Enhanced security for Configuration Manager administration service
We're introducing a new cloud application with limited access to the administration service. This feature allows cloud management gateway (CMG) to segment the admin privileges between a management point, and the administration service. This enables CMG to restrict access to the administration service. This feature gives admins granular access controls through which users can have access to the administration service and to enforce MFA if necessary.
An administrator can now approve or deny the request for deploying an application on a device from anywhere they have internet access by selecting a link in the email notification. This feature requires admins to manually add the CMG URL in the Azure Active Directory app as single page application redirect URI.
Include and prefer a cloud source for a management point in a default boundary group
Until 2203 current branch, you didn’t have an option to prefer a CMG as a management point in a default boundary group. The clients falling back to a default boundary group could only communicate to non-cloud-based management points.
When a site is initially installed, there's a default site boundary group created for each site, and all the clients use it by default until they're assigned to a custom boundary group.
Starting in Configuration Manager 2207, you can add options via PowerShell to include and prefer cloud sources. For instance, you can set the CMG as the preferred management point for the clients in the default boundary group.
Granular control over compliance settings evaluation
You can now define aScript Execution Timeout (seconds)when configuring client settings for compliance settings. The timeout value can be set from a minimum of 60 seconds to a maximum of 600 seconds. This new setting allows you more flexibility for configuration items when you need to run scripts that may exceed the default of 60 seconds.
Improved manageability of automatic deployment rules (ADRs)
You'll now be able to organize ADRs with folders. This improvement helps you with better categorization and management of ADRs across your organizational hierarchy by having a structured view across your phased deployments. Folder can also be created with PowerShell cmdlets.
Based upon your feedback, we have enhanced monthly maintenance windows scheduling. You can now set monthly maintenance window schedules to better align deployments with the release of monthly software updates by configuring offsets. For example, using an offset of two days after the second Tuesday of the month, sets the maintenance window for Thursday.
Improved Microsoft Defender for Endpoint (MDE) onboarding for Windows Server 2012 R2 and Windows Server 2016
Configuration Manager version 2207 now supports automatic deployment of modern, unified Microsoft Defender for Endpoint for Windows Server 2012 R2 & 2016. Windows Server 2012 and 2016 devices that are targeted with Microsoft Defender for Endpoint onboarding policy will use the unified agent versus the existing Microsoft Monitoring Agent based solution, if configured through Client Settings.
Windows Defender Application Guard is now called Microsoft Defender Application Guard in the console.
TheGeneralsettings page in the Microsoft Defender Application Guard now allows you to create policies within Configuration Manager to protect your employees using Microsoft Edge and isolated Windows environments.
TheApplication Behaviorsettings page allows you to enable or disable cameras and microphones, along with certificate matching of the thumbprints to the isolated container.
The following items were removed:
The Enterprise sites can load non-enterprise content, such as third-party plug-in settings, under theHost interactionpage.
The file trust criteria policy, under theFile Managementpage.
When performing a search on any node in the console, the search bar will now include aPathcriteria to show that subfolders in the node are included in the search.
The path criteria is informational and can’t be edited.
By default, all subfolders will be searched when you perform a search in any node that contains subfolders. You can narrow down the search by selecting the “Current Node” option from the search toolbar.
Improvements to the dark theme
The dark theme has been available as a pre-release feature since 2203. In this release we've extended the dark theme to additional components such as buttons, context menus, and hyperlinks. Enable this pre-release feature to experience the dark theme.
Distribution point content migration support is now available for migrating content from one distribution point to another distribution point using PowerShell cmdlets. You can also monitor the distribution point migration status using these PowerShell cmdlets.
There are multiple scenarios where the content of one distribution point needs to be migrated to another distribution point.
Cloud distribution points (CDP) hosted on Azure classic services will be unsupported in 2024. You need to migrate CDP content to another distribution point.
Migration of cloud migration gateway (Classic CMG) hosted with *.cloudapp.net domain will also be unsupported. You may need to migrate CMG classic content to another distribution point.
You may need to migrate local distribution point content to other local distribution point or CMG.
The user's security role permission should have "Copy to Distribution Point" enabled under Distribution Point.
If you want to deprecate the source distribution point, make sure that the source and destination distribution points have the same boundary group.
The destination distribution point should be installed already and able to receive the content.
Note: You can't currently configure this behavior from the Configuration Manager console. For more information on configuring this behavior with PowerShell, see the cmdlet details.