Does Configuration Manager need to be the primary SUP ?

Question

Does Configuration Manager need to be the primary SUP ?

Brian E. Collins 0

Have ConfigMgr server and 2 WSUS servers, we rebuilt the WSUS servers and have seen a few articles that stated that ConfigMgr should be the Primary SUP and the WSUS servers should point to ConfigMgr as Source, however in ConfigMgr in the Update Source and Proxy it lists http://WSUS...:8530 or 8531 as examples. Need to knwo which is correct.

Thank you

Rahul Jindal 11,641 Reputation points

2026-04-24T06:19:55.22+00:00

If you are using ConfigMgr as the policy provider for security updates, then you can either sync the meta data and content directly from internet on the SUP or use a separate WSUS instance as the upstream server.

1 answer

Your answer

Rahul Jindal 11,641 Reputation points

2026-04-24T06:19:55.22+00:00

If you are using ConfigMgr as the policy provider for security updates, then you can either sync the meta data and content directly from internet on the SUP or use a separate WSUS instance as the upstream server.

Answer 1

Configuration Manager does not use itself as the WSUS upstream source. The WSUS server that hosts the software update point (SUP) is the update source, and Configuration Manager configures that WSUS instance via the WSUS APIs.

Key points from the supported design:

The first (top-level) software update point at the CAS or primary site must be a WSUS server that is not configured as a replica. Configuration Manager connects to this WSUS server and configures it; it does not act as a WSUS upstream server itself.
- “When you add the software update point role on a primary site server, you can't use a WSUS server that's configured as a replica. When the WSUS server is configured as a replica, Configuration Manager fails to configure the WSUS server, and the WSUS synchronization fails. The first software update point that you install at a primary site is the default software update point. Additional software update points at the site are configured as replicas of the default software update point.”
The topmost WSUS/SUP in the hierarchy normally synchronizes directly from Microsoft Update (or from another upstream WSUS, if you have a multi-tier WSUS design). In the SUP properties in Configuration Manager, the Update Source is that WSUS server (for example, http://WSUSServer:8530 or https://WSUSServer:8531). This matches what is shown in the console examples.
If you have multiple SUPs at a primary site, they should share the same WSUS database and are configured as replicas of the default SUP, not as WSUS servers pointing to Configuration Manager as a source:
- “When you install more than one software update point at a primary site, use the same WSUS database for each software update point in the same Active Directory forest.”
- “Additional software update points at the site are configured as replicas of the default software update point.”
WSUS Configuration Manager (WCM) on the site server connects to the WSUS server (the SUP) using the configured port (commonly 8530/8531) and applies the SUP settings (products, classifications, etc.):
- “WSUS Configuration Manager uses the WSUS APIs to connect to the WSUS server… Attempting connection to WSUS server: CE1SITE.CONTOSO.COM, port: 8530, useSSL: False… Successfully connected to server… Subscribed Update Categories… Configuration successful.”

So the correct configuration is:

A WSUS server (or servers) hosting the SUP role.
The SUP’s Update Source in Configuration Manager pointing to that WSUS server URL (for example, http://WSUSServer:8530), not to the Configuration Manager server itself as an upstream WSUS.
Additional SUPs at the same primary site configured as replicas of the default SUP and, ideally, sharing the same WSUS database.

Configuration Manager is the management and configuration layer for WSUS/SUP, not the WSUS upstream source.

References: