Skip to main content
The Microsoft Configuration Manager connector is available in every edition, and is currently in beta.
BOW reads Microsoft Configuration Manager (SCCM / MECM / ConfigMgr) through its AdminService REST API on the SMS Provider. IT and endpoint teams can ask questions like “which updates are missing on the most devices?”, “how many machines are still on Windows 10?” or “who is low on disk space?” — without SQL access to the site database. The connector is read-only. With per-user credentials, each person’s own Configuration Manager security scopes still apply: a helpdesk account limited to one office only sees that office’s devices.

​
What the catalog looks like

Configuration Manager catalogs classes, not tables. Each class is queried with OData ($filter, $select), not SQL. By default BOW indexes a curated set of 19 reporting classes: Device classes join on ResourceID / MachineID, and collection classes on CollectionID. To expose other classes — including custom hardware inventory classes — list them in Classes or turn on Discover all classes.

​
Before you start

The connect form shows these steps as a setup guide with copy buttons.
1

Give the account read access in Configuration Manager

In the console go to Administration → Security → Administrative Users, add the account (or its AD group) and assign the Read-only Analyst role. Its security scopes and collections decide what BOW can see.
2

Check the administration service answers

From a domain-joined machine, run this against your SMS Provider. It should list your site.
3

Export the SMS Provider certificate

The site binds a self-signed certificate by default. Run this on the SMS Provider and paste the output into SMS Provider certificate (PEM). Skip this if the certificate comes from a CA the BOW server already trusts.

​
Fields

​
Authentication

Windows credentials (NTLM) — ntlm (scopes: system and user) At user scope, each person signs in with their own Windows account, so their own security scopes filter what they see. Per-user credentials on a database-style connection require an Enterprise license. See Authentication and access. Kerberos service account — kerberos (system scope)

​
Troubleshooting

The SMS Provider uses its default self-signed certificate. Export it with the PowerShell in step 3 and paste it into SMS Provider certificate (PEM).
The account isn’t a Configuration Manager administrative user, or the password is wrong. Add it under Administrative Users with the Read-only Analyst role.
The account’s security scopes and collections limit what it can see. That’s expected with per-user credentials; for a shared connection, widen the service account’s scopes.
The BOW server can’t reach the SMS Provider on HTTPS (443). Check the host name and firewall. The test gives up after 30 seconds.