How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune

0
SCCM Tenant Attach Device Sync

In Configuration Manager, production version 2002, Microsoft introduced a new feature called “Tenant attach“. With this feature, you can synchronize ConfigMgr agents to Intune without enrolling in Intune. Once synchronized, the ConfigMgr device will be visible in Microsoft Endpoint Manager Admin Center (MEMAC).

The key point here is that ConfigMgr client is in Intune console without enrolling in Intune. This means your ConfigMgr managed device does not needs co-managed to avail of some of the Cloud benefits.

Related Posts SCCM 2002 Installation Step By Step Guide | MEMCM | ConfigMgr & PowerShell Script To Enable Opt-In Version Of SCCM 2002 Early Update Ring

TL;DR

Introduction

Both tenants attached and co-managed devices will be visible in single MEMAC console but they are not the same.

  • Co managed device = SCCM agent + Intune enrolled
  • Tenant attach device = SCCM agent synced to MEM (Not Intune enrolled)

The co-managed device got a lot more options available in Microsoft Endpoint Manager Admin Center (MEMAC). However, In the future we can expect a lot more features for tenant-attached devices also in MEMAC console. Below are some of the cloud benefits ConfigMgr tenant attach provide:

  • Single Microsoft Endpoint Admin Console (MEMAC) to manage ConfigMgr and intune devices.
  • ATP Integration
  • Helpdesk troubleshooting
  • User Experience Analytics
  • Web front-end CMPivot

Note: Above listed benefits announced in ignite 2019 is not yet available to public. Only limited features are available at the time of writing. We will discuss some of the features currently available.

Prerequisites

  • Appropriate access to SCCM infra (Full Admin preferably)
  • Recommended to perform this activity from the Tier 1 server in ConfigMgr Hierarchy (CAS) or standalone primary server
  • Global Administrator account for signing in the Tenant onboarding page (configuration in SCCM).
  • An Azure public cloud environment.
  • The user account triggering device actions has the following prerequisites:
    • The Notify Resource permission under Collections object class in Configuration Manager.
    • On-Prem user synchronized to azure using AADconnect
  • SCCM server should have access to below Internet endpoints
    • https://aka.ms/configmgrgateway
    • https://gateway.configmgr.manage.microsoft.com
    • https://us.gateway.configmgr.manage.microsoft.com
    • https://eu.gateway.configmgr.manage.microsoft.com

Tenant attach high level Architecture

There are three components in Tenant attach Architecture.

SCCM Tenant Attach Device Sync Architecture
SCCM Tenant Attach Device Sync Architecture
  • ConfigMgr agent:
    • ConfigMgr client communicate with ConfigMgr server as normal.
    • There is no change. In addition, there is no need to enroll to Intune.
  • ConfigMgr server:
    • ConfigMgr synchronizes devices to Microsoft Endpoint Manager Admin Center (MEMAC).
    • ConfigMgr server receive instructions from Microsoft Endpoint Manager Admin Center (MEMAC) and forward the instructions to ConfigMgr clients.
    • ConfigMgr server plays middleman between Intune and ConfigMgr client.
  • Intune:
    • MEMAC console show the SCCM Devices synchronized from SCCM server to Intune.

Note: In this architecture, entire ConfigMgr database will not be synchronize to Intune. It is a on demand architecture. MEMAC console connects to SCCM only when required or admin initiate action.

How to configure Tenant Attach?

The configuration required for the tenant attach is within co management wizard. If you have not enabled co management wizard then follow the steps as mentioned here . There is a good post from Windows noob on tenant attach

In Configuration Manager Admin console, go to Administration > Overview > Cloud Services > Co-management.

