate to CMG

You supply this root certificate when you setup the cloud management gateway in the Configuration Manager console. The CMG must trust the client authentication certificates. If you’re using PKI client authentication certificates, then you must add a trusted root certificate to the CMG.

HTTPS certs for Management Points

To configure HTTPS on Management points requires PKI and this topic is huge. Don’t worry, I have covered step-by-step deployment of the PKI certificates for SCCM here.

Azure management certificate

The Azure management certificate is required for classic service deployments. With SCCM 1810 and above the classic service deployments in Azure are deprecated. So start using Azure Resource Manager deployments for the cloud management gateway.

Confirm Unique Azure Domain Name

You must confirm that the Azure domain name you want is unique. You can check this in Azure portal. When you enter the DNS name, you should see either a green tick or red X. Green tick means yes the domain name is available and red X means it is not available.

Login to Azure portal and select Cloud Services (classic). Click +Add button.

Enter the DNS name which should be unique as I mentioned before. In my case I see a green tick so I will be prajwalcmg.cloudapp.net will be my unique Azure domain name or DNS name.

At this post there are two options. You can skip creating this service because it will be created automatically when we setup CMG. You may also create the service and use it while setting up CMG.

Configure Azure Services for Cloud Management

We will now configure Azure cloud services that you can use with SCCM using the Azure Services Wizard. We will create web app and native client app that provide subscription and configuration details, and authenticate communications with Azure AD.

Go to Administration > Overview > Cloud Services > Azure Services. Right click Azure Services and click Configure Azure Services.

Select the Azure Services as Cloud Management and specify a name and description. Click Next.

Select the Azure environment which is AzurePublicCloud. First we will create a web app, click Browse.

In the Server App box, click Create.

In the Create Server Application box, enter the application name. It can be anything. Specify key validation period and next click Sign-in button.

You should now see a box where-in you must sign in. Once you enter the correct credentials, you Azure AD tenant name will be shown along with Signed in successfully message.

Click OK.

Select the server app that you just created and click OK.

We will now create a native client app, so click Browse.

Enter the application name and you must sign-in again. When you do that click OK.

Now we have Server and Client app created. Click Next.

You can leave this option “Enable Azure Active Directory User Discovery” selected. Click Next.

Click Next on Summary page.

Finally on Completion page, click Close.

Verify Configuration Manager Azure Service

To verify the Azure Service that you created for Configuration Manager, click Azure Services. On the right pane you should see the Azure service and Associated Azure Service which is Cloud Management.

If you click Azure Active Directory Tenants, you should see Tenant name and tenant ID. In addition to that, you will see the Application Name, Tenant ID, Client ID in the bottom pane.

Create and Issue Web Server CMG Certificate Template

In this section we will create a new custom certificate which by using the web server certificate template. At this point, if you have templates created during implementing PKI, you can simply duplicate the SCCM IIS Certificate and use it.

If not you can duplicate the web server template and configure it. This certificate will be used for the installation of the SCCM cloud management gateway.

Login to Certification Authority server, open the Certification Authority console. Right-click Certificate Templates and select Manage.

Right click Web Server and click Duplicate Template.

Click Compatibility tab and ensure the settings are same as per below screenshot.

Click General tab and specify a name to this temple. I will name it as SCCM CMG Certificate.

Click Request Handling and ensure Allow private key to be exported is checked.

Now click Security tab, add the group that contains your SCCM Primary Site server computer account. Select the group and allow Enroll permission.

For Enterprise Admins, you can uncheck Enroll permission. Click Apply and OK. Close the console.

Now right click Certificate Templates and click New > Certificate Template to Issue.

Select the SCCM CMG Certificate and click OK.

Import Web server CMG certificate on the Primary Site Server

After you have created the CMG certificate, we will now import this certificate on our SCCM server.

Login to SCCM server. Open the Certificates console (run the command certlm.msc – this saves your time). Expand Personal > Certificates. Right click Certificates > All Tasks > Request New Certificate.

From the list of certs, select SCCM CMG Certificate and click the link below it.

In the Certificate Properties dialog box, under for Subject name, select Type as Full DN. Under Alternative name, select Type as DNS and enter the service name.

Enter a public DNS name that you want to use with CMG. So I will enter *.prajwal.org here which allows me to use any subdomain for CMG.

Click General tab and specify a friendly name to this certificate and then click Apply and OK.

