Azure, Hybrid Identity & Enterprise Mobility + Security
In the early days of onboarding Windows 10 endpoints to Windows Defender ATP you had to define a custom device configuration policy via Intune, in order to enable and register your Windows Defender ATP agents at scale.
Continue reading “Windows Defender ATP: Onboarding your Windows 10 endpoints, do it the right way!”
The cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients on the internet. By deploying the CMG as a cloud service in Microsoft Azure, you can manage traditional clients that roam on the internet ‘without’ additional (on-premise) infrastructure.
However, there is a limitation when deploying CMG using Azure CSP subscription.
This capability does not enable support for Azure Cloud Service Providers (CSP). The CMG deployment with Azure Resource Manager continues to use the classic cloud service, which the CSP does not support. For more information, see available Azure services in Azure CSP.
As CSP model is becoming more and more popular as Azure subscription, this scenario is a potential blocker for many customers having a CSP subscription which wants to deploy a CMG. The Microsoft product teams are aware of this situation and I’m sure they will solve this the sooner or later.
Converting your CSP subscription to an eligible Azure subscription is no option here (managed by CSP Partner). Therefore I would like to take you how to deploy a CMG while you’re on a CSP subscription. Yes it’s possible! In this blog I’ll describe what it takes to achieve this. Continue reading “Unleash your Azure CSP subscription for Cloud Management Gateway deployments”
In Configuration Manager Current Branch 1806, Microsoft introduced the Cloud Management Gateway Connector Analyzer. A highly valued feature which is a great starting point to troubleshoot your Cloud Management Gateway (CMG) in case you ran in to any issues. In short, it’s a more than welcome and helpful feature!
In a nutshell the Cloud Management Gateway Connection Analyzer validates you Cloud Management Gateway deployment on 6 points, namely:
This blog post provides a first aid guidance to troubleshoot you Cloud Management Gateway(s).
The Cloud Management Gateway Connection Analyzer can be found in the Cloud Services section part of the Administration pane. There are two clients authentication options to connect to the Cloud Management Gateway.
Once connected successfully with a valid Azure AD Account or Client Certificate we can start the connection analyzer to verify the Cloud Management Gateway is working properly.
By deploying the Cloud Management Gateway as a cloud service in Microsoft Azure, you can manage traditional clients that roam on the internet without additional infrastructure. The cloud services authenticates and forwards Configuration Manager client requests to the CMG connection point. The status of the cloud services has the following statuses:
The illustration below indicates the CMG service is in ready state and therefore available.
The illustration below indicates the CMG service is not in a ready state.
To troubleshoot CMG Ready state, use CloudMgr.log.
The illustration below indicates the CMG service is running.
The illustration below indicates the CMG service is not running and therefore not available.
In this case the CMG cloud services might be not running. To troubleshoot CMG services, use CMG-<cloud_service_name>-ProxyService_IN_0-CMGService.log (or CMG-<cloud_service_name>-ProxyService_IN_1-CMGService.log in case of 2 or more VM instances) and SMS_Cloud_ProxyConnector.log.
The illustration below indicates the CMG configuration between on-premise CMG connection point and in CMG in Azure is in sync.
The illustration below indicates the CMG configuration between on-premise CMG connection point and in CMG in Azure is in sync.
This is an easy one, just makes sure the CMG configuration data is in sync by enforcing “Synchronize configuration” under Cloud Services section part of the Administration pane.
The CMG connection point is the site system role for communicating with the CMG. By default the CMG connection point establishes TCP-TLS connections (10140-10155) to connect to CMG cloud service in Azure. In case of 2 or more VM instances, the second VM instance uses port 10141, up to the sixteenth on port 10155.
Make sure <cloud_service_name>.cloudapp.net:10140 is reachable and can be resolved (name resolution) properly. To troubleshoot CMG service health, use CMGService.log and SMS_Cloud_ProxyConnector.log.
The illustration below indicates the CMG configuration point is able to communicate with CMG in Azure.
The illustration below indicates the CMG configuration point is not able to communicate with CMG in Azure.
To troubleshoot CMG services, use SMS_Cloud_ProxyConnector.log.
Make sure you have configured the management point and/or software update point site systems linked to your CMG to accept CMG traffic from clients which are on the internet.
When there is no site system role assigned (whether management point or software update point) clients on the internet won’t be able to take benefit of the concerning service(s).
Make sure you’ve assigned at least one management point or more to service clients on the internet.
The CMG connect point forwards client communications to on-premise site system role(s) (management point(s) and/or software update point(s). In this case the site system roles should be available
In case you’ve bind a wrong web server certificate to you management point or software update point (IIS) or the certificate isn’t trusted (certificate chain) incoming client communications from CMG cloud service won’t be accepted.
