Deploying SCCM agent through Autopilot

Question

I am trying to install the SCCM Agent through Autopilot and ultimately using ProvisionTS to run a task sequence. I can see the SCCM agent trying to install using the first suggested parameters for the CCMSetup. I quickly discovered those don't work because the agent doesn't have the certs to authenticate with the SCCM environment when on the Internet.

So I did some more digging and found that Azure AD can be used for that authentication, which makes a lot more sense. The article https://learn.microsoft.com/en-us/mem/configmgr/core/clients/deploy/deploy-clients-cmg-azure helped with some of it.

That led me to the following CCMSetup command. Edited for easy of reading.

The Tenant ID, ClientID and ResourceURI are all fields came from the SQL query select * from proxy_settings, that came from the article https://eskonr.com/2020/05/how-to-prepare-sccm-cmg-client-installation-switches-for-internet-based-client/

ccmsetup

CCMHOSTNAME=CMAZUREZZZCMG.SOUTHCENTRALUS.CLOUDAPP.AZURE.COM/CCM_Proxy_MutualAuth/72057594037927939

SMSSiteCode=ZZZ

SMSMP=https://cmserver.ad.ZZZ.com

AADTENANTID=Tenant ID

AADCLIENTAPPID=ClientID

AADRESOURCEURI=ResourceURI

Unfortunately, it doesn't work, and there isn't a real clear reason in the logs. But if I had to guess this is the one that is causing the problem.

[CCMHTTP] ERROR: URL=https://CMAZUREZZZCMG.SOUTHCENTRALUS.CLOUDAPP.AZURE.COM/CCM_PROXY_ServerAuth/ServiceMetadata, Port=443, Options=224, Code=12175, Text=ERROR_WINHTTP_SECURE_FAILURE

Answer 1

Hi,

Thank you for posting in Microsoft Q&A forum.

Please make sure that the devices trust the CMG server authentication certificate. For more details, please refer to:

Co-management settings: Windows Autopilot with co-management

Installing The Configuration Manager Client During Autopilot

Thanks for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.