Microsoft

System Center Configuration Manager Feedback

Suggestion box powered by UserVoice

How can we improve Configuration Manager?

Ability to provision gMSA as an Administrative User

As of CB 1702, we can provision AD Users or Groups as administrative users in SCCM. However, gMSAs (Group Managed Service Accounts) can't be directly provisioned - though you can work around that by creating an AD group with the gMSA as a member and provisioning that group in SCCM.

It'd be helpful if we could directly provision gMSAs in SCCM; I don't see any reason why this shouldn't be allowed.

Thanks

4 votes
Vote
Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
You have left! (?) (thinking…)
kedia990 shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

2 comments

Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
Submitting...
  • Mark Godfrey commented  ·   ·  Flag as inappropriate

    Can confirm. It works fine if I add it via PowerShell, but you cannot add gMSAs via the console GUI. My experience also shows that even adding it via it's group membership does not work. It would be nice if it could be added via the other methods as well.

  • kedia990 commented  ·   ·  Flag as inappropriate

    Correction - it turns out that you *can* provision a gMSA directly in SCCM - but only using PowerShell (New-CMAdministrativeUser -Name domain\gmsa$), not the UI. So this is just an inconsistency.

Feedback and Knowledge Base