Finally got it sorted after a lot of back and forth with support.
Issue:
Scanning, patching and deploying the agent across multiple domains and VMs not on a domain.
Fixed:
* Add VMs by IP
* VMs not on the same domain as the console need a entry in the consoles Host file, or a static entry in the consoles domains DNS record. Note: vms need different computer names (this could be a issue if one domain is dev, one is beta, etc).
* Need a credential per domain. For machines not on a domain (web facing VMs) they need a local login.
* Copy agent to VMs not on a domain, then do the registration from there. VMs on a domain it can be pushed from the console.
* There is two sets of credentials - one in the pop up machine group window (admin) and another when you view by machine view and right click a VM and select machine properties.
Hopes this helps other people.