A cloud management gateway (CMG) lets Configuration Manager clients on the internet reach your management points and software update points without a VPN, and without publishing anything on-premises. In this post I'll deploy one on an Azure virtual machine scale set, show what healthy looks like at both ends, and track down clients that won't connect.
How it works and prerequisites#
Clients reach the CMG in Azure over HTTPS on port 443. On-premises, the CMG connection point role keeps an outbound connection to the CMG and relays traffic to the management points and software update points you allow, so nothing has to be opened inbound. The CMG can also serve content from Azure storage.
- Deployment model: a virtual machine scale set. Version 2203 removed the cloud service (classic) option.
- Azure: a subscription and a Subscription Owner account for the wizard.
- Microsoft Entra integration: connect the site to your tenant under Administration › Cloud Services › Azure Services (Cloud Management). This registers a server app and a client app.
- Server authentication certificate: a .pfx file that includes the private key. Its common name becomes the CMG service name and must be globally unique in Azure.
- Site roles: a service connection point in online mode, and a server for the CMG connection point.
Also decide how internet clients will authenticate:
| Method | Suits | Notes |
|---|---|---|
| Microsoft Entra ID token | Entra joined and hybrid joined devices | The management point needs HTTPS or Enhanced HTTP |
| PKI client certificate | Estates that already issue client certificates | Add the trusted root chain to the CMG. Publish a CRL, or turn off revocation checking |
| Bulk registration token | Devices that can't use either of the above | Issued by the site and passed to ccmsetup at install time |
Step-by-step#
1. Get the server authentication certificate#
A public CA certificate is trusted by Windows out of the box and uses your own name, such as contosocmg.contoso.com. You then need a DNS CNAME that points that name at the deployment name: the same prefix plus the region's Azure domain, here contosocmg.westeurope.cloudapp.azure.com. An enterprise PKI certificate can use either name, but every internet client must trust your root CA. Wildcard certificates are supported. Check that the name is free in Azure first.
2. Create the CMG#
- At the top-level site, go to Administration › Cloud Services › Cloud Management Gateway and select Create Cloud Management Gateway.
- On General, choose the Azure environment and your Microsoft Entra tenant, sign in as Subscription Owner and pick the subscription.
- On Settings, browse to the .pfx file. The service and deployment names come from its common name; with a wildcard certificate, replace the asterisk with your prefix. Choose a region and a resource group. An existing resource group must be in the same region, or the deployment fails.
- For the VM size, Standard (A2_v2) is the default, Large (A4_v2) carries more clients per VM, and Lab (B2s) is for tests only. You can run from one VM instance (the default) up to 16.
- Add trusted roots only for PKI client certificates, and keep Verify Client Certificate Revocation only if your CRL is published on the internet. Keep Enforce TLS 1.2, plus the cloud distribution point option if clients need content.
- On Alerts, set the 14-day traffic and storage thresholds, then finish the wizard.
Watch the Status column until the CMG is ready. CloudMgr.log on the site server tracks the deployment, and CMGSetup.log covers the setup in Azure.
3. Add the CMG connection point#
Under Administration › Site Configuration › Servers and Site System Roles, select a server, choose Add Site System Roles, select Cloud management gateway connection point and pick your CMG. With PKI client authentication, this server needs a client certificate too. If the server reaches the internet through a proxy, configure the proxy in the site system's properties.
4. Allow CMG traffic on the client-facing roles#
For each management point and software update point that serves internet clients, open its properties and select Allow Configuration Manager cloud management gateway traffic. With PKI client certificates, also set the primary site's Communication Security tab to Use PKI client certificate (client authentication) when available.
5. Bring clients onto the CMG#
In client settings, set Cloud Services › Enable clients to use a cloud management gateway to Yes. Existing clients learn about the CMG from their management point while they're on the intranet, then use it when they leave. Devices that have never been on the network need an internet install, for example with a bulk registration token:
REM Site server (bin\x64 folder): create a token
BulkRegistrationTokenTool.exe /new
REM Device: install via the CMG (use your CMG's exact path)
ccmsetup.exe /mp:https://contosocmg.contoso.com/CCM_Proxy_MutualAuth/<ID> CCMHOSTNAME=contosocmg.contoso.com/CCM_Proxy_MutualAuth/<ID> SMSSiteCode=<site code> /regtoken:<token>For devices already in Intune, copy the ready-made command line from the Enablement page of the co-management properties.
Verify#
On the server side:
SMS_Cloud_ProxyConnector.logon the connection point shows connections to the CMG being set up without repeated failures.CMGService.logrecords the service side in Azure.- The CMG Connection analyzer on the ribbon tests a Microsoft Entra user or a client certificate end to end.
On a client that's off the corporate network:
LocationServices.logandClientLocation.loglist the CMG as an internet management point, with a path containingCCM_Proxy_MutualAuthorCCM_Proxy_ServerAuth.CcmMessaging.logshows policy requests to the CMG succeeding. For new installs,ClientIDManagerStartup.logshows the client registering.- A machine policy cycle completes, and Software Center lists the expected deployments.
Tips & gotchas#
| Symptom | Likely cause | Where to look |
|---|---|---|
| Deployment fails or never becomes ready | Resource group in another region, name already taken, account not Subscription Owner, or a required resource provider (compute, network, storage, key vault) not registered | CloudMgr.log |
| CMG is ready, but the connection point won't connect | A proxy or firewall blocks outbound traffic, or the PKI client certificate is missing | SMS_Cloud_ProxyConnector.log |
| Client never tries the CMG | Client setting off, management point not allowed for CMG traffic, or the client hasn't been on the intranet since the CMG was created | LocationServices.log |
| Client reaches the CMG but authentication fails | Certificate root not trusted, revocation checking on without a public CRL, device not Entra joined or hybrid joined (token auth), or management point not on HTTPS or Enhanced HTTP | CcmMessaging.log, ClientIDManagerStartup.log, Connection analyzer |
| Policy works but content doesn't download | Content isn't enabled on the CMG or isn't on it. The management point only offers the CMG when it holds the content | Distribute content to the CMG |
Track the server certificate's expiry date, because an expired certificate cuts off every internet client at once. The CMG also lets Intune-enrolled devices get the client in a co-management rollout.
