KB40345593: Fix CMG bulk registration after the ConfigMgr 2603 rollup

What changed

Affected devices cannot obtain individual Configuration Manager client authentication tokens. CCM_STS.log can show an mpisapiclr assembly mismatch with HRESULT 0x80131040. Devices using Microsoft Entra authentication are not affected.

Technical details

• Restores bulk registration token verification on the management point after KB39169655.

Why it matters

A failed token exchange prevents affected clients from completing registration through the CMG and can affect other CMG communication for non-Entra-joined devices.

Known limitations

• Only ConfigMgr 2603 sites with KB39169655 installed require this hotfix. It appears in Updates and Servicing only after that rollup.
• No computer restart is required, but a site reset is required. Preexisting secondary sites require manual recovery after the primary-site update.
• The article date is November 3, 2026; Microsoft lists the initial release as November 2026 without a separate exact release day.

Now check

• Confirm version 2603 and installed rollup KB39169655; identify non-Entra-joined clients using CMG token authentication.
• Check CCM_STS.log for mpisapiclr manifest mismatch 0x80131040, install KB40345593 from Updates and Servicing and perform the required site reset.
• Recover preexisting secondary sites and verify dbo.fnGetSecondarySiteCMUpdateStatus returns 1; retest bulk registration and CMG client communication.