April 2022

Download and own the latest version of this SCCM Cloud Management Gateway Installation Guide in a single PDF file.

The guide was recently updated to cover the latest method of building a Cloud management Gateway with the VM Scale set. The below information cover the CMG with Cloud Service (classic) which will be retired in Q1 2023.

The PDF file is a 50 pages document that contains all information to install a cloud management gateway with SCCM. Use our products page or use the button below to download it.


We can also set up a Cloud Management Gateway for your organization through our consulting services. See our Fixed Price Plan page to see our prices.

The ConfigMgr team is working really hard to make SCCM admins job easier for some of the key components of Modern Management. Starting with SCCM 1806 release, they ease a bit the setup of the SCCM Cloud Management Gateway (CMG).

If you are new to the concept of SCCM Cloud Management Gateway, the main advantage is that it doesn’t expose your SCCM servers to the internet. The downside is that it requires an Azure subscription which brings recurring monthly costs. If you’re still unsure which method to use, you can read the Microsoft documentation and see our blog post about internet client management. Make sure that you understand the limitation of using internet clients.

We strongly encourage to use the SCCM Cloud Management Gateway if you’ll be managing client on the internet since this feature will evolve with time and the traditional way support should go away.

January 2021

This post has been updated to reflect recent addition with SCCM 2010 release.

The main new feature is Token-based authentication for clients.
Also added more tips and tricks to ease implementation

If you are not yet running SCCM 1806, but still would like to use Cloud Management Gateway, see our previous post

Here the available features supported through the Cloud Management Gateway:

In this post, we will configure an SCCM Cloud Management Gateway by using the Azure Resource Manager.

Some sections from our previous post are brought back here to ease reading.

SCCM CMG High-level steps

All steps are done directly in the SCCM console and from the Azure Portal. We will describe each step:

SCCM Cloud Management Gateway Prerequisites


 Configuring the Cloud Management gateway with SCCM 1806 remove the requirement of an Azure Management certificate

Verify a unique Azure cloud service URL

We don’t need to create the cloud service in Azure, the Cloud Management Gateway setup will create the service. We just need to verify that the Azure cloud service URL is valid and unique.

  • Log in the Azure portal
  • In the Azure Portal, select Cloud Services on the left, click Add
  • Enter the desired DNS name
  • Validate that there’s a green checkmark on the right. If your name is not valid, a red X will display, choose a different name if it’s the case
  • Once your name is valid, take note of the name as it will be needed later. We will use SCDCMG as DNS Name for our example
  • Close the window, do not create the service now
SCCM Cloud Management Gateway

Verify Azure subscription’s Resource Provider

This is not documented in the official Cloud Management gateway docs from Microsoft, but 2 resource providers are now defaulted to Not Registered for newer Azure Subscription.
To validate the status, follow these steps

  • Log in the Azure portal
  • In the Azure Portal, select Cost management and billing
  • Click on Cost Management and select Go to subscription
    • If you see multiple subscriptions, select the one that will host the Cloud Management Gateway
  • Under the section Settings, select Resource Provider
  • Make sure Microsoft.ClassicCompute and Microsoft.Storage are registered. If not, select one and click on Register

Configure the Azure Service – Cloud Management

  • Go to Administration/Cloud Services/Azure Services and select Configure Azure Services
  • Specify a name and select Cloud Management, click Next
  • In this step, the Azure Administrator will be required to create the web app and native client app. Click on Browse for the Web app
  • Click on Create
  • Click the Sign in and provide Azure administrator credentials. Default names do just fine. Click OK when login completed
  • Select the App that was just created and click OK
  • Click Browse for the  Native client app.  Click Create
  • Click the Sign in and provide Azure administrator credentials. Default names do just fine. Click OK when login completed
  • Select the App that was just created and click OK
  • Click Next
  • Chose to Enable Azure Active Directory User Discovery or not.

