Overview

In this step-by-step guide, we will walk through the process of installing and configuring a Microsoft SCCM site to use Internet-Based Client Management.

Topics in Video

• Reviewing Internet-Based Client Management Prerequisites  – https://youtu.be/GbIOxNhJ9lU?t=1
• Requesting the IIS Certificate on the Internet-Facing Site System – https://youtu.be/GbIOxNhJ9lU?t=508
• Changing WSUS to require SSL – https://youtu.be/GbIOxNhJ9lU?t=806
• Installing the Software Update Point – https://youtu.be/GbIOxNhJ9lU?t=1203
• Installing the Management Point and Distribution Point – https://youtu.be/GbIOxNhJ9lU?t=1656
• Verify Client Gets New IBCM MP – https://youtu.be/GbIOxNhJ9lU?t=2019
• Verify Content Gets Distributed To IBCM DP – https://youtu.be/GbIOxNhJ9lU?t=2119
• Checking the MPLIST and MPCERT on the Internet-Facing Management Point – https://youtu.be/GbIOxNhJ9lU?t=2160
• Client Testing on the Internet – https://youtu.be/nChKKM9APAQ?t=1176

Documentation for Topics in this Guide:

• Plan for Internet-based client management in System Center Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-internet-based-client-management
• Features that Are Not Supported on the Internet – https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-internet-based-client-management
• Considerations for client communications from the Internet or untrusted forest – https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-internet-based-client-management#considerations-for-client-communications-from-the-internet-or-untrusted-forest
• Prerequisites for Internet-Based Client Management (IBCM) in Configuration Manager – https://blogs.technet.microsoft.com/jchalfant/prerequisites-for-internet-based-client-management-ibcm-in-configuration-manager/
• How To Configure Microsoft SCCM to Use HTTPS/PKI – https://setupconfigmgr.com/how-to-configure-microsoft-sccm-to-use-https-pki
• How to Publish the CRL on a Separate Web Server – https://cloudblogs.microsoft.com/enterprisemobility/2009/05/01/how-to-publish-the-crl-on-a-separate-web-server/
• Common HTTPS errors in Configuration Manager – http://blogs.msdn.com/b/ameltzer/archive/2008/04/14/common-native-mode-client-mp-error-messages-and-what-to-do-about-them.aspx
• Ports Required for a Site System in DMZ in Configuration Manager – https://blogs.technet.microsoft.com/b/jchalfant/archive/2015/04/08/ports-required-for-a-site-system-in-dmz-in-configuration-manager.aspx
• IIS Error 403.13 Client Certificate Revoked if IIS can’t access the Clients CRL Distribution Point – https://support.microsoft.com/en-us/help/294305/iis-returns-http-403-13-client-certificate-revoked-error-message-altho
• How to Configure the WSUS Web Site to Use SSL – https://technet.microsoft.com/en-us/library/bb633246.aspx 

 

 

Overview

• In this video guide, we will be covering how you can set up the cloud management gateway in Configuration Manager to manage clients on the internet. This guide covers essential aspects of CMG such as certificates, site system roles, Azure prerequisites and much more!

Topics in Video

• CMG Vs. IBCM – https://youtu.be/kTOPhVHyZtE?t=42
• Certificates needed for Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=186
• Create Web Server CMG Certificate Template – https://youtu.be/kTOPhVHyZtE?t=289
• Review Client Communication Settings- https://youtu.be/kTOPhVHyZtE?t=401
• Request Server/Web Server Certificate for CMG – https://youtu.be/kTOPhVHyZtE?t=446
• Export Internal Root CA Certificate to use in CMG – https://youtu.be/kTOPhVHyZtE?t=583
• Allow Client to Use Cloud DP and CMG – https://youtu.be/kTOPhVHyZtE?t=622
• Configure Azure Subscription – https://youtu.be/kTOPhVHyZtE?t=658
• Give App Registrations Permissions in Azure – https://youtu.be/kTOPhVHyZtE?t=821
• Create Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=884
• Install Cloud Management Gateway Connection Point Role – https://youtu.be/kTOPhVHyZtE?t=1600
• Set Management Point and Software Update Point to Allow CMG Traffic – https://youtu.be/kTOPhVHyZtE?t=1660
• Distribute Content to CMG – https://youtu.be/kTOPhVHyZtE?t=1755
• Enable RDP for the Azure CMG Server – https://youtu.be/kTOPhVHyZtE?t=1869
• Verify Client Receive CMG Server for IBCM Mangement Point – https://youtu.be/kTOPhVHyZtE?t=2154
• Verify Client Notifications Work on Internet Client – https://youtu.be/kTOPhVHyZtE?t=2372
• Verify App Deployment Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2491
• Verify Software Updates Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2523
• Verify Hardware Inventory from Client Notification Channel Works – https://youtu.be/kTOPhVHyZtE?t=2650

Notes From Justin

• Niall Brady’s (windows-noob.com) CMG BlogN
  • Niall’s guide should be out soon. It looks like I beat him to it :).

Helpful Resources:

• Plan for the cloud management gateway in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway
• IBCM Vs. CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/manage-clients-internet
• Set up cloud management gateway for Configuration Manager- https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/setup-cloud-management-gateway
• Support for Configuration Manager features from CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#support-for-configuration-manager-features
• Cloud Management Gateway Performance and scale – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#performance-and-scale
• Ports and data flow – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#ports-and-data-flow
• Required ports – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#required-ports
• Publish the certificate revocation list – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/security-and-privacy-for-cloud-management-gateway#publish-the-certificate-revocation-list
• Plan for PKI certificate revocation – https://docs.microsoft.com/en-us/sccm/core/plan-design/security/plan-for-security#BKMK_PlanningForCRLs
• Certificates for the cloud management gateway – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway
• CMG server authentication certificate – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-server-authentication-certificate
• CMG trusted root certificate to clients – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-trusted-root-certificate-to-clients
• Enable management point for HTTPS – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#enable-management-point-for-https
• Classic Servier Deployment | Create Management Certificate  – https://docs.microsoft.com/en-us/azure/cloud-services/cloud-services-certs-create
• Classic Servier Deployment | Upload your service certificate to the Azure portal – https://docs.microsoft.com/en-us/azure/azure-api-management-certs