In the table below an overview of a few scenarios whereby the management point isn’t available for various reasons.
| Error | Solution | |||||||||||||||||||||
| Failed to get ConfigMgr token with Azure AD token. Status code is ‘503’ and status description is ‘CMGConnector_ServiceUnavailable’. | A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: ‘ServiceUnavailable’. | Make sure IIS services is running properly. | ||||||||||||||||||||
| Failed to get ConfigMgr token with Azure AD token. Status code is ‘500’ and status description is ‘CMGConnector_InternalServerError’. | A possible reason for this failure is the CMG connection point failed to forward the message to the management point. Internal server error. For more information, see the management point logs for more details to see why internal server error returns. | Make sure you bind the right web server certificate to IIS or make sure the correct root- and/or intermediate CA is added. | ||||||||||||||||||||
| Succeed to get ConfigMgr token with Azure AD token. | Failed to refresh MP location. Status code is ‘401’ and status description is ‘CMGConnector_Unauthorized’ | A possible reason for this failure is the CMG connection point failed to forward the message to the management point. The management point returned the following error: ‘Unauthorized’. | ||||||||||||||||||||
| Succeed to get ConfigMgr token with Azure AD token. | Failed to refresh MP location. Status code is ‘500’ and status description is ‘CMGService_No_Connector’. | A possible reason for this failure is the CMG service failed to forward the message to the CMG connection point. There is no CMG connection point that is connecting to the CMG service. For more information, see the SMS_CLOUD_PROXYCONNECTOR.log on the CMG connection point. | Make sure firewall or proxies aren’t blocking network traffic. Click here for a complete overview of ports required by CMG. |
Cloud Management Gateway Log files
The following table lists the log files that contain information related to the cloud management gateway.
| Log name | Description | Computer with log file | |||||||||||
| CloudMgr.log | Records details about deploying the cloud management gateway service, ongoing service status, and use data associated with the service. | You can configure the logging level be editing the Logging level value in the registry key HKLM\SOFTWARE\ Microsoft\SMS\COMPONENTS\ SMS_CLOUD_ SERVICES_MANAGER | The installdir folder on the primary site server or CAS. | ||||||||||
| CMGSetup.log1 | Records details about the second phase of the cloud management gateway deployment (local deployment in Azure) | You can configure the logging level using the setting Trace level (Information (Default), Verbose, Error) on the Azure portal\Cloud services configuration tab. | The %approot%\logs on your Azure server, or the SMS/Logs folder on the site system server | ||||||||||
| CMGHttpHandler.log1 | Records details about the cloud management gateway http handler binding with Internet Information Services in Azure | You can configure the logging level using the setting Trace level (Information (Default), Verbose, Error) on the Azure portal\Cloud services configuration tab. | The %approot%\logs on your Azure server, or the SMS/Logs folder on the site system server | ||||||||||
| CMGService.log1 | Records details about the cloud management gateway service core component in Azure | You can configure the logging level using the setting Trace level (Information (Default), Verbose, Error) on the Azure portal\Cloud services configuration tab. | The %approot%\logs on your Azure server, or the SMS/Logs folder on the site system server | ||||||||||
| SMS_Cloud_ | ProxyConnector.log | Records details about setting up connections between the cloud management gateway service and the cloud management gateway connection point. | Site system server |
1 These are local Configuration Manager log files that cloud service manager sync from Azure storage every five minutes. The cloud management gateway pushes logs to Azure storage every five minutes. So the maximum delay is 10 minutes. Verbose switches affect both local and remote logs. The actual file names include the service name and role instance identifier. For example, CMG-ServiceName-RoleInstanceID-CMGSetup.log
Please find below the resources I’ve used to writeup this blog post.
Microsoft, Plan for the cloud management gateway in Configuration Manager
https://docs.microsoft.com/en-us/sccm/core/clients/manage/cmg/plan-cloud-management-gateway
Microsoft, Log files in System Center Configuration Manager
https://docs.microsoft.com/en-us/sccm/core/plan-design/hierarchy/log-files#cloud-management-gateway
Further I want to pay attentions of a great blog post series of how to set up your Cloud Manage Gateway by fellow MVP Zeng Yinghua
SCConfigMgr, How to setup Co-Management
http://www.scconfigmgr.com/2017/11/23/how-to-setup-co-management-part-1/
Nowadays Microsoft provides us a lot of flexibility to empower end-users to be productive as never before. Users are able to register their devices in order to access corporate resources anytime, anywhere on devices they love. Provisioning of Windows 10 devices to your enterprise has never been easier for end-users. They are even able to join their brand new devices to the corporate from home taking benefit of Windows Autopilot & Azure AD MDM auto-enrollment.
From an end-user perspective this is great, productivity can be restored in minutes instead of hours or even days. However the flexibility we provide for the end-users has a downside from an IT Admin perspective. As we’re able to join or register devices to Microsoft Intune/Azure AD, it causes a lot of obsolete device objects in your tenants. Continue reading “Keep your Microsoft Intune tenant clean and tidy /w Azure Automation & Graph API”
Since December 2017 Microsoft Intune introduced support for multiple active SCEP/PFX connectors per tenant in order to provide high availability for certificate handling.
Initially the Microsoft Intune SCEP/PFX connector didn’t provide support for high availability. The SCEP/PFX connector could be installed as an single instance with no option for multiple active connectors.
Continue reading “Microsoft Intune introduced High Available (HA) support for SCEP/PFX Connector”
Alongside the announcement of down-level support for Windows 7 and Windows 8.1, there is more exciting news in regards to Windows Defender ATP. Since today Windows Defender ATP Security Analytics is extended with two new security controls; BitLocker and Firewall.
Continue reading “Windows Defender ATP updates including BitLocker & Firewall security controls”
In this blog post I’ll explain how to configure and enable Windows Hello Multifactor Device Unlock using Microsoft Intune. Windows Hello Multifactor Device Unlock provides multifactor device authentication for login or unlocking Windows 10 devices.
Windows Hello for Business