• yes the CMG seems to work correctly (ran connection analyzer >all is green)

• we already tried uninstall and reinsintall the CMG connection point . role installation is ok , but still have same error in SMS_CLOUD_PROXYCONNECTOR.log

• we are also able to distribute packages to the CMG with no issue .

• from sccm client, the CMG is known , but device can't receive policy when connected over internet
  -test port 443 from lan to CMG ,port is opened

• from azure we activated the RDP on the CMG and are able to loggin the CMG over internet (not over lan port 3389 not opened there.
  - checked CMG logs no errors
  - checked IIS config on CMG ,ok
  - checked CMG certificat (provided by external provider) , the certificat is installed on the CMG and correctly configured in IIS on port 443
  

  • checked IIS logs on CMG , log indicates only internal communication within the cmg

-rebooted the CMG server and the cmgconnection point server has not sovled the error in SMS_CLOUD_PROXYCONNECTOR.log

Yes they all are.

Here are the errors I see in Admin:

MDM PolicyManager: Set policy precheck precheck call. Policy: (Security), Area: (RequireRetrieveHealthCertificateOnBoot), int value: (0x1) Result:(0x80004005) Unspecified error.

MDM PolicyManager: Set policy int, Policy: (RequireRetrieveHealthCertificateOnBoot), Area: (Security), EnrollmentID requesting set: (), Current User: (Device), Int: (0x1), Enrollment Type: (0x6), Scope: (0x0), Result:(0x80004005) Unspecified error.

MDM ConfigurationManager: Command failure status. Configuration Source ID: (), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Vendor/MSFT/Policy/Config/Security/RequireRetrieveHealthCertificateOnBoot), Result: (Unspecified error).

Hi, thank you for taking the time to answer.

I forgot to mention it's enterprise edition.

As for the event logs, that is way I'm asking here, because I don't know where to look to see why it's not applicable.

Would it be somewhere under Applications and Services - Microsoft - Windows - DeviceManagement-Enterprise_diagnosticts-Provider?

Here's the screenshot I see in MEM

Don't hesitate if you need more information?

Thank you for the reply.

Sorry I forgot to mention that it was for WUFB Update compliance that uses KQL.

Hi, we're using both, but WUFB workload is set to Intune .

Yes an no, like I mentionned, it seems to be not supported to do HAAD and silent bitlocker with Intune.

I'M still waiting for premier support to contact me to give me the official statement.

Hopefully by the end of the week.

It was just to be sure that I had the proper link for what I was looking for and that I didn't missread/understand what was written there.

Thank you for confirming.