The Azure AD Discovery is not a requirement for Cloud Management gateway to work

  • Click Next
  • The Azure service is completed. If enabled, the AAD user discovery can be modified
  • the Azure AD Tenant is now configured

Cloud Management Gateway server authentication Certificate requirements

The certificate requirements are the most complex part of configuring the Cloud Management Gateway.

A certificate is needed between the SCCM server and the Cloud Management Gateway.

The following choices are available :

  • Use a certificate from a public trusted provider
    • This option requires a CNAME to be created in the DNS for CMGSCD.SystemCenterDudes.com to the real hostname CMGSCD.CloudApp.Net
  • Use a certificate from an enterprise CA
    • This certificate must be trusted by all computers that will connect with the Cloud Management Gateway
    • Use format <CMG name>.CloudApp.Net

The CMG server authentication certificate supports wildcards. Some certificate authorities issue certificates using a wildcard character for the service name prefix. For example, *.scd.com

For this post, we will use a certificate from an Enterprise CA.

Create and Issue a Custom Web Server Certificate Template on your Certification Authority

This procedure creates a custom certificate template that is based on the web server certificate template. The certificate will be used for the installation of the SCCM cloud management gateway and the private key must be exportable as it will be asked during installation.

  • In Active Directory, create a security group named SCCM Site Servers that contain your SCCM Primary Site server computer account
  • On the server running the Certification Authority, open the Certification Authority console (certsrv.mmc), right-click Certificate Templates and select Manage
SCCM Cloud Management Gateway
  • The Certificate Templates management console opens
  • Right-click the Web Server template and then select Duplicate Template
SCCM Cloud Management Gateway
  • In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected in Certification Authority
SCCM Cloud Management Gateway
  • In the General tab, enter a template name, like SCD SCCM Cloud Management Gateway. Change the validity period if needed. As a best-practice, the longer the validity period, the less secure is your certificate
SCCM Cloud Management Gateway
  • In the Request Handling tab, select Allow private key to be exported
SCCM Cloud Management Gateway
  • In the Security tab, remove the Enroll permission from the Enterprise Admins security group
SCCM Cloud Management Gateway
  • Choose Add, enter SCCM Site Servers in the text box, and then choose OK
  • Select the Enroll and Read permission for this group
SCCM Cloud Management Gateway
  • Choose OK, close Certificate Templates Console
  • Back in the Certification Authority (certsrv.mmc) console, right-click Certificate Templates, select New / Certificate Template to Issue
SCCM Cloud Management Gateway
  • In the Enable Certificate Templates dialog box, select the new template that you just created, SCD SCCM Cloud Management Gateway, click OK
SCCM Cloud Management Gateway

Request the custom web server certificate on the Primary Site Server

This procedure requests and then installs the newly created custom web server certificate on the Primary Site prior to the SCCM cloud management gateway installation

  • On the SCCM Server, run MMC
  • On the File Menu, choose Add/Remove Snap-in…  select Certificates, and click Add
SCCM Cloud Management Gateway
  • When prompted for what you want to manage certificates for, select Computer Account, click Next
SCCM Cloud Management Gateway
  • Select Local Computer and then click Finish
SCCM Cloud Management Gateway
  • Click OK to close the Add/Remove Snap-ins
SCCM Cloud Management Gateway
  • In the Add or Remove Snap-ins dialog box, choose OK.
  • In the console, expand Certificates (Local Computer) / Personal / Certificates
  • Right-click Certificates, select All Tasks / Request New Certificate
  • On the Before You Begin page, click Next
SCCM Cloud Distribution Point
  • If you see the Select Certificate Enrollment Policy page, choose Next
  • On the Request Certificates page, identify the SCD SCCM Cloud Management Gateway from the list of available certificates, and then select More information is required to enroll for this certificate. choose here to configure settings
SCCM Cloud Management Gateway
  • In the Certificate Properties dialog box, in the Subject tab
    • Subject name: in Type choose Common name
    • Value:  Specify your service name and your domain name by using an FQDN format. (For example: scdcmg.cloudapp.net) and select Add
    • Alternative name: in Type choose DNS
    • Value: Specify your service name and your domain name by using an FQDN format. (For example: scdcmg.cloudapp.net) and select Add
Important Info

In all cases this certificate will determine the name of the Cloud Management Gateway.

