Client Installation over Internet
System Center Configuration Manager 1706 simplified the capability to install (bootstrap) the client over internet, this blog post walks through two scenarios -
- AAD joined device – Modern management of Windows 10 devices leveraging Azure.
- Workgroup device – Servers on DMZ without corporate network access
Prerequisites
The table below lists the requirements for each scenario -
Scenario |
Client PKI |
Cloud DP |
CMG |
HTTPS MP |
Sync AAD Users |
Azure Web/Client Apps |
Intune |
AAD Joined Device |
No |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes (Optional) |
Workgroup Device |
Yes |
Yes |
Yes |
No |
No |
No |
No |
Client PKI -
For AAD Joined devices you don't need one as ConfigMgr leverages Azure authentication
For Workgroup devices, we need a PKI certificate from an internal CA or Public CA.
Cloud DP –
Required for both the scenarios to provide content.
Instructions to setup a Cloud DP - https://social.technet.microsoft.com/wiki/contents/articles/37914.cloud-distribution-point-part-1.aspx
Additional Reference -
/en-us/sccm/core/plan-design/hierarchy/use-a-cloud-based-distribution-point /en-us/sccm/core/servers/deploy/configure/install-cloud-based-distribution-points-in-microsoft-azure
CMG –
Required for both the scenarios.
Instructions to setup a CMG - https://blogs.technet.microsoft.com/arnabm/2016/12/19/step-by-step-cloud-management-gateway/
Additional Reference -
/en-us/sccm/core/clients/manage/setup-cloud-management-gateway
HTTPS MP –
Required only for AAD Joined Devices to authenticate in an absence of a PKI certificate.
Its optional for Workgroup Devices but recommended.
Sync AAD Users & Azure Web/Client Apps
Required only for AAD Joined Devices.
Instructions to create Azure Web & Client Apps and sync AAD Users - https://blogs.technet.microsoft.com/arnabm/2017/06/10/modern-management-of-internet-clients/
Intune –
For AAD Joined devices to push the ConfigMgr agent (CCMSetup.MSI), the source files will be downloaded from the CMG. Refer the above blog post for instructions to deploy applications via Intune.
If you don't have Intune, leverage an alternate tool to push CCMSetup.exe/msi [Refer the command lines below]
Command Line –
#AAD Command Line
ccmsetup.exe /nocrlcheck /mp:https://CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 CCMHOSTNAME=CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 SMSMP=https://remote1.contoso.net SMSSiteCode=CS1 AADTENANTID=256ed977-4388-a224-3d441dfb0def AADTENANTNAME=Contoso AADCLIENTAPPID=45b4c32c-89f9-4770-8a8b-a37d34fd2632 AADRESOURCEURI=https://contoso.onmicrosoft.com/d098acfa-8874-4ef6-a610-07440fb52c7c
#AAD Command Line for Intune [uses CCMSetup.MSI, below are parameters for the MSI]
CCMSETUPCMD="/nocrlcheck /mp:https://CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 CCMHOSTNAME=CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 SMSMP=https://remote1.contoso.net SMSSiteCode=CS1 AADTENANTID=256ed977-4388-a224-3d441dfb0def AADTENANTNAME=Contoso AADCLIENTAPPID=45b4c32c-89f9-4770-8a8b-a37d34fd2632 AADRESOURCEURI=https://contoso.onmicrosoft.com/d098acfa-8874-4ef6-a610-07440fb52c7c"
#Workgroup Command Line
ccmsetup.exe /nocrlcheck /mp:https://CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 CCMHOSTNAME=CONTOSO.CLOUDAPP.NET/CCM_Proxy_MutualAuth/72057594037937951 SMSSiteCode=CS1 /UsePKICert CCMALWAYSINF=1
Table reference for command line switch –
Thanks,
Arnab Mitra