Jump to content


Cloud attach - Endpoint Managers silver lining – part 2 Prepare for a Cloud Management Gateway

Recommended Posts


This is part 2 in a series of guides about cloud attach in Microsoft Endpoint Manager, with the aim of getting you up and running with all things cloud attach. This part will focus on preparing your environment for a Cloud Management Gateway (CMG). This series is co-written by Niall & Paul, both of whom are Enterprise Mobility MVP’s with broad experience in the area of modern management. Paul is 4 times Enterprise Mobility MVP based in the UK and Niall is 10 times Enterprise Mobility MVP based in Sweden.

In part 1 we configured Azure AD connect to sync accounts from the on premise infrastructure to the cloud. In this part we'll prepare your environment for a Cloud Management Gateway. A Cloud Management Gateway gives you a whole bunch of new abilities for managing, imaging computers, escrowing BitLocker keys and delivering software, updates and policy to remote based internet enabled clients.

Below you can find all parts in this series.


  • Cloud attach - Endpoint Managers silver lining - part 1 Configuring Azure AD connect
  • Cloud attach - Endpoint Managers silver lining - part 2 Prepare for a Cloud Management Gateway <- you are here
  • Cloud attach - Endpoint Managers silver lining - part 3 Creating a Cloud Management Gateway
  • Cloud attach - Endpoint Managers silver lining - part 4 Enabling co-management
  • Cloud attach - Endpoint Managers silver lining - part 5 Enabling compliance policies workload
  • Cloud attach - Endpoint Managers silver lining - part 6 Enabling conditional access
  • Cloud attach - Endpoint Managers silver lining - part 7 Co-managing Azure AD devices
  • Cloud attach - Endpoint Managers silver lining - part 8 Enabling tenant attach
  • Cloud attach - Endpoint Managers silver lining - part 9 Renewing expiring certificates
  • Cloud attach - Endpoint Managers silver lining - part 10 Using apps with tenant attach



  • Intune Tenant already created
  • Azure Subscription (free trial)
  • Licenses applied, you can grab a free trial of Enterprise Mobility plus Security which includes Intune and Azure AD Premium P2 here (free trial).
  • Intune is configured to auto-enroll devices (guide)

Configuration Manager:

  • PKI enabled (guide)
  • Configuration Manager current branch, version 1810 or later.
  • The MDM authority must be set to Intune

The following permissions are required to be able to set up the Cloud Management Gateway:

  • An account that is a global administrator for Azure Active Directory
  • An account that is a domain admin on your on-premises infrastructure
  • An account that is a full administrator for all scopes in Configuration Manager

Update: At the time of writing Virtual Machine Scale Set was not an option., and now it's the default, it requires different settings such as registering the following services

  • Microsoft.compute
  • Microsoft.network
  • Microsoft.keyvault

change your cname to the new format

cname    cloudattachcmg    cloudattachcmg.<REGION>.cloudapp.azure.com

where <REGION> corresponds to the region of your resource group, eg: westeurope

cname    cloudattachcmg    cloudattachcmg.westeurope.cloudapp.azure.com

for more details, see Pauls blog post here

Step 1. Add Classic Compute and Storage
In order to setup the Cloud Management Gateway, you will need to register a couple of the resource providers in Azure (Microsoft.ClassicCompute & Microsoft.Storage). These resource providers may already be registered in your tenant, but you should check to ensure that they are and if not, act accordingly.

Launch the Azure port at https://portal.azure.com, go to Subscriptions, select your subscription, and choose Resource Providers in the Settings section.

Resource Providers.png

Search for Microsoft.Classic.Compute, select it and if it is listed with a status of NotRegistered then click Register. It will register the provider.

Classic Compute.png

After a few moments the provider should appear as registered.

classic computer registered.png

Repeat the above process for Microsoft.Storage so that both providers are listed as Registered.

both providers registered.png

Step 2. Check for a unique name of your CMG instance

Verify in Azure that you have a unique name for your CMG, this is a unique name using Microsoft’s cloudapp.net namespace. You cannot reserve this name, only check for its availability. To do this, search for Cloud Service in the Azure portal and go to the Cloud service (classic) page. Click Add link.

cloud service classic - add.png

In the DNS name field, search for the name you want to use. Note that this name will not be visible to anyone on the outside world, so can be any available name you want. For our DNS name, we searched for CloudAttachCMG and as a result you want to see green ticks on both Match Found and DNS name. Both conditions must be met, if not you will get a red cross and you will need to search for another name.

Note the .cloudapp.net entry next to the DNS name field, the full name associated with the cloud management gateway VMs will be DNSName.cloudapp.net – so our CMG VM’s will be cloudattachcmg.cloudapp.net.

Do not save anything here, as mentioned you are just checking for availability.

create a cloud service.png

Step 3. Create a CNAME record

You are going to request an external PKI certificate to secure communication to the CMG, but prior to that you need to reate a CNAME record at your external DNS provider. We cannot run through that process, as each provider is different, but you need to create a CNAME record to map to your chosen DNSName.cloudapp.net address.