Only letters and numbers are allowed in the name.

A valid example is CMGSCD.cloudapp.net

An invalid example is CMG-SCD.cloudApp.Net

SCCM Cloud Management Gateway
  • Click OK to close the Certificate Properties dialog box
  • On the Request Certificates page, select SCD SCCM Cloud Management Gateway from the list of available certificates, click Enroll
  • On the Certificates Installation Results page, wait until the certificate is installed, click Finish
SCCM Cloud Management Gateway

Export Web Server Certificate

This procedure exports the custom web server certificate to file. We will export it as a .CER file for the Azure Management Certificate and in a .PFX format for the cloud management gateway creation.


  • In the Certificates (Local Computer) console, right-click the SCD Cloud Management Gateway certificate that you just created, select All Tasks / Export
SCCM Cloud Management Gateway
  • In the Certificates Export Wizard, choose Next
SCCM Cloud Management Gateway
  • On the Export Private Key page, select No do not export the private key and click Next
SCCM Cloud Management Gateway
  • On the Export file format, select CER and click Next
SCCM Cloud Management Gateway
  • Save your certificate in a folder and close the wizard
SCCM Cloud Management Gateway
  • To close the wizard, click Finish in the Certificate Export Wizard page
SCCM Cloud Management Gateway


  • Redo the export task a second time
  • On the Export Private Key page, choose Yes, export the private key, click Next
SCCM Cloud Management Gateway
  • On the Export File Format page, ensure that the Personal Information Exchange – PKCS #12 (.PFX) option is selected
SCCM Cloud Management Gateway
  • On the Password page, specify a strong password to protect the exported certificate with its private key, and then click Next
SCCM Cloud Management Gateway
  • On the File to Export page, specify the name of the file that you want to export
SCCM Cloud Management Gateway
  • To close the wizard, click Finish in the Certificate Export Wizard page
SCCM Cloud Management Gateway
  • Close Certificates (Local Computer).

The certificate is now ready to be imported to create an SCCM Cloud Management Point Gateway.

Client Authentication

SCCM clients can authenticate on the Cloud Management gateway following one of these methods:

  • Devices are Azure AD joined (Hybrid AD Joined)
    • Azure AD registered device is not enough for authentication
    • This isn’t covered in this guide, but here’s more information from Microsoft Docs
  • Token-based authentication
    • This feature is only available from SCCM 2002 release and above
  • Client certificate using an Enterprise CA

Token-based authentication

This feature is only available from SCCM 2002 or higher. If you do not have an Enterprise CA and computers are not joined yet to Azure AD, this is a good alternative.

The token-based does not require any kind of configuration or enablement once SCCM is up to date with 2002 or higher. The most important part is that the update on the client-side is mandatory to use the Token-based authentication.

The way it is working is simple. The Management Point issue a token to the client to be authenticated on the Cloud Management gateway while connected on-prem. This token is then automatically renewed each month and is valid for up to 90 days.

Important Info

Microsoft still recommends using Azure AD joined to authenticate on the Cloud Management Gateway.

It is also possible to generate a bulk registration token to allow external devices for a first communication with the Cloud Management Gateway. This could be useful for devices in a DMZ for example.

For more details about Token-based authentication, see Microsoft docs

Client authentication certificate requirements

This method relies on an Enterprise CA to manage the client certificate.

If computers are Azure AD joined, or you have chosen to leverage the new Token-based authentication, this step can be skipped.

