Blog Post

Configuration Manager Blog
4 MIN READ

Managing remote machines with cloud management gateway in Microsoft Endpoint Configuration Manager

RobYork's avatar
RobYork
Icon for Microsoft rankMicrosoft
Mar 18, 2020
In light of the global situation that has escalated over the past weeks regarding COVID-19 and the coronavirus; there has been a significant increase in the number people working from home. Indeed, m...
Updated Mar 18, 2020
Version 3.0
cloud-attached management
cm current branch
Unified Endpoint Management
RichMawdsley's avatar
RichMawdsley
Copper Contributor
Mar 31, 2020

Glad to see we're not the only ones with the issue;  User Apps not appearing in Software Center when utilising CMG + EHTTP + VPN.

 

I'm getting no where with my PremSupport case.  RobYork this realllly feels like a bug..  Are you able to confirm that when client is on Intranet (via VPN), with CMG as it's sole Site Server in boundary, that when it contacts the CMG upon opening Software Center, it should use Windows Authentication, as opposed to AAD Authentication (which works when on Internet) as per the below lines:

 

Intranet Software Center:

Using endpoint Url: https://FQDN-OF-CMG/CCM_Proxy_MutualAuth/XXXXXXXX:443/CMUserService_WindowsAuth, Windows authentication (Microsoft.SoftwareCenter.Client.Data.ACDataSource+<>c at <RefreshLocalSettingsAsync>b__16_0)

 

Internet Software Center:

Using endpoint Url: https://FQDN-OF-CMG/CCM_Proxy_ServerAuth/XXXXXXXX/CMUserService, AAD authentication (Microsoft.SoftwareCenter.Client.Data.ACDataSource+<>c at <RefreshLocalSettingsAsync>b__16_0)

 

The issue here is also that because it fails with Windows Authentication, it takes 2 minutes of 403 returns (confirmed by iis on CMG) until Software Center actually loads.

 

It really feels like someone has just forgotten that the CMG being a sole Site System on Intranet was a possible outcome, and the 'Intranet Only' switch in the sms agent instantly sets it to Windows Auth be damned.