Click Enroll.

The certificate is enrolled successfully. Click Finish.

Export the CMG Web Server Certificate

In the above step, on the site server, you requested the CMG certificate and enrolled it. Now we will export this certificate in a .PFX format. This certificate will required while creating cloud management gateway.

Select the CMG certificate, right click and click All Tasks > Export.

On welcome to certificate export wizard, click Next.

Select Yes, export the private key. Click Next.

Make no changes here and click Next.

Enter a password and click Next.

Save the CMG certificate on your computer. Click Next.

Click Finish. This completes the CMG certificate export process.

Setup / Create SCCM Cloud Management Gateway

To create or setup cloud management gateway in SCCM –

• Launch the SCCM console.
• Navigate to Administration > Cloud Services > Cloud Management Gateway.
• Right click Cloud Management Gateway and click Create Cloud Management Gateway

You should now see the Create Cloud Management Gateway Wizard. Click Sign-in and login with your subscription admin account.

On successful sign-in you should see Subscription ID, Azure AD app name and tenant name automatically populated. Click Next

On the Settings page, click Browse and select the CMG certificate. The Service name and deployment name are populated automatically.

At this step you can use an existing resource group or create new resource group. I will go with just 1 VM instance.

You see two options and a certificates button.

• Verify Client Certificate Revocation – To understand this refer this article.
• Allow CMG to function as a cloud distribution point and serve content from Azure storage – With SCCM 1806, you get this new option. Now a CMG can also serve content to clients. This functionality reduces the required certificates and cost of Azure VMs.

I will leave both the above options checked. Next click Certificates.

You need to specify a certificate that tells CMG what certs it needs to trust. In my case I have got an PKI setup, so I will add the root certificate.

Click Next.

On the Alerts page, click Next.

On the completion page click Close.

Cloud Management Gateway Status

After you setup cloud management gateway, monitor the status in the SCCM console. Right now the status in Provisioning.

After few minutes the status is changed to Provisioning Completed. Later I will cover what log file do you need to monitor for this.

Install Cloud Management Gateway Connection Point

To install cloud management gateway connection point role in SCCM

• In SCCM console, go to Administration > Site Configuration > Servers and Site System Roles.
• Right click site server and click Add Site System Roles.

Click Next.

Check the box for Cloud Management gateway connection point. Click Next.

Select the cloud management gateway and click Next.

On the completion page, click Close.

Allow SCCM Cloud Management Gateway Traffic

You must configure the management point and software update point site systems to accept CMG traffic. Do this procedure on the primary site, for all management points and software update points that service internet-based clients.

Go Administration > Site Configuration > Servers and Site System Roles. Select the site server and in the bottom pane, right click Management point and click Properties.

Under Management Point Properties, check the box Allow Configuration Manager cloud management gateway traffic. Click OK.

Under Software update point properties, check the box Allow Configuration Manager cloud management gateway traffic. Click OK.

Allow access to cloud distribution points

Under the client settings, click Cloud Services. Under Device/User Settings, set Allow access to cloud distribution point to Yes.

Associate CMG with Boundary groups

If you are using SCCM 1902, you can associate a CMG with a boundary group. You can do this after you setup cloud management gateway. When you create or configure a boundary group, on the References tab, add a cloud management gateway.

Configure clients for CMG

Once you setup cloud management gateway and all the site system roles are running, clients get the location of the CMG service automatically on the next location request.

Most of all the clients must be on the intranet to receive the location of the CMG service. By default the polling cycle for location requests is every 24 hours. However to speed up the request, you can restart the SMS Agent Host service (ccmexec.exe) on the computer.

To troubleshoot CMG client traffic, use CMGHttpHandler.log, CMGService.log, and SMS_Cloud_ProxyConnector.log.

I will cover more about CMG troubleshooting and other stuff related to it in some other post.

Enable Remote Desktop on SCCM CMG (Cloud Management Gateway)

Once you setup the SCCM CMG, you can enable remote desktop on SCCM CMG. Once you enable remote desktop on CMG, you can the IIS log files from the CMG Virtual Machine. Here is a step by step guide on how to enable remote desktop in SCCM cloud management gateway.

Cloud Management Gateway Log Files for Troubleshooting

When you setup the SCCM cloud management gateway, you must know the CMG log files that can help you to troubleshoot CMG issues. There are very few CMG log files and I have listed all the CMG log files in this post.