Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to: Configuration Manager (current branch)
Update 2609 for Configuration Manager current branch is available as an in-console update. Apply this update on sites that run version 2503 or later.
As of October 26, 2026, version 2609 is globally available for all customers to install.
Always review the latest checklist for installing this update. For more information, see Checklist for installing update 2609. After you update a site, also review the Post-update checklist.
To take full advantage of new Configuration Manager changes, after you update the site, also update clients to the latest version. New functionality appears in the Configuration Manager console when you update the site and console, but the complete scenario isn't functional until the client version is also the latest.
For a list of significant customer-reported issues resolved in this release, see the Summary of changes in Configuration Manager version 2609 knowledge base article.
Site infrastructure
Prerequisite warning for automatic approval of all clients
The upgrade prerequisite check warns when the client approval method is set to Automatically approve all computers (not recommended). This check is a warning and doesn't block the upgrade.
Important
The Automatically approve all computers (not recommended) option is planned for removal in a future release because it allows untrusted computers to be approved without administrator review. We strongly recommend that you stop using this option as soon as possible. In Hierarchy Settings, change the client approval method to manual approval or automatic approval for computers in trusted domains.
For more information, see Insecure client approval method.
SQLCLR assemblies no longer require TRUSTWORTHY
The site database no longer requires the TRUSTWORTHY property to load Configuration Manager SQLCLR assemblies, including when you use SQL Server Always On availability groups. Configuration Manager also verifies that its SQLCLR assemblies are Microsoft-signed.
For configuration details, see SQLCLR assembly trust.
Supported platforms and dependencies
Windows Server 2012 and 2012 R2 client support removed
Configuration Manager no longer supports Windows Server 2012, Windows Server 2012 R2, or their Windows Storage Server editions as client operating systems.
Upgrade devices to a supported Windows Server version. For more information, see Supported OS versions for clients and devices.
Configuration Manager no longer supports SQL Server 2016
Starting with version 2609, Configuration Manager no longer supports SQL Server 2016 (Standard, Enterprise, and Express editions). SQL Server 2016 extended support ended in July 2026. Upgrade to a supported SQL Server version — at minimum, SQL Server 2017 (Cumulative Update 2 or later). If you don't upgrade, Configuration Manager upgrades are blocked and you see an error during the prerequisite check.
This minimum applies to site databases at central administration sites, primary sites, and secondary sites, including SQL Server Express at secondary sites. The prerequisite check blocks site installation or update when the SQL Server version is below this minimum.
For more information, see Supported SQL Server versions for Configuration Manager.
SQL Server drivers updated
Configuration Manager updates the SQL Server driver packages to the following versions:
- Microsoft ODBC Driver for SQL Server: 18.6.2.1
- Microsoft OLE DB Driver for SQL Server: 19.4.2.0
Important
Microsoft ODBC Driver for SQL Server version 18.7.1.1 has a known issue with Configuration Manager version 2603 and earlier that can block site configuration. If you're updating from one of these versions, don't install ODBC driver version 18.7.1.1 before the update. Complete the Configuration Manager update to version 2609 before you install this ODBC driver version.
Configuration Manager automatically installs Microsoft OLE DB Driver for SQL Server on site servers and on computers that host the SMS Provider or a management point. The SQL Server Native Client (sqlncli.msi) dependency is removed from all Configuration Manager components and site roles.
For ODBC installation requirements and version guidance, see ODBC driver for SQL Server. For automatic OLE DB driver installation on applicable roles, see Site and site system prerequisites.
.NET Framework applications upgraded to version 4.7.2
All Configuration Manager C# applications that previously targeted .NET Framework 4.6.2 now target .NET Framework 4.7.2.
Microsoft Visual C++ Redistributable updated
Configuration Manager updates Microsoft Visual C++ Redistributable to version 14.51.36247.
Cloud management gateway
Shared key access automatically disabled for CMG storage
Shared key access is automatically disabled for cloud management gateway (CMG) storage, even if you haven't previously selected the option to disable it in the console.
Important
Before updating a site that has a CMG, verify that the CMG server application's service principal has the required Azure role-assignment permissions at the CMG resource group, and that Microsoft.Maintenance is registered in the subscription. Existing CMGs that previously used shared-key access also need these prerequisites. Missing permissions or provider registration can cause the CMG deployment update to fail.
For the required permissions and verification steps, see Configure Azure RBAC permissions for the server app and Configure Azure resource providers.
