In this post, let’s discuss how to Setup SCCM CMG in Virtual Machine Scale Set Model. The VM scale set feature was first started in SCCM CB version 2010 as a pre-release update. Starting in version 2107, it’s a main released feature. I would like to thank Vaishnav for writing and sharing this awesome post with the HTMD community.
CMG deployments with a virtual machine scale set support Azure US Government cloud environment from CB version 2111 onwards. The option to deploy a Cloud Management Gateway (CMG) as a cloud service (classic) is deprecated. From SCCM version 2203 onwards, you can use all CMG deployments with a virtual machine scale set.
In the SCCM console, you may get the above-mentioned Management Insights notification under “Deprecated and unsupported features” if your existing CMG is running in a cloud service (classic) deployment model. Here you won’t get the conversion option. Need to create a new CMG VMSS and decommission/delete the Classic Service later.
The existing CMG is there in the custom domain, you will get an option to “convert” it into the virtual machine scale set model. In this article am going to explain how to create CMG in a virtual machine scale set model if your existing CMG classic is there in the Microsoft-owned domain (xxx.cloudapp.net).
- Is SCCM Dying?
- Intune Training Course 2023
- Free SCCM Training 37 Hours of Latest Technical Content Lab Setup
Pre-requisite to Setup CMG in Virtual Machine Scale Set Model
Here are the Microsoft recommended few basic Prerequisites for a new Cloud Management Gateway VMSS creation.
- A valid Azure Subscription is required to host CMG.
- Azure AD site integration to deploy the service with the Azure resource manager.
- Full Admin access in Configuration Manager console (Full or Infrastructure Administrator).
- Service Connection Point must be in online mode.
- The clients must use Internet Protocol version 4.
- To host the CMG connection point, at least one on-premises Windows server.
- Configure the Management Point to allow traffic from CMG, it requires HTTPS or Enhanced HTTP.
- CMG Server Authentication certificate.
What is Cloud Management Gateway (CMG)?
The Cloud Management Gateway provides a way to manage clients on the Internet without the need for a VPN connection to your on-premises network. It allows Configuration Manager clients to communicate with the Configuration Manager site system roles that are placed in Azure.
This is particularly useful for organizations with many devices outside their corporate network, such as remote workers or devices that frequently connect from different locations.
Classic Cloud Services is Retiring
If you have CMG with a Cloud service (classic) deployment model as per Microsoft recommendation, you have to Convert/Migrate into a Virtual Machine scale set model. Please find the Azure notification screenshot below if the Cloud service is in Classic mode.
Should your CMG’s service name be under the cloudapp.net domain, it is not possible to transform it into a virtual machine scale set.
For instance, if you have obtained a server authentication certificate from your internal PKI with a common name of xyzabc.cloudapp.net, you won’t be able to create a DNS CNAME to map this service name to the new deployment name in the cloudapp.azure.com domain due to Microsoft’s ownership of the cloudapp.net domain.
- Generate a fresh server authentication certificate from your internal PKI utilizing a new service name. It is advisable to employ your domain name instead of a Microsoft domain. For additional details, refer to the guidelines on utilizing an enterprise PKI certificate.
- Implement a new CMG as a virtual machine scale set, incorporating the newly acquired certificate.
- After clients have updated their policies to include the new CMG, proceed to remove the outdated CMG.
How to Setup SCCM CMG in Virtual Machine Scale Set Model
Now will see the steps to set up CMG in the Virtual Machine Scale Set Model using SCCM.
First, make sure the “Cloud management gateway with Azure VM scale set” feature is Turned On. To check that, navigate to Administration > Updates and Servicing > Features.
Now we have to create a CMG web server certificate. If the web server certificate template is already available. Request a certificate from your Configuration Manager Site server.
If you don’t have an active template, create a webserver certificate template from your CA server with a private key exportable option and proceed further. Here I already have a web server template available. So, in Configuration Manager Server:
- Open Run, type “certlm.msc” and hit Enter.
- It will open the Manage Computer Certificate MMC for you.
- Navigate to Certificate (Local Computer) > Personal > Right Click and All Tasks > Request New Certificate
You will get the Certificate Enrollment pop-up.
- Click on Next to proceed further.
In Select Certificate Enrollment Policy, leave it as default and click Next.
Under the Request New Certificate option, select the available web server certificate template. Click on Configure settings and provide the required details for your certificate.
Here I gave “vklabconfigmgrcmg.WestUS.CloudApp.Azure.Com” as a Common name.
In Certificate Properties, check the Private Key exportable option while requesting a new certificate.
Once the enrollment is completed, export the newly created certificate in a local path.
For client authentication, we also require a couple of certificates. Export your client’s Trusted Root Certificate. If your environment has an Intermediate Trusted Root Certificate, export that as well.
Now we can go ahead and create “Azure Services” from the Configuration Manager console > Administration > Cloud Services > Azure Services node. Give a Name and select the Cloud Management option > Next.
Note! Deploying the Azure services for Cloud Management enables Configuration Manager clients to authenticate with the site using Azure Active Directory (Azure Entra ID). You can also enable this tenant to discover Azure Active Directory resources.
In order to incorporate the website, it is necessary to establish app registrations in Azure AD. For the CMG, two app registrations are required.
- Web application (called a server app in Configuration Manager)
The Azure-hosted CMG components are represented by the server app. It outlines the Azure resources to which they have access. The purpose of the server application is to enable users, managed clients, and the CMG connection point to authorize and authenticate against the Azure-based CMG components. Initial CMG provisioning in Azure, Azure AD discovery, and traffic to on-premises management points and software update points are all included in this communication.
- Native app (in Configuration Manager, referred to as client app)
The client app represents users and managed clients who connect to the CMG. It outlines the resources, including the CMG itself, that they can access within Azure.
Give Web App (Server) and Native App (Client) Application Names, Secret Key Expire duration and login with an Azure AD Admin account.
The Discovery page of the wizard is only necessary in some scenarios. It’s optional when you onboard the site to Azure AD, and not required to create the CMG. If you need it to support specific functionality in your environment, you can enable it later.
So, Enable Azure AD User and Group Discoveries based on your requirements.
Enable Azure AD group synchronization. It also helps to automatically sync the latest data from Azure AD to the Configuration Manager console on a pre-defined interval.
Log in to the Azure portal https://portal.azure.com/ and verify whether the AD apps are created successfully or not under the Microsoft Entra ID > App Registrations blade.
Our prerequisites have been completed. Now we’re good to create CMG. So, go back to the configuration manager console and navigate to Administration Workspace > Cloud Management Gateway node Right click and create Cloud Management Gateway.
The Azure environment will be in “Azure Public Cloud”.
Sign In with a user account having Global Administrator and Virtual Machine Contributor roles in Azure Subscription.
Browse the newly created Web Certificate and select the required Region where you want to create the CMG resource group. You can either select an existing resource group in the same location or create a new one. If you are going with a new resource group, it’s better to give the same name you have already given in the deployment name.
Note! Make sure the deployment name is unique; otherwise, the deployment may fail during the resource-creating time.
Provide the Virtual Machine size and instances. Only 3 sizes are available in the configuration manager right now.
- Lab (B2S): 10
- Standard (A2_V2): 6,000
- Large (A4_V2): 10,000
Note! Small proof-of-concept environments and lab testing are the only uses for the Lab (B2S) size virtual machine. They are not meant to be used in production with the CMG. The B2S virtual machines are cheap and underpowered. This size supports that number of clients since the Configuration Manager technical preview branch only allows ten clients.
We can scale up or down the VM size at a later point in time. Then Import the client authentication certificates (Trusted Root CA/Intermediate Trusted Root CA). If you Verify Client Certificate Revocation, IIS on the VM instance also verifies client certificate revocation. In this example am not able to understand that. If you didn’t originally enable this setting when creating the CMG, you can enable it after publishing the CRL.
Enforce TLS 1.2. The CMG enables this option by default. Require it to use the TLS 1.2 encryption protocol. Starting in version 2107 with the update rollup, this setting also applies to the CMG storage account. This enforcement is only applied to the Azure cloud service VM. It doesn’t apply to any on-premises Configuration Manager site servers or clients.
Allow CMG to function as a cloud distribution point and serve content from Azure storage. The CMG enables this option by default. If you plan on targeting deployments with content to clients, you need to configure the CMG to serve content.
Click on Next and reconfigure alerts based on your requirements. In this example am unchecking Stop this service when the critical threshold is exceeded option and changing both the outbound data and storage alert threshold to 500GB.
The remaining Setting is kept as default. You can also change these values based on your requirements in the future.
Click Next, re-verify the entire summary once before the CMG creation and click Next again.
Analyse the deployment status from CloudMgr.Log under configuration manager and as well as from Azure portal Activity Log.
Note! Default log path (Eg: C:\Program Files\Microsoft Configuration Manager\Logs\CloudMgr.Log)
Login to Azure Portal, Log Path: (Eg: Resource Groups/vklabconfigmgrcmg/Activity log)
A successful creation shows like status Ready and Configuration update completed in the Configuration Manager console.
In the Azure portal, under the newly created Resource Group, you can be able to find the 7 supported resources for cloud service.
(Virtual machine scale set, Key vault, Load balancer, Network security group, Public IP address, Virtual network, Storage account)
Also, verify the functionality via the connection analyser option available in the cloud management gateway node.
Navigate (Administration > Cloud Services > Cloud Management Gateway) Right-click on the newly created CMG “vklabconfigmgrcmg.WestUS.CloudApp.Azure.Com” Right-click Connection Analyzer.
Sign In with an Azure AD user ID and start here; all the checks have been passed without any error. Now, we can conclude the New CMG virtual machine scale set has been configured successfully!
We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here – HTMD WhatsApp.
Author
Debabrata Pati has more than 8+ years of experience in IT. Skilled in MEMCM, Azure, and Powershell. More than Six (6) years of experience in MEMCM (SCCM) administration, OSD, and Troubleshooting for the environment with more than 100K client devices.