Systems Management

Building a ConfigMgr Lab from Scratch: Step 16 – Setting up CMG in the Console

Topics: Systems Management

Building a ConfigMgr Lab from Scratch: Step 16

Setting up CMG in the Console

We’re four posts into our CMG Sub Series here, and we’re finally getting to the CMG setup. We’re going to go through the CMG Setup in the Console. Looking back, we needed to create our Certs (Note, if you’re not using an internal CA but a cert from a Cert Provider then you didn’t need to worry about that, but I’m not covering that setup, but merely an overview of how I set it up for our lab and hopefully it will be of use) and we’ll need our Azure Services already setup.

If you’re also following along in MS Docs, we’re up to this Point in the docs.

Setting up tje CMG Console

From the Administration Node -> Cloud Services -> Cloud Management Gateway -> Right Click -> Create Cloud Management Gateway
Here we Sign in with our Azure Account that has the proper permissions, as we talked about previously.
Once you sign in, if you have more than one subscription choose the proper one, and the rest should auto-populate.
Now we get to a fun part, lots of stuff to fill in. First, you’ll need to add that Certificate we created in an earlier post.
Browse and select our CMG Cert
It then prompts for the Password we placed on the certificate.
Once it imports, it creates this warning, since I created it with a wildcard since I wasn’t sure at the time what name I was going to use.  Let’s go ahead and finish filling it out
I’ve decided to go with recastdevcmg as the name.  The name you pick will automatically be placed into the box after it. You’ll see that MS uses its own domain behind the scenes (

NOTE… YOU NEED TO SETUP A DNS ALIAS for your custom CMG Name [] to the Microsoft backend name []. If you don’t have that in place, your clients and servers will not be able to communicate with the CMG in Azure.

alright, going back to that last image, I found it easiest to have the wizard create a new Resource Group in Azure.  I made sure it was a unique name, and one pretty easy to know what it was when you’re in the Azure Portal. Also please note, that you’re going to want to uncheck that box for “Verify Client Certificate Revocation” unless you don’t.. but if you’re not sure, then you’ll want to uncheck it. [MS Docs] (as shown below).. sorry I didn’t do that when I first set it up and was grabbing the screen captures, and I found it caused some issues. But it wasn’t really practical, but thankfully some of these settings you can change after the fact… like that one. I also checked the box to all the CMG to function as a cloud DP, which is pretty cool, and I’ve been doing tests with my client that doesn’t have a VPN connection back to the lab, and it’s great that I can install applications from the software center without being on the network. But I’m getting ahead of myself. While you’re still on the screen in the wizard you’ll need to load your CA Cert, which I’ll show below too.

Make sure you uncheck that box in the wizard above, as I forgot originally. More info about this in the MS Docs if you want to understand what that box does.
This shows what you see when you click on the Certificates button, it will show any certs you already have in there, I didn’t have any, so I clicked add, then browsed to my root CA cert and added.
It will then pull the Cert in, and you can specify which Store, you’ll want to make sure it’s the Trusted Root Certificate Authorities store.
On the next page, I just left the defaults.
And Complete! Success!

We now see our CMG service set up in the console, and its status is provisioning.

Going into Azure Portal, in the Resource Groups, I see the Resource Group that was created by the wizard.
Digging into the Resource Group I can see that is being deployed right now.
And here we are, my CMG is set up in that Group, and you can see the MS Provided URL

Ok, so now we have our CMG, in the next post(s) we’ll go over how to leverage this new CMG. We still have a few more things to set up in the Console before it’s useable.

So we’re getting close, so hang in there team!

Building a ConfigMgr Lab from Scratch Series

Series Introduction – Building a CM Lab from Scratch

  1. Setting up your Domain Controller
  2. Creating a Router for your Lab using Windows Server 
  3. Certificate Authority – On Domain Controller [Optional]
  4. ConfigMgr Server Pre-Reqs (Windows Features)
  5. Configuration Settings (AD & GPOs)
  6. Source Server (File Share)
  7. ConfigMgr SQL Install
  8. ConfigMgr Install
  9. ConfigMgr Basic Settings
  10. ConfigMgr Collections & App Deployment
  11. ConfigMgr OSD
  12. ConfigMgr Reporting Services
  13. Cloud Management Gateway (CMG) – Certs PreReq
  14. Cloud Management Gateway (CMG) – Azure Subscription
  15. Azure Services Connection
  16. Setting up CMG in the Console – You are Here
  17. Cloud Management Gateway (CMG) – Post CMG Config
  18. Cloud Management Gateway – Client CMG Endpoints
Back to Top