If you need to create a Client authentication certificate on your Enterprise CA, here’s the steps:

  • RDP to an Intermediate Certification Authority
  • Open Certification Authority console, right-click Certificate Templates and click Manage
  • Right-click Workstation Authentication and click Duplicate Template
SCCM Cloud Management Gateway
  • Make sure to use Server 2003, not 2008
  • In the General, name this SCCM Client Certificate
SCCM Cloud Management Gateway
  • Set the Validity Period to 5 years
  • Click on the Security tab, select the Domain Computers group and add the permissions of Read and Autoenroll, do not clear Enroll. Then click OK
SCCM Cloud Management Gateway
  • When you refresh your console, you will see that the new template is there

Create an Auto-Enroll Group Policy

A client certificate is required on any computer which will be managed via the Cloud Management Gateway. It is also required on the server that will host the Cloud Management Gateway connection point.

The fastest way to deploy the client certificate to all your machines is through an autoenrollment GPO :

  1. Launch Group Policy Management on your Domain (Start / Administrative Tools / Group Policy Management)
  2. Right-click the desired OU and select Create a GPO in this domain, and Link it here… as we are going to create a new GPO
  3. Name your GPO AutoEnroll ConfigMgr Client Cert, then click OK
  4. Right-click and Edit your newly created GPO
  5. Navigate to: Computer Configuration / Policies / Windows Settings / Security Settings / Public Key Policies
SCCM Cloud Management Gateway
  • Right-click on Certificate Services Client – Auto-Enrollment and then click Properties
  • Change the Configuration Model: to Enabled
  • Check the Update certificates that use certificate templates and Renew expired certificates, update pending certificates, and remove revoked certificates
SCCM Cloud Management Gateway
  • Click Apply and OK
  • Reboot a workstation and when you run a gpupdate /force or in 15 minutes when GP is re-applied, any machine on the domain communicating with the DC will request and receive a client certificate automatically that will be placed in theLocal Computer Personal Certificate Store

The easiest way to export the root of the client certificates used on the network is to get it on one of the domain-joined machines that receive it through your auto-enrollment GPO


Client certificates are required on any computer you want to manage with cloud management gateway and on the site system server hosting the cloud management gateway connector point

  • Run MMC
  • From the File menu, choose Add/Remove Snap-in…
  • In the Add or Remove Snap-ins dialog box, choose Certificates / Add / Computer account / Local computer
  • Go to Certificates / Personal / Certificates
  • Double-click the certificate for client authentication on the computer, choose the Certification Path tab, and double-click the root authority (at the top of the path).
  • On the Details tab, choose Copy to File…
  • Complete the Certificate Export Wizard using the default certificate format. You’ll need it to configure the cloud management gateway (CMG) later

Configure SCCM Cloud Management Gateway

  • Go to Administration/Cloud Services/Cloud Management Gateway, select Create cloud management gateway
  • Sign-in with Azure Administrator rights. The Azure AD App name should be auto-populated, click Next
  • Select :
    • Service name: provided automatically if the certificate is using .cloudapp.net. If using a public certificate or an internal certificate, the name will need to be entered manually.
      • Remember, only letter and number for the name.
    • Region: should be the same as the on-prem Management point
    • Resource group: select an existing or create a new one
    • VM instance: 1
    • Cloud service certificate: select the CMG server authentication certificate or the Public certificate
    • Client authentication certificate: Provide the client authentication certificate when using an Enterprise CA
    • Choose to Verify client certificate revocation or not
    • Choose if you want to enable the Cloud DP

 Depending on the certificate used, the following message will display. This will happen when the certificate is not pointing to .cloudapp.net.

This is a reminder about the CNAME requirements.

If you use a wildcard certificate, replace the asterisk (*) in the Service name field with the globally unique deployment name prefix for your CMG.

  • Set the threshold as needed
  • Summary, click Next
  • Click Close
  • The Cloud Management Gateway will show as Provisioning for about 10 minutes
  • The Cloud Management Gateway is ready for next steps
  • The cloud management gateway resources are also visible in the Azure portal.

Configure SCCM-generated certificates

This is a new feature from SCCM 1806, but still in Pre-Release. This means that this feature is still in development but is fully supported.

