When setting up a Cloud Management Gateway (CMG) in Microsoft Configuration Manager, you may encounter an error while Configuration Manager attempts to grant the Contributor role to the Microsoft Entra application for the Azure resource group.
The Configuration Manager console may display an error similar to “Error occurred when granting Contributor permission to the Azure AD app for the resource group”. The SmsAdminUI.log file can provide additional details, including an InvalidAuthenticationTokenTenant error indicating that the authentication token was issued by a different Microsoft Entra tenant than the tenant associated with the Azure subscription.
This article explains the error, the relevant SmsAdminUI.log entries, and the troubleshooting steps that resolved the issue during CMG setup.
Error: Unable to Grant Contributor Permission
Error occurred when granting Contributor permission to the Azure AD app for the resource group <Resource Group >. For more information see SmsAdminUI.log
To investigate the error, review the SmsAdminUI.log file on the Configuration Manager console computer. By default, the log is located at:
[16, PID:3448][04/29/2021 15:54:18] :Hyak.Common.CloudException\r\nInvalidAuthenticationTokenTenant: The access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/'. It must match the tenant 'https://sts.windows.net/e6d66549-5275-4d02-89d4-c9f495bae48b/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/e6d66549-5275-4d02-89d4-c9f495bae48b' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.\r\n at Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
Understanding the Error
“The access token is from the wrong issuer”
The error indicates a tenant mismatch between the authentication token and the Azure subscription.
This is particularly important because Microsoft currently documents scenarios where the Microsoft Entra tenant and the Azure subscription hosting the CMG can be different. In those scenarios, Configuration Manager needs to onboard the appropriate tenant(s).
In this case, the initial CMG configuration involved selecting a resource group in a different Azure region from the selected CMG region. However, the log specifically reported an InvalidAuthenticationTokenTenant error. Therefore, the tenant mismatch should be investigated first rather than assuming that the resource-group region was the cause.
Resolution
In my case, the issue was resolved by closing and reopening the Configuration Manager console and starting the CMG setup again.
Before retrying the deployment, verify that the selected Azure subscription, Microsoft Entra tenant, and CMG resource group are correct. Also confirm that the Microsoft Entra server application has the required Contributor permission on the resource group.
If the error persists, review SmsAdminUI.log for InvalidAuthenticationTokenTenant or other authentication-related errors. These messages can indicate that Configuration Manager is requesting an access token from a different Microsoft Entra tenant than the tenant associated with the Azure subscription.
If the Azure subscription or tenant relationship was recently changed, allow time for the change to propagate before retrying the CMG deployment.
Troubleshooting Checklist
- Verify the Azure subscription
- Confirm that the subscription selected during CMG setup is the intended subscription.
- Verify the Microsoft Entra tenant
- Confirm that the tenant configured in Configuration Manager corresponds to the tenant associated with the Azure subscription, or that the required multi-tenant configuration is in place.
- Verify the CMG server/web app
- Confirm that the correct Microsoft Entra application is being used.
- Verify Contributor permissions
- Check the resource group’s Access control (IAM) settings.
- Confirm that the CMG web/server application has the required Contributor role.
Microsoft specifically documents that, for ARM-based CMG deployment, the web application gets Contributor permission at the resource-group level.
- Restart the Configuration Manager console
- Close the MECM/Configuration Manager console completely.
- Reopen it.
- Start the CMG configuration again.
- Allow Azure configuration changes to propagate
- If the subscription or tenant relationship was recently changed, wait and retry.
Related Posts:
- CMG Connection Point Status Disconnected | SCCM | ConfigMgr
- CMG Setup – Subscription ID drop-down not populating
- SCCM Cloud Management Gateway (CMG) Setup Guide
- Configure SCCM Software Update Point for SSL
Explore More SCCM Guides
Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting.
- Microsoft Intune Learning – Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more.
- SCCM (Configuration Manager) Guides – Explore more SCCM guides covering device management, application deployment, software updates, troubleshooting, and automation.
