Search the Community

We're trying to set up a Cloud Management Gateway and following the regular guides all works fine until one of the last steps, the actual creation of the CMG in Azure. At the beginning of the wizard I just log in to my Azure admin account that I used to set up all other parts. The wizard then auto-populates all Azure fields and finds the correct resource group. When clicking finish it shows the error: Error occurred when granting Contributor permission to the Azure AD app for resource group RG-SCCM-CMG. For more information, see SmsAdminUI.log When checking SmsAdminUI.log we see: Hyak.Common.CloudException\r\nInvalidAuthenticationTokenTenant: The access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-xxxx-xxxx-xxxx-xxxx/'. It must match the tenant 'https://sts.windows.net/aa3c372d-xxxx-xxxx-xxxx-xxxx/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/aa3c372d-xxxx-xxxx-xxxx-xxxx' to get the token. The guid starting with aa3c372d is indeed our correct tenant ID. I have no idea where the one with f8cdef31 comes from. I've search for this guid in our Azure subscription but nothing pops up. Also in SCCM under Azure Active Directory Tenants only the tenant with aa3c372d is shown. Anyone an idea of what could be wrong?

Hi, I have an issue with my CMG and I can´t seem to resolve it. Running ConfigMgr 1910 and using only HTTPS mode with internal PKI. I need some help on where to look, I have replaced the CMG certificate in an attempt to see if that fixed the issue but to no avail. Attached the client location log and it says it can´t resolve the name I can do nslookup and get the cloudapp.net from the external server domain address. I also have a client computer certificate, which should work since we use PKI internally for ConfigMgr too. Cleared the WinHTTP settings just in case since I got an error that it could not resolve the name via WinHTTP. I can download the PKI CRL file (http), it is in the certificate. Regards Niklas