Skip to main content
Version: Next

Task 05: Configure Azure Update Manager

Runbook Azure

DOCUMENT CATEGORY: Runbook SCOPE: Patch management and update orchestration PURPOSE: Configure Azure Update Manager for Azure Local clusters and Arc-enabled servers MASTER REFERENCE: Microsoft Learn - Azure Update Manager

Status: Active

Azure Update Manager provides centralized patch management for Azure Local clusters, Arc-enabled servers, and Azure VMs. It enables update assessment, scheduling, and compliance reporting without requiring additional agents or Log Analytics workspace dependencies.

Overview​

Azure Update Manager is a native capability that works directly with:

  • Azure Local cluster nodes (Arc-enabled)
  • Arc-enabled Windows and Linux servers
  • Azure VMs
  • Arc-enabled VMware vSphere and SCVMM machines
No Additional Dependencies

Unlike legacy Azure Automation Update Management, Azure Update Manager does not require Log Analytics workspace or Automation account. All data is stored in Azure Resource Graph.

Prerequisites​

RequirementDescriptionValidation
Azure Arc connectivityCluster nodes and servers Arc-enabledArc agents reporting connected
VM agent (Azure VMs)Azure VM agent runningAgent status healthy
Outbound connectivityAccess to Windows Update or WSUSPort 443, 80 outbound
RBAC permissionsContributor or Update Manager roleOn resource scope
Maintenance windowsDefined change windowsDocumented in ITSM

Variables from variables.yml​

VariableConfig PathExample
AZURE_SUBSCRIPTION_IDazure.subscription.id00000000-0000-0000-0000-000000000000
AZURE_RESOURCE_GROUPazure.resource_group.namerg-azurelocal-prod-eus2
AZURE_REGIONazure.resource_group.locationeastus2
MACHINE_NAMEnodes[0].nameazl-dal-node-01
MAINTENANCE_CONFIG_NAMEpatching.maintenance_config_namemc-prod-saturday-patch
MAINTENANCE_START_TIMEpatching.start_time23:00
MAINTENANCE_DURATIONpatching.duration_hours3
TIME_ZONEpatching.time_zoneCentral Standard Time

Architecture​

Azure Update Manager uses extensions managed by the Azure VM agent or Arc agent:

PlatformExtensions Installed
Azure VMs (Windows)Microsoft.CPlat.Core.WindowsPatchExtension
Azure VMs (Linux)Microsoft.CPlat.Core.LinuxPatchExtension
Arc-enabled (Windows)WindowsPatchExtension (assessment) + WindowsOsUpdateExtension (patching)
Arc-enabled (Linux)LinuxPatchExtension (assessment) + LinuxOsUpdateExtension (patching)

Extensions are automatically installed when Update Manager operations are triggered.

Configuration Steps​

Step 5.1: Enable Periodic Assessment​

Enable automatic update assessment to continuously check for available updates:

For individual machines:

  1. Navigate to Azure Arc → Machines (or Virtual machines for Azure VMs)
  2. Select the machine
  3. Go to Updates → Settings
  4. Enable Periodic assessment: Set to On
  5. Click Save

For multiple machines at scale:

  1. Navigate to Azure Update Manager → Overview
  2. Click Settings → Update settings
  3. Select subscription and resource groups
  4. Filter to machines of interest
  5. Select machines and click Configure
  6. Set Periodic assessment to On
  7. Click Save
Azure Policy Recommendation

Use Azure Policy to enable periodic assessment at scale. Built-in policies:

  • Configure periodic checking for missing system updates on Azure Arc-enabled servers
  • Configure periodic checking for missing system updates on Azure virtual machines

Step 5.2: Check for Updates (On-Demand)​

Perform immediate update assessment:

  1. Navigate to Azure Update Manager → Overview
  2. Click Check for updates
  3. Select machines to assess
  4. Click Check for updates
  5. Monitor progress in History tab

Step 5.3: Create Maintenance Configuration​

Define scheduled maintenance windows for automated patching:

  1. Navigate to Azure Update Manager → Machines
  2. Click Scheduled updates → Create a maintenance configuration
  3. Configure basics:
  • Name: {{MAINTENANCE_CONFIG_NAME}}
  • Resource group: {{AZURE_RESOURCE_GROUP}}
  • Region: {{AZURE_REGION}}
  • Maintenance scope: Guest (Azure VM, Azure Arc-enabled VMs/servers)
  1. Configure schedule:
  • Start date and time: {{MAINTENANCE_START_TIME}}
  • Duration: {{MAINTENANCE_DURATION}} hours
  • Time zone: {{TIME_ZONE}}
  • Recurrence: Weekly/Monthly
  1. Configure updates:
  • Windows:
  • Classifications: Critical, Security, Update Rollup, Definition
  • KB numbers to include/exclude (optional)
  • Linux:
  • Classifications: Critical, Security
  • Packages to include/exclude (optional)
  1. Configure reboot option:
  • IfRequired: Reboot only if updates require it
  • AlwaysReboot: Always reboot after updates
  • NeverReboot: Never reboot (may leave updates pending)
  1. Click Review + create

Step 5.4: Assign Machines to Maintenance Configuration​

Associate machines with maintenance schedules:

  1. Navigate to maintenance configuration
  2. Go to Resources → Add
  3. Select machines to include
  4. Click Add

Or use Dynamic Scopes:

  1. Go to Dynamic scopes → Add a dynamic scope
  2. Configure filters:
  • Subscriptions
  • Resource groups
  • Resource types
  • Tags (e.g., Environment=Production)
  1. Click Save
Dynamic Scopes

Use dynamic scopes with tag-based filtering for automatic inclusion of new machines matching criteria.