The goal of this feature is to enable an HTTP Management point and Software Update to support CMG traffic using HTTPS. Prior to SCCM 1806, it was needed to provide an HTTPS MP and SUP in order to connect those services to the Cloud Management Gateway.

  • Go to Administration/Updates and Servicing/Features
  • Turn on the feature Enhanced HTTP site system
  • Go to Administration/Site Configuration/Sites and select properties on your site
  • Under the Client computer communication tab, check to box for Use Configuration Manager-generated certificates for HTTP Systems

For more detail on the SCCM-Generated certificate, see Docs.Microsoft.com

The cloud management gateway connector point is a new site system role for communicating with cloud management gateway. Let’s add this role to our management point machine.

  • In the SCCM console, go to Administration / Site Configuration / Servers and Site System Roles
  • Select your server which will serve as your cloud management gateway connection point and select Add Site System Role
  • On the System Role Selection pane, select Cloud management gateway connection point
SCCM Cloud Management Gateway
  • Your Cloud Management Gateway name and region will be auto-populated
SCCM Cloud Management Gateway
  • Review your settings and complete the wizard
SCCM Cloud Management Gateway
SCCM Cloud Management Gateway

You can follow the installation progress in SMS_Cloud_ProxyConnector.log.

Configure System roles to communicate with the Cloud Management Gateway

Prior to SCCM 1806, it was not possible for the current Management Point and Software Update Point to remain in HTTP mode and support the Cloud Management Gateway.

Admins were in need of a new Management Point and Software Update Point configured in HTTPS mode or to switch current ones.

Now with the SCCM-generated certificate, a current HTTP MP and SUP can support the Cloud Management Gateway.

  • Under Administration/Site Configuration/Servers and site System roles, select the Management Point properties
  • Check the box Allow Configuration Manager cloud management gateway traffic. Notice that the Client Connections remain in HTTP
  • Under Administration/Site Configuration/Servers and site System roles, select the Software Update Point properties
  • Check the box Allow Configuration Manager cloud management gateway traffic. Notice that the Require SSL communication to the WSUS remains unchecked

Configure SCCM CMG Client settings

Under Administrations/Client Settings, under Cloud Services make sure Enable clients to use a cloud management gateway is set to yes.

Once configure, deploy your client settings to the desired clients.

If you plan to use Cloud Distribution Point, it is also configured here.

In order to be able to see Applications deployment targeted to users, the following client setting is also required.

SCCM Cloud Management Gateway

Configure clients for cloud management gateway

We will now verify if clients are able to successfully communicate with our server via the SCCM Cloud Management Gateway.

On a client connected to the intranet, do a machine policy retrieval and restart the SMS Agent host.

On the Network tab of the Configuration Manager agent, the *.CloudAPP.net should be visible.

Additional information is available in the ClientLocation.log

SCCM Cloud Management Gateway

Testing client connection to Cloud Management gateway

To test the cloud management gateway (CMG), get your machine on the internet … or force the SCCM client to be configured as Always Internet.

In the registry editor, set HKLM/Software/Microsoft/CCM/Security/ClientAlwaysOnInternet to 1 and restart the SMS Agent host service.

After the SMS Agent host service, the client will display connection type Always internet

From this point, you can try any of the supported features for the Cloud Management Gateway!


Make sure to whitelist the address XXXX.cloudapp.net in your Enterprise Firewall. We’ve seen an issue with Cisco Umbrella blocking traffic thus preventing the Cloud connector point to keep the connection to the cloud management gateway.

The following error found in the SMS_CLOUD_PROXYCONNECTOR.log was showing Failed to build HTTP connection with XXXXX.CloudApp.Net. The cloud management gateway check the connection every 60 seconds

Bonus Resources for Troubleshooting

We released a complete troubleshooting guide in a separate post. Use it to troubleshoot your errors.

If you want to easily identify your CMG client, we have developed a free report.

