MECM Tenant attach - 401 errors

Question

MECM Tenant attach - 401 errors

Conor Treslove-Hayes 1

Hi,

I have recently added Tenant attach to my SCCM server.
One PC has successfully added into Intune, but all remote options are disabled saying "Device is blocked or unapproved in MECM".
On checking both CMGatewayNotificationWorker and CMGatewaySyncUploadWorker logs, I get a 401 error:

<![LOG[Worker CMGatewaySyncUploadWorker failure]LOG]!><time="16:06:46.8307671" date="3-22-2021" component="SMS_SERVICE_CONNECTOR_CMGatewaySyncUploadWorker" context="" type="3" thread="153" file="">

<![LOG[Exception details:]LOG]!><time="16:06:46.8307671" date="3-22-2021" component="SMS_SERVICE_CONNECTOR_CMGatewaySyncUploadWorker" context="" type="3" thread="153" file="">
<![LOG[[Critical][CMGatewaySyncUploadWorker][0][System.Net.WebException][0x80131509]
The remote server returned an error: (401) Unauthorized. at Microsoft.ConfigurationManager.ServiceConnector.ExtensionMethods.<GetResponseAsync>d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ConfigurationManager.ServiceConnector.ExtensionMethods.<GetResponseAsync>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ConfigurationManager.ServiceConnector.ExtensionMethods.<GetResponseAsync>d__10.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.ConfigurationManager.ServiceConnector.DeltaUploadWorkerBase1.<ProcessRequestQueueAsync>d__31.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.ConfigurationManager.ServiceConnector.DeltaUploadWorkerBase1.<ProcessRequestQueueAsync>d__31.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ConfigurationManager.ServiceConnector.DeltaUploadWorkerBase`1.<DoWorkAsync>d__23.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ConfigurationManager.ServiceConnector.AadServiceConnectorWorker.<DoWorkAsync>d__16.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ConfigurationManager.ServiceConnector.ServiceConnectorWorkerBase.<ExecuteAsync>d__75.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

This has been setup for around 5 hours, with the error persisting through out.
I have checked the pre-requisites and these are met (that I believe).

Any other things to have a look at? Some Policies are not syncing in Intune, so this may be linked.

Any help is appreciated

Thanks

Conor

2 answers

Your answer

Answer 1

Crystal-MSFT 53,971 Microsoft External Staff

@Conor Treslove-Hayes , For our issue, we suggest all the prerequisites in the following link are met:
https://learn.microsoft.com/en-us/mem/configmgr/tenant-attach/device-sync-actions#prerequisites

However, if the issue still persists, please try the suggestions under "Fix ConfigMgr Tenant Attach Error 401 403" in the following link to see if it can help.
https://www.anoopcnair.com/fix-configmgr-tenant-attach-error-401-403-missing-config-sccm/
Note: Non-Microsoft link, just for the reference.

Hope it can help.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Conor Treslove-Hayes 1 Reputation point

2021-03-23T08:02:28.947+00:00

This did not work unfortunately. Am seeing the same error.
I have full control in SCCM and am a Global admin in O365/ Azure. Does the SCCM service account need global admin permissions?
The Endpoint internet checker passes successfully.
EDIT: I have checked the MCEM (under connectors & tokens) from Endpoint.microsoft and our one does not show here.
Conor Treslove-Hayes 1 Reputation point

2021-03-23T20:10:48.213+00:00

Does the SCCM facing the internet need a public trusted SSL cert? Also, how would I find if I need to use the remote provider pre-req? I am still facing this and clueless as to why I am.
Crystal-MSFT 53,971 Reputation points Microsoft External Staff

2021-03-24T05:39:00.223+00:00

@Conor Treslove-Hayes , For your question, I would like to say that the SCCM service account didn' need global admin permission. I have tried to configure the Tenant attach in my environment and find there's also no information under "Connectors and tokens | Microsoft Endpoint Configuration Manager (Preview)
". But the devices are synced into Intune and the Devices actions are there.

Could you check if we have configured the Azure Services as below: did it sync successfully?

For the SCCM facing Internet, could you confirm if we mean CMG?
Conor Treslove-Hayes 1 Reputation point

2021-03-24T07:53:05.867+00:00

Thank you for your reply. Those 2 options are disabled, while hovering I receive the message "Device is blocked or unapproved in Microsoft Endpoint configuration manager".
Only 1 device shows, that is in the auto-pilot group.
I can confirm the bottom group is setup successfully and has synced (Called AAD User, not your name). While finding my account, I get both the directory user and tenant id.

We appear to have an ADFS target setup for sccm.domain that takes us to an IIS site. We do not have CMG Setup.
Conor Treslove-Hayes 1 Reputation point

2021-03-24T13:29:35.757+00:00

I can see the Azure AD app is successfully logging in via the Service principal sign-ins. However, I do see the following error:
"Microsoft.Online.DirectoryServices.UniqueKeyPropertyException" under the activity type of "Add app role assignment to service principal" for Microsoft Graph
Crystal-MSFT 53,971 Reputation points Microsoft External Staff

2021-03-25T05:48:15.953+00:00

@Conor Treslove-Hayes ,, Thanks for the reply. From your description, I know our environment is more complex than what I test. For the error we get, based on my research, I didn't any related cases for the reference. For our issue, I think more logs analysis from different teams is needed. As Q&A limitation, we are not the best channel to handle such issue. To troubleshoot issue in a more efficient way, we suggest to open case to work on this issue. Here is a link list the steps about opening case:
https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding.

Answer 2

Danny Guillory 1 Microsoft Employee

Did you ever get this working?

Share via

MECM Tenant attach - 401 errors

2 answers

Your answer