CMG virtual machine scale set image uses Windows Server 2022
Cloud management gateway (CMG) virtual machine scale sets use a supported Windows Server 2022 image offer that doesn't include the deprecated .NET 6 packages. For more information, see KB 37942646.
CMG deployments use Azure Load Balancer inbound NAT rules version 2
When you update to version 2609, CMG deployments are automatically migrated from Azure Load Balancer inbound NAT rules version 1 to version 2. Azure Load Balancer inbound NAT rules version 1 retire on September 30, 2027. Install version 2609 before the retirement date to ensure that CMG deployments use the supported inbound NAT rule version.
For more information, see Migrate NAT pools to NAT rules.
New cloud management gateway virtual machine sizes
Cloud management gateway (CMG) virtual machine scale sets use new VM sizes. The previously used Av2-series and B-series (V1) VM sizes are scheduled to retire in November 2028 and already have limited capacity in some Azure regions.
When you update to version 2609, existing CMG deployments are automatically migrated to the corresponding new VM size. The new VM sizes provide higher performance and more memory at a price that's generally close to the previous sizes.
Important
Before updating to version 2609, check the vCPU quotas and availability of the new VM sizes in each Azure subscription and region where you deploy a CMG. The VM scale set migration uses a new VM family. Ensure that both the standard Dadv6 Family vCPUs quota and the Total Regional vCPUs quota have enough available quota for the new instances, with additional headroom for temporary instances during upgrade or maintenance. Quota is the number of vCPUs your subscription is allowed to use. Azure must also have enough resources available in the region to deploy the new VM instances.
Important
Upgrade the Configuration Manager console after updating to version 2609. The updated console is required to display the new CMG VM sizes correctly.
| CMG tier | Previous VM size | Previous vCPU | Previous memory | New VM size | New vCPU | New memory |
|---|---|---|---|---|---|---|
| Small | Standard_B2s | 2 | 4 GiB | Standard_D2ads_v6 | 2 | 8 GiB |
| Medium | Standard_A2_v2 | 2 | 4 GiB | Standard_D4ads_v6 | 4 | 16 GiB |
| Large | Standard_A4_v2 | 4 | 16 GiB | Standard_D8ads_v6 | 8 | 32 GiB |
Retirement dates are subject to change. For the current retirement date and other VM series retirement details, see Retired Azure VM size series. VM pricing varies by region. For current pricing, see Azure Virtual Machines pricing.
Check CMG capacity and vCPU quotas before upgrading
To identify the subscription, region, current VM size, and instance count for each CMG, run the following read-only SQL query against the site database at your top-level site:
SELECT Name, Region, SubscriptionId, VmSize, NumberOfInstances
FROM Azure_Service;
Use the VM size mapping in the preceding table to calculate the required vCPUs for each CMG: multiply the New vCPU value by NumberOfInstances. Add the requirements for all CMGs in the same subscription and region, account for other workloads that consume these quotas, and allow additional headroom for temporary instances during CMG upgrade or maintenance.
In the Azure portal, check the standard Dadv6 Family vCPUs and Total Regional vCPUs quotas for each subscription and region identified by the query. Request any necessary increases before upgrading. For instructions, see Increase regional vCPU quotas - Azure Quotas | Microsoft Learn.
You can also run the following Azure CLI commands from PowerShell to check quota usage and limits. Sign in to Azure CLI first, and replace the placeholders with your subscription ID and Azure region name:
$subscriptionId = '<subscription ID>'
$region = '<region name>'
$usage = az vm list-usage --location $region --query "[?name.value=='standardDadv6Family']" --output json --subscription $subscriptionId
$usage
az vm list-usage --location $region --query "[?name.value=='cores']" --output json --subscription $subscriptionId
If there isn't enough available quota, the CMG migration can fail with a QuotaExceeded error in CloudMgr.log. For example, the log might include the following details:
{
"details": [
{
"code": "QuotaExceeded",
"message": "Operation could not be completed as it results in exceeding approved Total Regional Cores quota. Additional details - Deployment Model: Resource Manager, Location: <Your location>, Current Limit: 10, Current Usage: 8, Additional Required: 8, (Minimum) New Limit Required: 16."
}
]
}
Asset Intelligence
Asset Intelligence reports removed
Asset Intelligence reports are removed from the Monitoring > Reporting > Reports node.
Asset Intelligence home page updated
The Catalog Synchronization and Inventoried Software Status sections are removed from the Asset Intelligence home page. The page now displays deprecation information and links to the product lifecycle dashboard and Asset Intelligence client WMI classes.