This was a big one, hope it helped! Are you using the Cloud Management Gateway ? Tell us your experience in the comment section.

Comments (38)

Russell Johnson

01.21.2020 AT 08:34 PM
Why not use your company's domain instead of cloudapp.net?

Jonathan Lefebvre

01.22.2020 AT 12:05 PM
Hi Russell, if you look closely at the wizard for the CMG installation, it's not something you have a choice over. thanks Jonathan

sebastian baboolal

01.16.2020 AT 12:01 PM
Hello, the link for the certificate for Client Authentication might be going to the wrong link. "See our post for the complete How-to about the certificate for Client Authentication" it takes me to HOW TO CONFIGURE SCCM CLOUD DISTRIBUTION POINT ON CLOUD MANAGEMENT GATEWAY but i don't see any info for how to configure the cert. cheers

Jonathan Lefebvre

01.16.2020 AT 12:28 PM
Hi Sebastian, sorry about this, look for sections CREATE AND ISSUE A CUSTOM WEB SERVER CERTIFICATE TEMPLATE ON YOUR CERTIFICATION AUTHORITY and onward, in the Cloud DP post. Follow those steps with using your CMG name, as the steps are the exact same. thanks Jonathan


12.06.2019 AT 05:49 AM
Create the two applications highlighted below. Note: If you already have the web app created, the wizard will prompt you to reuse the existing. Chances are that you already have Microsoft Store for Business  configured in Configuration Manager. If that is the case, you will have the web app already.


08.15.2019 AT 10:10 AM
Can we use Federated GA with MFA enabled for configuring CMG ?


08.06.2019 AT 01:29 AM
quick query , what dns entry i need to put. the warning errror which you mentioned at the bottom i am getting it for internal CMG service FQDN. 1. i have created the CNAME entry in Public DNS to map localdomain.com to cloudapp.net 2. i have create other Cname entry in local dns server to MAP internal SCCM server IP to local CMG service FQDN


06.17.2019 AT 08:48 AM
old blog post.. not updated now azure can host in ARM


05.22.2019 AT 06:42 AM
hello this feature can be used on computers out of domain active directory with the use of a public certificate?

Michael Kassenoff

05.09.2019 AT 12:33 PM
Hi, great article. I am having an issue with the internet client getting content from the cloud DP. any thoughts? everything else appears to be functional.


05.01.2019 AT 03:42 PM
Hi! I haven't have any error while creating CMG, certificates, services associated, etc. But when I try to test with Connection Analyzer, I allways get this errors: 1.- Configuration version of the CMG service should be 3. Failed to get CMG service metadata. For more information, see SmsAdminUI.log. In SMSAdminUI.log I see thiis entry: [12, PID:5860][05/01/2019 22:37:57] :System.Net.WebException\r\nThe remote server returned an error: (403) Forbidden.\r\n at System.Net.HttpWebRequest.GetResponse() 2.- Failed to refresh MP location. Selected client certificate is not trusted by the CMG service. Check if certificate chain for the client certificate is specified to upload to the CMG service and check revocation check setting. I've reviewed everything, I do not find where is the mistake. Please any help? Thanks


04.16.2019 AT 04:21 AM
Nice guide! Maybe I'm wrong but shouldnt be the CMG be added to the boundaries before it can be used?

Jonathan Lefebvre

04.16.2019 AT 09:36 AM
Hi Duuck, only if you want to manage internal network sites with the CMG. Like a small remote office with a bad VPN connection, it might be easier to support them with the CMG. Otherwise, any client connected to the web will go through the CMG. the strategy for the VPN IP range should be reviewed to see if you leverage the CMG or not. thanks! Jonathan


03.06.2019 AT 03:18 PM
"We have successfully added and tested a CMG Service (SCCM 1810)for both Australia East and East US, but all attempts to create a CMG service in any of the UK regions results in provisioning failed. Is it possible to create a CMG service in the UK at the current date?

