Microsoft Configuration Manager
GeneralEnable Tls 1 2 Server
In brief
The documentation now links to a built-in Azure Policy definition for configuring TLS 1.2 and updates wording, dates, links, and platform guidance. SQL Server, WSUS, and Windows Server support notes were also clarified.
What Intune admins need to know
Administrators configuring TLS 1.2 have a direct Azure portal policy reference and should review the updated prerequisites and support guidance.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- hugowu
- qiani
description: Information about how to enable Transport Layer Security (TLS) 1.2 for Configuration Manager site servers and remote site systems.
ms.date:
2024-06-20T00:2026-10-27T00:00:00.0000000Z ms.subservice: core-infra ms.topic: how-to ms.collection: tier3
Applies to: Configuration Manager (Current Branch)
When enabling TLS 1.2 for your Configuration Manager environment, start withby enabling TLS 1.2 for the clients first.. Then, enable TLS 1.2 on the site servers and remote site systems second.systems. Finally, test client to client-to-site system communications before potentially disabling the older protocols on the server side. The following tasks are needed for enablingto enable TLS 1.2 on the site servers and remote site systems:
- Ensure that TLS 1.2 is enabled as a protocol for SChannel at the operating system level
- Update and configure the .NET Framework to support TLS 1.2
Update SQL Server and client components
All SQL Server versions currently supported by Configuration Manager support TLS 1.1 and TLS 1.2. Dependent libraries might still require updates. For more information, see KB 3135244: TLS 1.2 support for Microsoft SQL Server.
Secondary site servers need to use at least SQL Server 2017 Express with Cumulative Update 2 (CU2) or later.
KB 3135244 also describes requirements for SQL Server client components.
Make sure to alsoEnsure you update the SQL Server Native Client to at least version SQL Server 2012 SP4 (11.*.7001.0). This requirement is a prerequisite check (warning).
Configuration Manager uses SQL Server Native Client on the following site system roles:
Enable TLS 1.2 at-scale using Automanage Machine Configuration and Azure Arc
Automatically configuresconfigure TLS 1.2 across both client and server for machines runningthat run in Azure, on-prem,premises, or multi-cloudmulticloud environments. To get started configuring TLS 1.2 across your machines, connect them to Azure by using Azure Arc-enabled servers, which comes with the Machine Configuration prerequisite by default. Once connected,
After you connect, configure TLS 1.2 can be configured with point-and-click simplicity by deploying the built-in policy definition in Azure Portal:portal: Configure secure communication protocols (TLS 1.1 or TLS 1.2) on Windows servers. TheAssign the policy scope can be assigned at the subscription, resource group, or management group level, as well asand exclude any resources from the policy definition.
After the configuration has been assigned, you can view the compliance status of your resources can be viewed in detail by navigating to the Guest Assignments page and scoping down to the impacted resources.
For a detailed, step-by-step tutorial, see Consistently upgrade your server TLS protocol using Azure Arc and Automanage Machine Configuration.
Update Windows Server Update Services (WSUS)
WSUS supports TLS 1.2 is supported by default for WSUS on all currently supported versions of Windows Server.
To support TLS 1.2 in earlier versions of WSUS, install the following update on the WSUS server:
- For WSUS
serverservers that's runningrun Windows Server 2012, install update 4022721 or a later rollup update. - For WSUS
serverservers that's runningrun Windows Server 2012 R2, install update 4022720 or a later rollup update.
Note
\ No newline at end of file
On October 10th,10, 2023, Windows Server 2012 and Windows Server 2012 R2 entered the Extended Support Updates phase. Microsoft will no longer provideprovides support for Configuration Manager site servers or roles installed to these Operating Systems.operating systems. For more information, see Extended Security Updates and Configuration Manager.
