Microsoft Configuration Manager

Checklist for 2609 - Configuration Manager | Microsoft Learn

6 November 2026Feature updateAction required+17 / −4 lines

In brief

The checklist now states that version 2609 automatically disables shared-key access for CMG storage and adds prerequisites for existing CMGs, including service-principal role-assignment permissions and Microsoft.Maintenance registration.

What Intune admins need to know

Before updating, verify permissions and provider registration, allow changes to propagate, and validate CMG deployment and client communication afterward. Missing prerequisites can cause the update to fail.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

layout: Conceptual title: Checklist for 2609 - Configuration Manager | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/checklist-for-installing-update-2609 author: ~~sccmavenger~~arob98 ms.author: ~~dannygu~~angrobe breadcrumb_path: /intune/breadcrumb/toc.json uhfHeaderId: MSDocsHeader-Intune feedback_system: Standard ms.service: configuration-manager ~~manager: laurawi~~ feedback_product_url: https://feedbackportal.microsoft.com/feedback/forum/4669adfc-ee1b-ec11-b6e7-0022481f8472 ms.reviewer:

umaikhan
hugowu
qiani description: Learn about actions to take before updating to Configuration Manager version 2609. ms.date: 2026-~~09-18T00:~~11-05T00:00:00.0000000Z ms.subservice: core-infra ms.topic: checklist ms.collection: tier3

For minimum required versions, validated versions, and versions with known blocking issues, see Prerequisite checks - ODBC driver for SQL Server.

Verify Azure prerequisites for existing CMGs

If your hierarchy uses a cloud management gateway (CMG), verify its Azure prerequisites before updating the site. Version 2609 automatically disables shared-key access for CMG storage, including deployments where you haven't previously selected that option.

Verify that the CMG server/web application's service principal has the required resource-management and storage role-assignment permissions at the CMG resource group. Contributor alone doesn't grant permission to create role assignments. Use appropriately constrained permissions as described in Configure Azure RBAC permissions for the server app.
Verify that Microsoft.Maintenance is registered in every subscription containing a CMG, along with the other required resource providers. Wait until registration is complete.
Allow time for permission changes to propagate, then verify the effective access for each CMG server application and resource group. Check production separately from staging: role assignments are scoped to Azure resources, and provider registration is subscription-scoped. Neither change is tenant-wide.

These prerequisites apply to existing deployments even if earlier CMG updates succeeded. Missing permissions or registration can cause the CMG deployment update to fail. For error details, review CloudMgr.log and the failed Azure deployment operations.

Review the site and hierarchy status for unresolved issues

A site update can fail because of existing operational problems. Before you update a site, resolve all operational issues for the following systems:

Consider restarting remote site systems that don't successfully update at first. Review your site infrastructure and make sure that applicable site servers and remote site system servers successfully restarted. Typically, site servers restart only when Configuration Manager installs .NET as a prerequisite for a site system role.

Verify CMG deployment and client communication

After updating a site that has a CMG, verify that the CMG deployment update completes successfully. Review CloudMgr.log and any failed Azure deployment operations. After the CMG is running, use the CMG connection analyzer to verify communication.

Review SQL Server client components

Starting in version 2609, Configuration Manager automatically installs Microsoft OLE DB Driver for SQL Server on site servers and on computers that host the SMS Provider or a management point. SQL Server Native Client is no longer required. For more information, see Site and site system prerequisites.

@@ -2,13 +2,12 @@ layout: Conceptual title: Checklist for 2609 - Configuration Manager | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/checklist-for-installing-update-2609-author: sccmavenger-ms.author: dannygu+author: arob98+ms.author: angrobe breadcrumb_path: /intune/breadcrumb/toc.json uhfHeaderId: MSDocsHeader-Intune feedback_system: Standard ms.service: configuration-manager-manager: laurawi feedback_product_url: https://feedbackportal.microsoft.com/feedback/forum/4669adfc-ee1b-ec11-b6e7-0022481f8472 ms.reviewer: - umaikhan@@ -17,7 +16,7 @@ ms.reviewer: - hugowu - qiani description: Learn about actions to take before updating to Configuration Manager version 2609.-ms.date: 2026-09-18T00:00:00.0000000Z+ms.date: 2026-11-05T00:00:00.0000000Z ms.subservice: core-infra ms.topic: checklist ms.collection: tier3@@ -137,6 +136,16 @@ Microsoft ODBC Driver for SQL Server version **18.7.1.1** has a known issue with 
 For minimum required versions, validated versions, and versions with known blocking issues, see [Prerequisite checks - ODBC driver for SQL Server](../deploy/install/list-of-prerequisite-checks#odbc-driver-for-sql-server).
 
+### Verify Azure prerequisites for existing CMGs
+
+If your hierarchy uses a cloud management gateway (CMG), verify its Azure prerequisites before updating the site. Version 2609 automatically disables shared-key access for CMG storage, including deployments where you haven't previously selected that option.
+
+- Verify that the CMG **server/web application's service principal** has the required resource-management and storage role-assignment permissions at the CMG resource group. Contributor alone doesn't grant permission to create role assignments. Use appropriately constrained permissions as described in [Configure Azure RBAC permissions for the server app](../../clients/manage/cmg/configure-azure-ad#configure-azure-rbac-permissions-for-the-server-app).
+- Verify that **Microsoft.Maintenance** is registered in every subscription containing a CMG, along with the other [required resource providers](../../clients/manage/cmg/configure-azure-ad#configure-azure-resource-providers). Wait until registration is complete.
+- Allow time for permission changes to propagate, then verify the effective access for each CMG server application and resource group. Check production separately from staging: role assignments are scoped to Azure resources, and provider registration is subscription-scoped. Neither change is tenant-wide.
+
+These prerequisites apply to existing deployments even if earlier CMG updates succeeded. Missing permissions or registration can cause the CMG deployment update to fail. For error details, review **CloudMgr.log** and the failed Azure deployment operations.
+
 ### Review the site and hierarchy status for unresolved issues
 
 A site update can fail because of existing operational problems. Before you update a site, resolve all operational issues for the following systems:
@@ -280,6 +289,10 @@ Make sure each site server and site system role is updated to version 2609. In t 
 Consider restarting remote site systems that don't successfully update at first. Review your site infrastructure and make sure that applicable site servers and remote site system servers successfully restarted. Typically, site servers restart only when Configuration Manager installs .NET as a prerequisite for a site system role.
 
+### Verify CMG deployment and client communication
+
+After updating a site that has a CMG, verify that the CMG deployment update completes successfully. Review **CloudMgr.log** and any failed Azure deployment operations. After the CMG is running, use the [CMG connection analyzer](../../clients/manage/cmg/monitor-clients-cloud-management-gateway#connection-analyzer) to verify communication.
+
 ### Review SQL Server client components
 
 Starting in version 2609, Configuration Manager automatically installs Microsoft OLE DB Driver for SQL Server on site servers and on computers that host the SMS Provider or a management point. SQL Server Native Client is no longer required. For more information, see [Site and site system prerequisites](../../plan-design/configs/site-and-site-system-prerequisites).