Use a cloud management gateway (CMG). The CMG provides a simple way to manage Configuration Manager clients on the internet. You deploy the service to an Azure subscription, and it connects to your on-premises infrastructure through the cloud management gateway connector point. Clients can then access on-premises site system roles whether they're connected to the internal network or on the internet.