\ No newline at end of file
\ No newline at end of file
@@ -17,7 +17,7 @@ ms.reviewer: - hugowu - qiani description: Information about how to enable Transport Layer Security (TLS) 1.2 for Configuration Manager site servers and remote site systems.-ms.date: 2024-06-20T00:00:00.0000000Z+ms.date: 2026-10-27T00:00:00.0000000Z ms.subservice: core-infra ms.topic: how-to ms.collection: tier3@@ -50,7 +50,7 @@ platformId: cfa77c09-77e2-2c8e-cfd3-03a843bdb7b5 *Applies to: Configuration Manager (Current Branch)*
-When enabling TLS 1.2 for your Configuration Manager environment, start with [enabling TLS 1.2 for the clients](enable-tls-1-2-client) first. Then, enable TLS 1.2 on the site servers and remote site systems second. Finally, test client to site system communications before potentially disabling the older protocols on the server side. The following tasks are needed for enabling TLS 1.2 on the site servers and remote site systems:
+When enabling TLS 1.2 for your Configuration Manager environment, start by [enabling TLS 1.2 for the clients](enable-tls-1-2-client). Then, enable TLS 1.2 on the site servers and remote site systems. Finally, test client-to-site system communications before potentially disabling the older protocols on the server side. The following tasks are needed to enable TLS 1.2 on the site servers and remote site systems:
- Ensure that TLS 1.2 is enabled as a protocol for SChannel at the operating system level
- Update and configure the .NET Framework to support TLS 1.2
@@ -120,7 +120,7 @@ The `SchUseStrongCrypto` setting allows .NET to use TLS 1.1 and TLS 1.2. The `Sy
## Update SQL Server and client components
-All SQL Server versions currently supported by Configuration Manager support TLS 1.1 and TLS 1.2. Dependent libraries might still require updates. For more information, see [KB 3135244: TLS 1.2 support for Microsoft SQL Server](https://support.microsoft.com/topic/kb3135244-tls-1-2-support-for-microsoft-sql-server-e4472ef8-90a9-13c1-e4d8-44aad198cdbe).
+SQL Server versions currently supported by Configuration Manager support TLS 1.1 and TLS 1.2. Dependent libraries might still require updates. For more information, see [KB 3135244: TLS 1.2 support for Microsoft SQL Server](https://support.microsoft.com/topic/kb3135244-tls-1-2-support-for-microsoft-sql-server-e4472ef8-90a9-13c1-e4d8-44aad198cdbe).
Secondary site servers need to use at least SQL Server 2017 Express with Cumulative Update 2 (CU2) or later.
@@ -130,7 +130,7 @@ Note
[KB 3135244](https://support.microsoft.com/topic/kb3135244-tls-1-2-support-for-microsoft-sql-server-e4472ef8-90a9-13c1-e4d8-44aad198cdbe) also describes requirements for SQL Server client components.
-Make sure to also update the SQL Server Native Client to at least version SQL Server 2012 SP4 (11.\*.7001.0). This requirement is a [prerequisite check (warning)](../../servers/deploy/install/list-of-prerequisite-checks#sql-server-native-client).
+Ensure you update the SQL Server Native Client to at least SQL Server 2012 SP4 (11.\*.7001.0). This requirement is a [prerequisite check (warning)](../../servers/deploy/install/list-of-prerequisite-checks#sql-server-native-client).
Configuration Manager uses SQL Server Native Client on the following site system roles:
@@ -152,21 +152,23 @@ Configuration Manager uses SQL Server Native Client on the following site system
## Enable TLS 1.2 at-scale using Automanage Machine Configuration and Azure Arc
-Automatically configures TLS 1.2 across both client and server for machines running in Azure, on-prem, or multi-cloud environments. To get started configuring TLS 1.2 across your machines, [connect them to Azure using Azure Arc-enabled servers](/en-us/azure/azure-arc/servers/learn/quick-enable-hybrid-vm), which comes with the Machine Configuration prerequisite by default. Once connected, TLS 1.2 can be configured with point-and-click simplicity by deploying the built-in policy definition in Azure Portal: [Configure secure communication protocols (TLS 1.1 or TLS 1.2) on Windows servers](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F828ba269-bf7f-4082-83dd-633417bc391d). The policy scope can be assigned at the subscription, resource group, or management group level, as well as exclude any resources from the policy definition.
