Microsoft Intune connector certificate does not renew in Configuration Manager

Symptoms

After you update to Microsoft System Center Configuration Manager current branch, version 1806 or 1810, the Microsoft Intune connector certificate renewal process fails.

This problem affects customers who have a hybrid mobile device management environment through Microsoft Intune. The problem occurs when the Service Connection Point is installed on a computer that is running Windows Server 2012 or Windows Server 2012 R2.

Additionally, error messages that resemble the following are recorded in the the DMPUploader log:

The renewal process starts at the halfway point of the certificate lifespan. If the renewal fails after the certificate is expired, Configuration Manager cannot connect to Microsoft Intune.

The following log entry in DMPUploader.log indicates a successful renewal:

The following entry indicates a certificate that is already expired:

To prevent this problem, apply this update. Certificates that are already expired have to be renewed manually to reestablish the Microsoft Intune connection.

For an expired certificate, use either of the following options.

• Option 1
  Migrate from a hybrid environment to Intune Standalone. Note that policies have to be re-created within seven (7) days in Intune Standalone to prevent the loss of policies and settings. For more information, see Migrate hybrid MDM users and devices to Intune standalone.
• Option 2
  Contact Microsoft Customer Support Services for help to renew the certificate. For more information, see How to get support for Microsoft Intune.

Hotfix information for System Center Configuration Manager, version 1806 and 1810

This hotfix is available for installation in the Updates and Servicing node of the Configuration Manager console on version 1806 and 1810 sites that use a hybrid mobile device management environment through Microsoft Intune.

Note Customers on version 1810 will see a reference to hotfix 4487997. This is expected. All required information is contained in hotfix 4487960.

If the service connection point is in offline mode, you must reimport the update so that it's listed in the Configuration Manager console.

See "Install in-console updates for Configuration Manager" for detailed information.

Restart information

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any previously released hotfix.

File information

File attributes for System Center Configuration Manager current branch, version 1806

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform
Microsoft.configurationmanager.dmpconnector.connector.dll	5.0.8692.1511	130,456	29-Oct-2018	01:10	x86

File attributes for System Center Configuration Manager current branch, version 1810

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform
Microsoft.configurationmanager.dmpconnector.connector.dll	5.0.8740.1020	130,456	04-Jan-2019	01:25	x86

More information

As of August 14, 2018, hybrid mobile device management is a deprecated feature. On September 1, 2019, any remaining hybrid MDM devices will no longer receive policy, applications, or security updates. For more information, see this Intune Support Team Blog article.

References

Install in-console updates for Configuration Manager

How does the service connection point authenticate with the Microsoft Intune service?

Learn about the terminology Microsoft uses to describe software updates.