This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 82%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello,
I am looking to accomplish pushout out Software Updates, Application Deployments, and Windows 10 Servicing to endpoints that rarely connect to our VPN.
My current environment is roughly 400 devices including servers that are on prem.
I have many end users who will never need to connect to the VPN to get company resources, so this makes utilizing SCCM very difficult to reach these devices.
I have a current project ongoing right now with a vendor and want to see if we are heading in the right direction or if we're not.
They are helping me configure Co-Management/Azure Hybrid Joined devices, and while I know Intune can handle this I don't feel we're ready to utilize Intune for this.
My goal is that I want devices to check into SCCM regardless if they are connected to the VPN or not. If they are in house I want them receiving the Updates/Applications from on prem, and if they are not connected to the VPN I want to be able to manage these devices. I want SCCM to do ALL the lifting here, so that devices follow my ADR's deployment windows and such.
Should I be looking to change the direction of my project to one of the following?
Co-management is an excellent choice but not for this issue as co-management is not* a solution for remote management. Remote management is addressed in ConfigMgr using a CMG (or IBCM).
Jason, so if I understand how it works correctly.
More or less, yes.
And, since you called out cost with IBCM, don't discount the cost of maintaining anything on-prem. You may not get a bill for it every month, but there are costs.
For some real-world costs of a CMG, see https://deploymentresearch.com/real-world-costs-for-using-a-cloud-management-gateway-cmg-with-configmgr/
CMG is the right option here. Doesn’t require any additional infra and at the same time you are taking a step towards extending your existing ConfigMgr infrastructure to use cloud services.