With the release of the build 1706 of System Center Configuration Manager Current Branch, it is now easier to manage Internet clients. Windows 10 Azure AD Joined devices do not need anymore certificate to authenticate against your SCCM.
The need for client authentication certificates is now removed (there is some prerequisites) and you can now deploy the SCCM client to these clients too.
So here are the steps to take advantage of this new functionalities
To be able to get your Internet client authenticating against SCCM you must meet the following:
- Have an Azure AD – this should be easy as you already have Azure AD when you use Office 365
- Your Internet client must run Windows 10 and be Azure AD Joined
- Your SCCM must have at least one management point configured for HTTPS mode and have setup the Cloud Management Gateway (see http://blog.hametbenoit.info/Lists/Posts/Post.aspx?ID=838 for details)
For this post I’m not covering the Cloud Management Gateway deployment and configuration; please refer to above link.
As first step you need to ensure your have installed the update 1706 for SCCM – without it, you will not get these functionalities available (except the Cloud Management Gateway which came with an earlier build)
After the installation of the build 1706, you should see the following in your SCCM Console within the Administration workspace below the Cloud Services section
- Azure Services
- Azure Active Directory Tenants
- Using the SCCM console, select Azure Services and configure them
- Follow the wizard to add Cloud Management – do not be confused with the Cloud Management Gateway
- Then define the Azure web apps properties; validate your Azure environment (should usually be Azure PublicCloud – it depends on your Azure services, either public or government); for each Web App and Native App click on Browse which then will open a window to let you select the Azure app to use. (see below sections for the details – Create new application or Reuse existing application)
NOTE if you already have create an Azure App to get SCCM working with Azure for OMS integration or Windows Store for Business you can reuse it
- Once the applications have been defined, you can then enable the Azure Active Directory User Discovery; if you click on the Settings button you will have the same options than for other user discovery methods to define when to run it. I would recommend to update the delta synch to match the Azure AD Connect synchronization interval.
NOTE if you need to reconfigure the discovery interval, it will be available in the Discovery tab of the management cloud service after the creation
- Finally you get the configuration summary as usual
- And this is it, SCCM is now configured to allow Windows 10 Azure AD Joined management
Next step is to configure your SCCM client to allow the use of this service.
- Create or edit Client Settings for the following options Cloud Services
- You need to Automatically register Windows 10 domain joined devices with Azure AD and Enable clients to use a cloud management
- Finally you need to deploy/update your SCCM client deployment to configure it for this functionality; you need to use the following command
ccmsetup.exe /NoCrlCheck /Source:<local location of the SCCM setup files> CCMHOSTNAME=<name of your Internet management point> SMSSiteCode=<your SMS site code> AADTENANTID=<your Azure tenant ID – see Re use existing web app below to get this> AADTENANTNAME=<your Azure tenant name> AADCLIENTAPPID=<the application ID – see Re use existing web app below to get this > AADRESOURCEURI=<the application URL – see Re use existing web app below to get this>
Create a new web app
Follow these steps only if you plan to create a new Azure web app for this service or if this is the first time you configure SCCM to work with Azure (meaning you do not have configure OMS or Windows Store for Business for use with SCCM).
- On the Server app window, click on Create and fill the fields
- Application Name: the name of your new application. I would recommend to use an understandable name
- Home page URL: is the sign in pa
ge to access the application. Use any URL you want, this will not be used in this context
- App ID URI: same as above
- Secret key validity period: defines how long the secret key is valid to authenticate against the application; maximum is 2 years
- Then you need to sign in to Azure AD with a global administrator account; this is just to initiate the app creation
- The application has been created on your Azure AD; you can confirm by logging on the Azure portal and searching for the application in the Azure Active Directory\Applications
Re use existing web app
Follow these steps only if you plan to reuse an existing app already integrated with SCCM or if you have manually and separately created it on Azure
- On the Server app window, click on Browse and fill the fields
- Azure AD Tenant Name: you can get it by connecting to your classic Azure portal and access the Active Directory section – the URL contains your tenant https://manage.windowsazure.com/<your tenant>#Workspaces/ActiveDirectoryExtension/directory or from your ARM Azure portal by accessing the Azure Active Directory blade and then accessing the Domain names options, your tenant will be the one with .onmicrosoft.com
- Azure tenant ID: you can get it by connecting to your classic Azure portal and access the Active Directory section – the URL contains your tenant ID https://manage.windowsazure.com/<your tenant>.onmicrosoft.com#Workspaces/ActiveDirectoryExtension/Directory/<your tenant ID>/directoryDashboard, or from your ARM Azure portal by accessing the Azure Active Directory blade and then accessing the Properties options
- Application Name: is the existing application name; you can get it either from the Azure portals in the Azure AD\Applications options
- Client ID: is the application client ID; you can get it either from the Azure portals in the Azure AD\Applications options
- Secret key: is the secret key generated when the application has been created; there is no way to get it back if you did not saved it to a vault; in this case you need to create a new secret key
- Secret key expiry: is the date when the secret key is expiring; you can get it from the Azure portals in the Azure AD\Applications options
- App ID URL: is the home page/sign in URL defined when the application has been created; you can get it from the Azure portals in the Azure AD\Applications options
Once all the fields have been filled, click Verify. If everything is correct, the Ok button becomes available, if not correct any incorrect values
Finally you need to grant the permissions to these application to get the synchronization working.
To do so, logon to your Azure portal (https://portal.azure.com) and access Azure Active Directory component
From there access the Application Registration blade and search for the newly created applications
And finally access the Required Permissions option and grant the permission; this will automatically apply the required permission for the application to work
You can use the SMS_AzureAD_Discovery_Agent.log SCCM log file; if you get the unauthorized error this means the permissions have not been set (or not yet applied)
Otherwise you should see the discovery process
And in the SCCM console, the Azure Client Cloud Management component will show the last sync (full or incremental) time
And in the Users list you will start seeing users prefixed with your tenant display name with the Agent name set to SMS_AZUREAD_USER_DISCOVERY_AGENT