Microsoft Configuration Manager
GeneralBulk registration token verification fails after installing Configuration Manager 2603 update rollup - Configuration Manager | Microsoft Learn
In brief
KB40345593 fixes bulk registration token verification failures for non-Microsoft Entra-joined devices connecting through a CMG after KB39169655 is installed.
What Intune admins need to know
For version 2603 sites with KB39169655, install KB40345593 from Updates and Servicing. A site reset is required, and existing secondary sites must be updated manually; no computer restart is required.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
new file mode 100644
layout: Conceptual title: Bulk registration token verification fails after installing Configuration Manager 2603 update rollup - Configuration Manager | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/40345593 author: iceorbital ms.author: acabello breadcrumb_path: /intune/breadcrumb/toc.json uhfHeaderId: MSDocsHeader-Intune feedback_system: Standard ms.service: configuration-manager feedback_product_url: https://feedbackportal.microsoft.com/feedback/forum/4669adfc-ee1b-ec11-b6e7-0022481f8472 ms.reviewer:
- umaikhan
- brianhun
- payur
- hugowu
- qiani description: Describes an update for token verification failures affecting devices that aren't Microsoft Entra joined and communicate through CMG after installing the Configuration Manager 2603 update rollup. ms.date: 2026-11-03T00:00:00.0000000Z ms.subservice: core-infra ms.topic: reference locale: en-us document_id: 83b2b4c5-e198-554c-df3f-ea70058b9388 document_version_independent_id: 83b2b4c5-e198-554c-df3f-ea70058b9388 original_content_git_url: https://github.com/MicrosoftDocs/memdocs-pr/blob/live/intune/configmgr/hotfix/2603/40345593.md site_name: Docs depot_name: MSDN.memdocs page_type: conceptual toc_rel: ../toc.json pdf_url_template: https://learn.microsoft.com/pdfstore/en-us/MSDN.memdocs/{branchName}{pdfName} feedback_help_link_type: '' feedback_help_link_url: '' asset_id: configmgr/hotfix/2603/40345593 moniker_range_name: monikers: [] item_type: Content source_path: intune/configmgr/hotfix/2603/40345593.md cmProducts:
- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/4c50f262-d533-4ba4-9d4a-08899ec3a3d1
- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/57eae307-c3a1-4cac-b645-1a899934bac8 spProducts:
- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/6a8c83be-f1de-4e90-bde0-bd097999a60c
- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/ee561821-1ac7-45a8-9409-6ba5eb7a5b97 platformId: ba776a3b-292a-0a00-e3a3-b22701a7fd07
Bulk registration token verification fails after installing Configuration Manager 2603 update rollup - Configuration Manager | Microsoft Learn
Applies to: Configuration Manager (current branch, version 2603 with update rollup KB39169655 installed)
Summary of KB40345593
This update resolves a token verification issue that occurs after you install the update rollup for Microsoft Configuration Manager version 2603 (KB39169655).
After you install the update rollup, bulk registration token verification fails on the management point for devices that aren't Microsoft Entra joined and connect through a cloud management gateway (CMG) to obtain a Configuration Manager-issued client authentication token.
This issue affects the bulk registration token scenario and may also affect other scenarios in which devices that aren't Microsoft Entra joined communicate through the CMG. It doesn't affect devices that use Microsoft Entra authentication.
On the management point, errors similar to the following are recorded in <MP_InstallDir>\Logs\CCM_STS.log:
ProcessRequest - Start
Incoming request URL: https://<management-point>/CCM_STS
Validated PreAuth SelfProve token. UniqueId: <client-id>. ClientKey: <public-key>
ProcessRequest - Exception: System.IO.FileLoadException:
Could not load file or assembly
'mpisapiclr, Version=5.0.9146.1045, Culture=neutral,
PublicKeyToken=31bf3856ad364e35' or one of its dependencies.
The located assembly's manifest definition does not match the assembly reference.
(Exception from HRESULT: 0x80131040)
As a result, affected devices can't complete bulk registration through the CMG to obtain their individual client authentication tokens.
Update information for Microsoft Configuration Manager current branch, version 2603
This update is available in the Updates and Servicing node of the Configuration Manager console for version 2603 sites that have KB39169655 installed.
Important
This issue only affects version 2603 sites that have the update rollup (KB39169655) installed. Version 2603 sites that haven't installed the update rollup aren't affected by this issue and don't require KB40345593. This update appears in Updates and Servicing only after you install KB39169655.
Install KB40345593 to resolve this token verification issue on the management point.
Restart information
This update doesn't require a computer restart, but does require a site reset after installation.
Additional installation information
After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.
Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:
select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')
If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.
If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the Recover Secondary Site option to update the secondary site.