SCCM Tenant Attach - CoMgmtSettingsProd
SCCM Tenant Attach – CoMgmtSettingsProd
  • Ensure your Azure environment is AzurePublicCloud.
  • Tenant is boarded to azure by singing in using your Global Administrator account.
Tenant Onboarding SCCM Infra
Tenant Onboarding SCCM Infra
  • Ensure you select the option “upload to MEM admin center”
  • Please make sure you select a collection for which you want to devices to synchronize. Its recommended to select a test device collection to start with. Also, ensure you exclude the servers managed by ConfigMgr
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 1
  • Tenant attach sync setting has nothing to do with co-management. However, tenant attaches settings are available within the co-management wizard.
  • Note: In my scenario, I do not have any co-managed devices so I configured it as none for Intune enrollment. You need to decide the configuration based on your scenario.
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 2
  • Below azure AD application gets created automatically after completing the configuration in ConfigMgr. You can see the events for troubleshooting from the log SmsAdminUI.log
  • You can see the application name starts with “ConfigMgrSVC_… “
  • ConfigMgr server communicate with cloud using this Azure AD Web application.
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 3

We completed the configuration. Let us discuss how ConfigMgr server establish a connection with Intune and upload the devices.

Log Files – Troubleshooting

Let’s see how log files can help to troubleshoot the issue with device sync and tenant attach.

ConfigMgr Device Upload to Intune Workflow

GatewaySyncUploadWorker.log :

This log tracks the connectivity between ConfigMgr and Intune . You can use this log to troubleshoot if ConfigMgr devices does not upload to MEMAC console

  • ConfigMgr server selects the gateway to upload the device based on the location.
  • Next, the ConfigMgr server will authenticate and establish the connection.
  • Once succeeded, ConfigMgr agent uploads to Intune through the gateway.
  • You can see the ConfigMgr client records uploaded in batch

If you enable verbose logging, log will tell the bytes written to network for upload. Based on my testing this network traffic is less. Moreover, follow-up device synch will be delta only.

  • The default upload sync interval is 15 min (delta)
  • Response code 200 state the connection between ConfigMgr and Intune is successful
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 4

After successful upload , You can start seeing your ConfigMgr client in Microsoft endpoint manager admin center console

How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 5

Until now, we discussed the device upload events from ConfigMgr to intune. Next, let us discuss the workflow from MEM admin console to ConfigMgr.

Intune to SCCM event workflow

At the time of writing this post, only limited features are available in MEM admin console for ConfigMgr clients as listed below

  • Machine policy synch
  • User policy synch
  • Application evaluation
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 6

Let us see what happens when I trigger a machine policy from MEM admin console. Below are the high-level activities

  1. MEM admin console sent instruction for triggering machine policy to ConfigMgr server
  2. ConfigMgr server receive notification from MEM gateway and authenticate
  3. Forwards as BGB instruction and process
  4. ConfigMgr server sent the notification to ConfigMgr client
  5. ConfigMgr client receive the instruction from ConfigMgr server and process
  • MEM admin console sent the machine policy instruction to the ConfigMgr server. Initially, you can see the status will show pending.
SCCM Device Sync Troubleshooting
SCCM Device Sync Troubleshooting

cmgatewaynotificationworker.log :

This log tracks the events from from Intune to ConfigMgr. You can refer this log while troubleshooting communication between Intune and ConfigMgr.

SCCM Device Sync Troubleshooting
SCCM Device Sync Troubleshooting
  • ConfigMgr server receive the notification and authenticate the user who initiated the policy from MEM console.
  • If user authentication is successful, the ConfigMgr BGB remote task will process further
How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 7
SCCM Device Sync Troubleshooting

You may get below error if the user is not having necessary ConfigMgr permission as mentioned in pre-req. Also If user is not an on Prem user id and not synchronized to azure then we see below error

Unauthorized to perform client action. TemplateID: RequestMachinePolicy TenantId: ed7ef5f4-73f7-4c1d-83de-453635ac145d AADUserID: f91c3e40-4c30-42e0-b0eb-c5663d549b75

How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 8
SCCM Device Sync Troubleshooting

ConfigMgr process the BGB notification service. Then sent the notification to ConfigMgr client.

How to Build Tenant attach for Microsoft Endpoint Manager | SCCM | ConfigMgr | Intune 9
SCCM Device Sync Troubleshooting

You can also track the status for the ConfigMgr client Machine policy, which you initiated from MEM console. The different status are Complete or pending or failed as shown below.

SCCM Device Sync Troubleshooting
SCCM Device Sync Troubleshooting

For this post I used MEM admin portal from my mobile phone to manage SCCM agent. We could manage my SCCM agent from mobile web browser. This is great step.

Resources

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.