Adam Runcie

02.07.2019 AT 03:41 PM
I can't seem to get my clients to detect that the CMG is a new management point now. I got everything setup and everything appears to be connected (the service connection point sees my CMG). But watching ClientLocation.log it still only detects my on-prem management point. I've triggered a machine policy & eval cycle as well as restarted the SMS agent service several times but no luck. Thoughts?


05.10.2020 AT 05:42 PM
Interested to hear if you got this working and what may of been the fix. I have configured the CMG and SCCM connects to the VM with no problems. Have configured the client settings, except the clients never receive the policy. If i click on the network tab in the config mgr properties,its empty. Something is stopping the clients getting the policy. WMI is healthy on clients. ANy ideas?


09.01.2020 AT 09:13 AM
exactly the same problem here! network tab in the config mgr properties is empty. I hope you have already found a solution and can help me. Thanks in advance!

Jennifer Bradley

01.30.2019 AT 05:57 AM
After the successful implementation of CMG a few weeks earlier, it stopped synchronizing the newly added connectors. What the reasons can be?

Albert Pang

01.16.2019 AT 01:16 PM
How does the configuration change with SCCM 1810?

Russ Rimmerman

01.09.2019 AT 02:26 PM
Enhanced HTTP isn't required to have your CMG utilize an HTTP based SUP, only for an HTTP based MP. You can leave a SUP on HTTP regardless if you enable enhanced HTTP or not.


01.07.2019 AT 09:43 AM
We are running into an issue on our environment (90k+ clients over 5 primary sites) where after 4-8 days the MPs we have installed the CMG connectors on are going in a “disconnected” state. Sometimes we need to restart them as the RDC connection dies & we can no longer login. This seems to be as the TCP/IP ports are exhausted (symptoms are accompanied by TCP/IP 4231/4227 errors in the system event log.) I’ve logged this with MS who have advised updating to 1810. Just reporting here in case anybody else has similar issues. The number of high-end ports has been amended (netsh int ipv4 set dynamicport tcp start=20000 num=45535) & time wait for disconnect reg entry (Create key “TcpipTimedWaitDelay” REG_DWord (32-bit) with dec setting of 40 under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameter) have been added, but for us this has had no impact. Am also seeing an inconsistency with the the max number of concurrent connections & number of actual clients. One of our sites has about 25k clients, however the console is reporting 120k+ concurrent connections!

James Leroux

01.02.2019 AT 08:27 PM
I have had zero luck getting clients to connect in this scenario. MS documentation indicates we do need AAD for this to work. My domain joined laptop, on the internet will not talk to the cloud management point at all.

gwyn jones

12.11.2018 AT 10:02 AM
We have successfully implemented CMG. However, a few weeks later when adding another site / connector it is now stuck at "updating configuration" start / stop / synchronise is greyed out. Any ideas ? thanks in advance

Benoit Lecours

01.29.2019 AT 11:46 AM
This is a known issue and should now be resolved in 1810.


10.31.2018 AT 09:27 AM
Hi, Recently we configured the CMG with HTTP Option and everything seems to OK when we test CMG Connection Analayzer when we configure client computer with external network we getting the following errors Raising pending event: instance of CCM_CcmHttp_Status { ClientID = "GUID😀4F03A98-74DE-4FB1-A4C6-93D3AE29F83C"; DateTime = "20181029111338.135000+000"; HostName = "XXXCMG.CLOUDAPP.NET"; HRESULT = "0x80072f78"; ProcessID = 32648; StatusCode = 600; ThreadID = 21268; }; [CCMHTTP] ERROR: URL=https://XXXCMG.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037927939/SMS_MP/.sms_aut?MPLIST2&AV1, Port=443, Options=1472, Code=12152, Text=ERROR_WINHTTP_INVALID_SERVER_RESPONSE Any suggestions? Thanks.


10.19.2018 AT 10:24 AM
Hi, Could this be used to manage devices that are in a completely separate (no trust) domain?