We have mapped cloudattachcmg to cloudattachcmg.cloudapp.net.

A couple of things to note here:

  • If you have an existing TXT record in your DNS you may need to delete this for the new CNAME to work, we saw issues in two tenants that would not properly create the CNAME record until we removed the previously created TXT record.
  • You will need to add in a CNAME to your internal DNS servers if your internal DNS namespace is identical to your external namespace.

Below you can see the created CNAME record in the DNS provider of the custom domain name we added in part 1.

cname record.png

Tip: You can use dnschecker.org to see that your CNAME has propagated successfully.

Step 4. Create an External PKI cert for the external address

Note: you can run this tool on any computer, it's only needed to generate the files needed in the remaining parts.

We downloaded a digital certificate utility from DigiCert for creating a Certificate Signing Request (CSR) but you can do this process on an IIS server see here. A CSR is a block of encoded text that is given to a Certificate Authority when applying for an SSL Certificate. It is usually generated on the server where the certificate will be installed and contains information that will be included in the certificate such as the organization name, common name (domain name), locality, and country. Source

generate csr.png

Using the tool above (from Digicert, our external SSL certificate provider, there are many to choose from), click on Generate to create the CSR.

gernerated csr.png

After generating the CSR, save it to a file. Next, go to your certificate provider and request a new SSL certificate based on the CSR you just created. The screenshot below is from our certificate provider, DigiCert, your provider will most likely look different.

create ssl certificate using csr.png

When creating the SSL certificate, you'll probably have to prove control over the domain, we chose the option to use a DNS TXT Record (recommended).

prove control over your domain.png

Be sure to enter the cloudattachcmg prefix (yours will be different obviously) into the record for the TXT DNS validation otherwise it might have problems finding the TXT record.

DNS TXT record.png

After creating the TXT record you can verify it with dnschecker, as shown here, this is helpful in troubleshooting whether your DNS record (TXT, CNAME etc...) is valid or not.



After verifying that you own the domain, you'll be able to download the created CRT (certificate).

download CRT.png

Next, import the downloaded CRT back into the Digicert tool.

import crt.png

Click Finish to complete the CRT import process.

finish to import.png

and you should see a notification about the success of the import.

import notification.png


Step 5. Export the pfx

Select the Imported certificate.

imported cert.png

Click on Export Certificate choose the option to export pfx

export pfx.png


You'll be prompted for a password

pfx password.png

and you'll be informed of the successful export.

pfx exported.png

Step 6. Configure Azure services

To configure Azure services from within the Configuration Manager console, use the Configure Azure Services wizard to create two Azure Active Directory (Azure AD) apps.

  • Server app – a Web app in Azure AD
  • Client app – a Native Client app in Azure AD

On the primary site server, open the Configuration Manager console and go to Administration > Cloud Services > Azure Services, and select Configure Azure Services.

configure azure services.png

On the Configure Azure Service page, specify a friendly name for the cloud management service you're configuring, for example Cloud Management Service. Then select Cloud Management from the options and then select Next.

cloud management service.png

On the App Properties page, for Web app, select Browse

app properties.png

 to open the Create Server Application dialog, configure the following fields:

create server application.png

  • Application Name: Cloud Management Server App
  • Home page URL: https://ConfigMgrService
  • App ID URI: https://ConfigMgrService
  • Secret key validity period: 2 years

Next, select Sign in, and specify an Azure AD Global Administrator account. These credentials aren't saved by Configuration Manager. This persona doesn't require permissions in Configuration Manager and doesn't need to be the same account that runs the Azure Services Wizard.

sign in.png

After you sign in, the results display.

cloud management server app signed in.png

Select OK to close the Create Server Application dialog and return to the App Properties page.

app properties page with server app configured.png

Next, select Browse to the right of the Native Client App section, the Create Client Application dialog, and then configure the following fields:

  • Application Name: Cloud Management Client App

And sign in.

cloud management client app.png

Click OK and click OK again, both apps will now be listed.

app properties page with both apps configured.png

On the Configure Discovery Settings page, check the box for Enable Azure Active Directory User Discovery, select Next, and then complete configuration of the Discovery dialogs for your environment.

enable aure active directory discovery.png

Click through to the end of that wizard and close the wizard. Your cloud management service that you just configured will be listed in the console.cloud management service listed.png

Step 7. Set API permissions on the server and client apps

Open a browser and sign in to the Azure portal. Select All services > Azure Active Directory > App registrations, then click All Applications.

all applications.png

Select the Cloud Management Server App you created. Go to API permissions or select View API permissions

View API permissions.png

Click the Grant admin consent link

grant admin consent.png

Click Yes when prompted. You'll be informed of the success.

grant consent successful.png

Repeat this process for the Cloud Management Client App. Pay attention to the fact that it doesn't have the same permissions listed before you grant consent.

cloud management client app api permissions.png

and here is the same app after the api permissions are applied.

cloud management client app api permissions granted.png

That's it for this part !

Please join us in part 3 where we'll configure the Cloud Management Gateway.

Useful links


  • Like 1

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.