File information
File information is available in the following downloadable text file:
Release history
- November 2026: Initial update release
References
@@ -0,0 +1,117 @@+---+layout: Conceptual+title: Bulk registration token verification fails after installing Configuration Manager 2603 update rollup - Configuration Manager | Microsoft Learn+canonicalUrl: https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/40345593+author: iceorbital+ms.author: acabello+breadcrumb_path: /intune/breadcrumb/toc.json+uhfHeaderId: MSDocsHeader-Intune+feedback_system: Standard+ms.service: configuration-manager+feedback_product_url: https://feedbackportal.microsoft.com/feedback/forum/4669adfc-ee1b-ec11-b6e7-0022481f8472+ms.reviewer:+- umaikhan+- brianhun+- payur+- hugowu+- qiani+description: Describes an update for token verification failures affecting devices that aren't Microsoft Entra joined and communicate through CMG after installing the Configuration Manager 2603 update rollup.+ms.date: 2026-11-03T00:00:00.0000000Z+ms.subservice: core-infra+ms.topic: reference+locale: en-us+document_id: 83b2b4c5-e198-554c-df3f-ea70058b9388+document_version_independent_id: 83b2b4c5-e198-554c-df3f-ea70058b9388+original_content_git_url: https://github.com/MicrosoftDocs/memdocs-pr/blob/live/intune/configmgr/hotfix/2603/40345593.md+site_name: Docs+depot_name: MSDN.memdocs+page_type: conceptual+toc_rel: ../toc.json+pdf_url_template: https://learn.microsoft.com/pdfstore/en-us/MSDN.memdocs/{branchName}{pdfName}+feedback_help_link_type: ''+feedback_help_link_url: ''+asset_id: configmgr/hotfix/2603/40345593+moniker_range_name: +monikers: []+item_type: Content+source_path: intune/configmgr/hotfix/2603/40345593.md+cmProducts:+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/4c50f262-d533-4ba4-9d4a-08899ec3a3d1+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/57eae307-c3a1-4cac-b645-1a899934bac8+spProducts:+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/6a8c83be-f1de-4e90-bde0-bd097999a60c+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/ee561821-1ac7-45a8-9409-6ba5eb7a5b97+platformId: ba776a3b-292a-0a00-e3a3-b22701a7fd07+---++# Bulk registration token verification fails after installing Configuration Manager 2603 update rollup - Configuration Manager | Microsoft Learn++*Applies to: Configuration Manager (current branch, version 2603 with update rollup KB39169655 installed)*
+
+## Summary of KB40345593
+
+This update resolves a token verification issue that occurs after you install the [update rollup for Microsoft Configuration Manager version 2603 (KB39169655)](39169655).
+
+After you install the update rollup, bulk registration token verification fails on the management point for devices that aren't Microsoft Entra joined and connect through a cloud management gateway (CMG) to obtain a Configuration Manager-issued client authentication token.
+
+This issue affects the [bulk registration token](../../core/clients/deploy/deploy-clients-cmg-token#bulk-registration-token) scenario and may also affect other scenarios in which devices that aren't Microsoft Entra joined communicate through the CMG. It doesn't affect devices that use Microsoft Entra authentication.
+
+On the management point, errors similar to the following are recorded in `<MP_InstallDir>\Logs\CCM_STS.log`:
+
+```text
+ProcessRequest - Start
+Incoming request URL: https://<management-point>/CCM_STS
+Validated PreAuth SelfProve token. UniqueId: <client-id>. ClientKey: <public-key>
+ProcessRequest - Exception: System.IO.FileLoadException:
+Could not load file or assembly
+'mpisapiclr, Version=5.0.9146.1045, Culture=neutral,
+PublicKeyToken=31bf3856ad364e35' or one of its dependencies.
+The located assembly's manifest definition does not match the assembly reference.
+(Exception from HRESULT: 0x80131040)
+```
+
+As a result, affected devices can't complete bulk registration through the CMG to obtain their individual client authentication tokens.
+
+### Update information for Microsoft Configuration Manager current branch, version 2603
+
+This update is available in the **Updates and Servicing** node of the Configuration Manager console for version 2603 sites that have [KB39169655](39169655) installed.
+
+Important
+
+This issue only affects version 2603 sites that have the update rollup (KB39169655) installed. Version 2603 sites that haven't installed the update rollup aren't affected by this issue and don't require KB40345593. This update appears in **Updates and Servicing** only after you install KB39169655.
+
+Install KB40345593 to resolve this token verification issue on the management point.
+
+### Restart information
+
+This update doesn't require a computer restart, but does require a [site reset](../../core/servers/manage/modify-your-infrastructure#bkmk_reset) after installation.
+
+### Additional installation information
+
+After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.
+
+Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:
+
+```sql
+select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')
+```
+
+If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.
+
+If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the **Recover Secondary Site** option to update the secondary site.
+
+## File information
+
+File information is available in the following downloadable text file:
+
+- [KB40345593_2603_FileList.txt](https://aka.ms/KB40345593_2603_FileList)
+
+## Release history
+
+- November 2026: Initial update release
+
+## References
+
+- [Token-based authentication for cloud management gateway](../../core/clients/deploy/deploy-clients-cmg-token)
+- [Update rollup for Microsoft Configuration Manager version 2603](39169655)
+- [Updates and servicing for Configuration Manager](../../core/servers/manage/updates)\ No newline at end of file