Third-Party Update Considerations with Cloud Management Gateway (CMG) in SCCM

Third-Party Update Considerations with Cloud Management Gateway (CMG) in SCCM

In this video guide, Cody Mathis and Justin Chalfant from Patch My PC will review common issues that can arise with third-party patch management through Cloud Management Gateway in Microsoft Configuration Manager (SCCM).

We will review common issues that can arise with third-party updates such as content not distributed to CMG, CMG authentication to the SUP site system, certificates, content lookups, policy, and more.

Helpful Resources

Deploy Cloud Management Gateway as a Virtual Machine Set in Configuration Manager 2111— wildcard cert method

Deploy Cloud Management Gateway as a Virtual Machine Set in Configuration Manager 2111— wildcard cert method

As we know beginning in Configuration Manager 2107, the virtual machine set option for cloud management gateway is out of preview.

Deprecated features — Configuration Manager | Microsoft Docs

Classic Cloud deployments for the CMG will now be considered deprecated after March 1, 2022.

I’m deleting my classic cloud deployment. Let’s deploy a Virtual Machine set CMG.

Here are MS Docs notes on Planning for the Virtual Machine Sets Deployment:

Plan for CMG — Configuration Manager | Microsoft Docs

Ensure the following Resource Providers are enabled when using Virtual Machine sets:

Microsoft.Compute

Microsoft.Network

Microsoft.Storage

Microsoft.KeyVault

Some more Notes:

Configure Azure AD for CMG — Configuration Manager | Microsoft Docs

Planning for Server Auth. How it can affect the Service/Deployment and Cert Naming

CMG server authentication certificate — Configuration Manager | Microsoft Docs

Essentially, it’s not that different from the prior method. We have to ensure additional resource providers are enabled, pick a service name namespace is now so for example, and so on. My service name will be

There is also a new option available to convert your CMG from classic cloud to virtual machine sets via the console.. The pre-requisites are obviously still applicable. We will revisit that in a different post.

Here is how I constructed it in my lab, and the proper entries:

External DNS Entry in google domains

Internal DNS Entry in Microsoft DNS

I’ve deleted my Classic CMG in the lab:

Begin Deployment of Virtual machine set CMG:

I also re-used my previously created azure ad apps.

External DNS Entry in google domains

Internal DNS Entry in Microsoft DNS

We are using the same wildcard cert we used when we deployed the Classic Cloud CMG. in PFX format.

Obviously the same pre-reqs are in place. So we need to ensure the Cloud Management Gateway Connection Point is deployed, and CMG Traffic is enabled on both SUP and MP.

Management Point

Software Update Point

Voila

Until next time.

Microsoft’s Cloud Management Gateway (CMG): 8 of Our Most Frequently Asked Questions

Arraya Insights | January 6, 2022

While some employees are slowly returning to the office, a generous portion of the workforce is still logging in remotely. In some capacity, remote work is here to stay indefinitely.

As more companies become acquainted with a hybrid workforce, they’re often met with challenges related to managing their remote clients, enabling endpoint protection, distributing software, and more. With Microsoft’s Cloud Management Gateway, users can safely manage remote clients without exposing their on-premises infrastructure to the internet.

So, what is Cloud Management Gateway?

Cloud Management Gateway, or CMG for short, is a cloud extension of Microsoft Endpoint Configuration Manager that enables remote systems’ management without VPN (Virtual Private Networks) and without an extensive certificate requirement.

Cloud Management Gateway FAQ’s:

If you’re considering CMG for your business or organization, we’ve broken down the most frequently asked questions we receive so you know what to expect:

Do I need certificates?

Yes, a trusted third-party certificate or public key infrastructure (PKI) certificates are required to create a secure communication between your on-premises Configuration Manager and the CMG resources that are primarily hosted in Azure. As far as the client certificates, plan to enable certificate enrollment for the workstations when domain joined.

Please note that the use of certificates is less than a traditional SCCM Internet Based Computer Management (IBCM) configuration when using modern authentication and enhanced http in MECM (Microsoft Endpoint Configuration Manager). This configuration does not require that the management point be converted to operate only with https.

Where would a CMG get installed?

The CMG is configured as a site system role, using the Configuration Manager console and with the use of an active Azure tenant. The resources used by the CMG are provisioned in the Azure cloud.

Are there fees associated with running the CMG?

Yes, there are compute fees for the virtual machine scale sets and egress fees for non-Microsoft provided content.

Do I need an Azure Cloud subscription?

Yes, there are Azure resources used for various purposes. In addition to authentication tokens provided by Azure AD (Active Directory), Intune integration with Microsoft Endpoint Configuration Manager (co-management) is highly recommended but not required.

Which version of Configuration Manager is required?

2107 (July 2021 release) or later, is required to support the current features and deployment practices for the CMG.

What is enhanced http or e-http?

E-http allows you to secure sensitive client communication without the need for PKI server authentication certificates. Clients can securely access content from distribution points without the need for a network access account, client PKI certificate, or Windows authentication.

Do I still need a split-tunnel VPN configuration for my Microsoft content?

Yes. To keep the costs down when utilizing Azure stored content and make this fully independent of on-premises content, this configuration is recommended to allow Microsoft edge content locations to download the content when connected to VPN. Microsoft related content provided in this configuration is not billed as egress when servicing internet-based clients.

How does this change my non-Microsoft content delivery?

When completely disconnected, the client will negotiate the state and switch to internet managed. Internet managed devices are configured to get Microsoft updates through Microsoft resources. As far as non-Microsoft content is concerned, the client will be able to only get content that is distributed to the CMG Servers in Azure, also known as a Virtual Machine Scale Set.

Next Steps: Enhance Your Remote Environment

CMG provides users with a straightforward way to manage Configuration Manager clients remotely so clients can seamlessly access on-premises site roles whether on the intranet or internet. As the workforce continues to rapidly change, it’s important that your business takes advantage of the latest means to support your employees.

For more information on Cloud Management Gateway, contact an Arraya expert today to start a conversation.

Visit to connect with our team now.

Comment on this and all of our posts on: LinkedIn, Twitter and Facebook.

Follow us to stay up to date on our industry insights and unique IT learning opportunities.