Azure Cloud App Discovery Endpoint Agent setup failed with error 0x80070643

EMS Landing page

Cloud App Discovery is really cool and I've done a couple of previous blogs describing the solution.

How to use Cloud App Discovery

Azure Cloud App Discovery now generally available 

However I had a problem this morning installing the Endpoint Agent at a customer site. The installation failed on all test computers with an error 0x80070643

The log file was of no use

The log contained just generic errors:

Could not create system restore point, error: 0x800704ec. Continuing…

Error 0x80070643: Failed to install MSI package.

Error 0x80070643: Failed to configure per-machine MSI package.

I found that this problem was caused by Websense Proxy. Those of you familiar with this product will know that it opens and analyses outbound http and https packets and may give the false impression that the packets were interfered with. Microsoft services will always reject such packets.

There is a good explanation of this behaviour on the Websense web site

The article describes the issue and lists the vendors affected - Microsoft, Citrix etc. The Microsoft Updates URLs, for example, are whitelisted by default to avoid the problem. However Azure services are NOT whitelisted by default.The Cloud App Discovery Endpoint Agent must be able to contact Azure during the installation.

Adding *.azure.com to the proxy whitelist solved the problem and the installations could continue.