Supported configurations for cloud management gateway

Article
11/16/2023

Applies to: Configuration Manager (current branch)

Use this article as a reference for the features and configurations that are supported by the Configuration Manager cloud management gateway (CMG).

Specifications

All Windows versions listed in Supported operating systems for clients and devices are supported for CMG.
CMG only supports the management point and software update point roles.
CMG doesn't support clients that only communicate with IPv6 addresses.
Software update points using a network load balancer don't work with CMG.
Starting in version 2203, the option to deploy a CMG as a cloud service (classic) is removed. All CMG deployments should use a virtual machine scale set. For more information, see Removed and deprecated features.
CMG names need to be between 3-24 alphanumeric characters. The name must begin with a letter, end with a letter or digit, and not contain consecutive hyphens.

Support for Configuration Manager features

The following table lists CMG support for Configuration Manager features:

Feature	Support
Software updates
Endpoint protection	^Note 1
Hardware and software inventory
Client status and notifications
Run scripts
CMPivot
Compliance settings
Automatic client upgrade
Client install (with Microsoft Entra integration)
Client install (with token authentication)
Software distribution (device-targeted)
Software distribution (user-targeted, required) (with Microsoft Entra integration)
Software distribution (user-targeted, available) (all requirements)
BitLocker Management
Pull distribution point source
Windows in-place upgrade task sequence ^Note 2
Task sequence without a boot image, deployed with the option to Download all content locally before starting task sequence ^Note 2
Task sequence without a boot image, deployed with either download option ^Note 2
Task sequence with a boot image, started from Software Center ^Note 2
Task sequence with a boot image, started from bootable media ^Note 2
Any other task sequence scenario ^Note 2
Content for PXE or multicast-enabled deployments
Client push
Automatic site assignment
Software approval requests
Configuration Manager console
Remote tools	^Note 3
Reporting website
Wake on LAN
macOS clients
Peer cache
On-premises MDM
Alternate content providers	^Note 4
Content for App-V streaming applications
Content for Microsoft 365 Apps updates
Prestage content

Key
= This feature is supported with CMG by all supported versions of Configuration Manager
(YYMM) = This feature is supported with CMG starting with version YYMM of Configuration Manager
= This feature isn't supported with CMG

Support notes

Note 1: Support for endpoint protection

Clients that communicate via a CMG can immediately apply endpoint protection policies without an active connection to Active Directory.

Note 2: Support for task sequences

For more information about support for deploying a task sequence to a client via the CMG, see Deploy a task sequence over the internet.

Note 3: Support for remote tools

As announced at Microsoft Ignite 2021, a public preview of the new remote assistance solution is now available in the Microsoft Intune admin center. This cloud-based tool can help you more securely support users of Windows devices.

For more information, see the following resources:

Note 4: Support for alternate content providers

Alternate content providers aren't supported to get content from a content-enabled CMG. You can still use them on a client that communicates with a CMG and gets content from other supported content locations.

Tip

Starting in version 2203, you can also configure the task sequence to allow token authentication with alternate content providers. For more information, see Task sequence variables: SMSTSAllowTokenAuthURLForACP.

Next steps

Next, plan how the design the CMG for the best performance at the appropriate scale:

CMG performance and scale