Overview

Here’s a playback of the community session with the Patch My PC team about Cloud Management Gateway in Configuration Manager. In this session, we cover common configurations and possible issues with CMG including:

– CMG server authentication certificate
– CMG trusted root certificate to clients
– Server authentication certificate issued by public provider
– Server authentication certificate issued from enterprise PKI
– Client authentication certificate
– Client trusted root certificate to CMG
– CRL checking
– Q&A

Overview

• In this video guide, we will be covering how you can set up the cloud management gateway in Configuration Manager to manage clients on the internet. This guide covers essential aspects of CMG such as certificates, site system roles, Azure prerequisites and much more!

Topics in Video

• CMG Vs. IBCM – https://youtu.be/kTOPhVHyZtE?t=42
• Certificates needed for Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=186
• Create Web Server CMG Certificate Template – https://youtu.be/kTOPhVHyZtE?t=289
• Review Client Communication Settings- https://youtu.be/kTOPhVHyZtE?t=401
• Request Server/Web Server Certificate for CMG – https://youtu.be/kTOPhVHyZtE?t=446
• Export Internal Root CA Certificate to use in CMG – https://youtu.be/kTOPhVHyZtE?t=583
• Allow Client to Use Cloud DP and CMG – https://youtu.be/kTOPhVHyZtE?t=622
• Configure Azure Subscription – https://youtu.be/kTOPhVHyZtE?t=658
• Give App Registrations Permissions in Azure – https://youtu.be/kTOPhVHyZtE?t=821
• Create Cloud Management Gateway – https://youtu.be/kTOPhVHyZtE?t=884
• Install Cloud Management Gateway Connection Point Role – https://youtu.be/kTOPhVHyZtE?t=1600
• Set Management Point and Software Update Point to Allow CMG Traffic – https://youtu.be/kTOPhVHyZtE?t=1660
• Distribute Content to CMG – https://youtu.be/kTOPhVHyZtE?t=1755
• Enable RDP for the Azure CMG Server – https://youtu.be/kTOPhVHyZtE?t=1869
• Verify Client Receive CMG Server for IBCM Mangement Point – https://youtu.be/kTOPhVHyZtE?t=2154
• Verify Client Notifications Work on Internet Client – https://youtu.be/kTOPhVHyZtE?t=2372
• Verify App Deployment Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2491
• Verify Software Updates Works from Internet Client using CMG – https://youtu.be/kTOPhVHyZtE?t=2523
• Verify Hardware Inventory from Client Notification Channel Works – https://youtu.be/kTOPhVHyZtE?t=2650

Notes From Justin

• Niall Brady’s (windows-noob.com) CMG BlogN
  • Niall’s guide should be out soon. It looks like I beat him to it :).

Helpful Resources:

• Plan for the cloud management gateway in Configuration Manager – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway
• IBCM Vs. CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/manage-clients-internet
• Set up cloud management gateway for Configuration Manager- https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/setup-cloud-management-gateway
• Support for Configuration Manager features from CMG – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#support-for-configuration-manager-features
• Cloud Management Gateway Performance and scale – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#performance-and-scale
• Ports and data flow – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#ports-and-data-flow
• Required ports – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway#required-ports
• Publish the certificate revocation list – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/security-and-privacy-for-cloud-management-gateway#publish-the-certificate-revocation-list
• Plan for PKI certificate revocation – https://docs.microsoft.com/en-us/sccm/core/plan-design/security/plan-for-security#BKMK_PlanningForCRLs
• Certificates for the cloud management gateway – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway
• CMG server authentication certificate – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-server-authentication-certificate
• CMG trusted root certificate to clients – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#cmg-trusted-root-certificate-to-clients
• Enable management point for HTTPS – https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/certificates-for-cloud-management-gateway#enable-management-point-for-https
• Classic Servier Deployment | Create Management Certificate  – https://docs.microsoft.com/en-us/azure/cloud-services/cloud-services-certs-create
• Classic Servier Deployment | Upload your service certificate to the Azure portal – https://docs.microsoft.com/en-us/azure/azure-api-management-certs