+Automatically configure TLS 1.2 across both client and server for machines that run in Azure, on-premises, or multicloud environments. To get started configuring TLS 1.2 across your machines, [connect them to Azure by using Azure Arc-enabled servers](/en-us/azure/azure-arc/servers/learn/quick-enable-hybrid-vm), which comes with the Machine Configuration prerequisite by default.
-After the configuration has been assigned, the compliance status of your resources can be viewed in detail by navigating to the Guest Assignments page and scoping down to the impacted resources.
+After you connect, configure TLS 1.2 with point-and-click simplicity by deploying the built-in policy definition in Azure portal: [Configure secure communication protocols (TLS 1.1 or TLS 1.2) on Windows servers](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F828ba269-bf7f-4082-83dd-633417bc391d). Assign the policy scope at the subscription, resource group, or management group level, and exclude any resources from the policy definition.
+
+After the configuration has been assigned, you can view the compliance status of your resources by navigating to the Guest Assignments page and scoping down to the impacted resources.
For a detailed, step-by-step tutorial, see [Consistently upgrade your server TLS protocol using Azure Arc and Automanage Machine Configuration](https://techcommunity.microsoft.com/t5/azure-arc-blog/consistently-upgrade-your-server-tls-protocol-using-azure-arc/ba-p/3664217).
## Update Windows Server Update Services (WSUS)
-TLS 1.2 is supported by default for WSUS on all [currently supported version](/en-us/windows-server/get-started/windows-server-release-info) of Windows Server.
+WSUS supports TLS 1.2 by default on all [currently supported versions](/en-us/windows-server/get-started/windows-server-release-info) of Windows Server.
To support TLS 1.2 in earlier versions of WSUS, install the following update on the WSUS server:
-- For WSUS server that's running Windows Server 2012, install [update 4022721](https://support.microsoft.com/topic/june-27-2017-kb4022721-preview-of-monthly-rollup-16a4b074-5202-c1c3-2c8a-34c1edd452f8) or a later rollup update.
-- For WSUS server that's running Windows Server 2012 R2, install [update 4022720](https://support.microsoft.com/topic/june-27-2017-kb4022720-preview-of-monthly-rollup-b98970bb-6f11-46c3-8681-a6b85d5d8eb4) or a later rollup update.
+- For WSUS servers that run Windows Server 2012, install [update 4022721](https://support.microsoft.com/topic/june-27-2017-kb4022721-preview-of-monthly-rollup-16a4b074-5202-c1c3-2c8a-34c1edd452f8) or a later rollup update.
+- For WSUS servers that run Windows Server 2012 R2, install [update 4022720](https://support.microsoft.com/topic/june-27-2017-kb4022720-preview-of-monthly-rollup-b98970bb-6f11-46c3-8681-a6b85d5d8eb4) or a later rollup update.
Note
-On October 10th, 2023, Windows Server 2012 and Windows Server 2012 R2 entered the Extended Support Updates phase. Microsoft will no longer provide support for Configuration Manager site servers or roles installed to these Operating Systems. For more information, see **[Extended Security Updates and Configuration Manager](/en-us/mem/configmgr/core/plan-design/configs/supported-operating-systems-for-clients-and-devices)**.\ No newline at end of file+On October 10, 2023, Windows Server 2012 and Windows Server 2012 R2 entered the Extended Support Updates phase. Microsoft no longer provides support for Configuration Manager site servers or roles installed to these operating systems. For more information, see **[Extended Security Updates and Configuration Manager](/en-us/mem/configmgr/core/plan-design/configs/supported-operating-systems-for-clients-and-devices)**.\ No newline at end of file