Step 5.5: Install Updates (On-Demand)​

For immediate patching outside maintenance windows:

  1. Navigate to Azure Update Manager → Machines
  2. Select machines to update
  3. Click One-time update
  4. Configure:
  • Machines: Selected or add more
  • Updates: All or specific classifications/KBs
  • Reboot option: IfRequired, AlwaysReboot, or NeverReboot
  1. Click Install
  2. Monitor progress in History

Step 5.6: Configure Azure Local Cluster Updates​

For Azure Local clusters specifically:

Azure Local Lifecycle Manager

Azure Local 23H2 and later uses Lifecycle Manager (LCM) for cluster-aware updates. Azure Update Manager integrates with LCM for orchestrated updates.

  1. Navigate to Azure Local → Select cluster → Updates
  2. Review available updates (Platform, Solution Extension, OS)
  3. Click Check for updates to refresh
  4. Review update readiness checks
  5. Click Install to begin update orchestration

LCM handles:

  • Pre-update health checks
  • Cluster-aware rolling updates
  • Node drain and resume
  • Post-update validation

Step 5.7: Configure Alerts​

Set up alerts for update compliance:

  1. Navigate to Azure Update Manager → Settings → Alerts
  2. Click Create alert rule
  3. Configure conditions:
  • Update assessment: Machines with pending critical updates
  • Compliance: Machines not compliant with maintenance configuration
  1. Configure action group for notifications
  2. Click Create

Validation​

Check Update Compliance​

  1. Navigate to Azure Update Manager → Overview
  2. Review compliance dashboard:
  • Machines with pending updates
  • Critical/Security updates pending
  • Machines needing attention

Verify Extension Installation​

# On Arc-enabled server, check extensions
az connectedmachine machine-extension list \
 --resource-group "{{AZURE_RESOURCE_GROUP}}" \
 --machine-name "{{MACHINE_NAME}}" \
 --output table

Expected extensions:

  • WindowsPatchExtension or LinuxPatchExtension (assessment)
  • WindowsOsUpdateExtension or LinuxOsUpdateExtension (patching)

Validation Checklist​

ComponentVerificationExpected Result
Periodic assessmentMachine settingsEnabled
Extension installedExtension listProvisioning succeeded
Update visibilityUpdate Manager → MachineUpdates listed
Maintenance configConfiguration statusActive, machines assigned
Schedule executionHistory tabSuccessful runs

Monitoring​

Azure Workbooks​

Use built-in workbooks for update reporting:

  1. Navigate to Azure Update Manager → Workbooks
  2. Available workbooks:
  • Update compliance - Compliance across all machines
  • Update deployment status - Scheduled deployment results
  • Machine updates - Per-machine update history

Azure Resource Graph Queries​

// Machines with critical updates pending
patchassessmentresources
| where type == 'microsoft.hybridcompute/machines/patchassessmentresults'
| extend critical = toint(properties.availablePatchCountByClassification.critical)
| where critical > 0
| project 
 Machine = tostring(split(id, '/patchAssessmentResults')[0]),
 CriticalUpdates = critical,
 LastAssessment = todatetime(properties.lastModifiedDateTime)
| order by CriticalUpdates desc
// Update installation history
patchinstallationresources
| where type == 'microsoft.hybridcompute/machines/patchinstallationresults'
| extend status = tostring(properties.status)
| extend installedCount = toint(properties.installedPatchCount)
| summarize 
 TotalInstalled = sum(installedCount),
 SuccessCount = countif(status == 'Succeeded'),
 FailedCount = countif(status == 'Failed')
 by bin(todatetime(properties.lastModifiedDateTime), 1d)

Troubleshooting​

SymptomLikely CauseResolution
Updates not showingAssessment not runTrigger manual assessment
Extension not installingAgent connectivityCheck Arc agent status
Scheduled patch failsMaintenance window too shortIncrease duration
Reboot not occurringReboot setting misconfiguredVerify IfRequired/AlwaysReboot
WSUS updates not detectedWSUS connectivityVerify WSUS server reachable
Group Policy conflictGPO overriding settingsReview Windows Update GPOs

Extension Troubleshooting​

# Check extension logs (Windows)
Get-Content "C:\WindowsAzure\Logs\Plugins\Microsoft.CPlat.Core.WindowsPatchExtension\*\CommandExecution.log" -Tail 50

# Reinstall extension if needed
az connectedmachine machine-extension delete \
 --resource-group "{{AZURE_RESOURCE_GROUP}}" \
 --machine-name "{{MACHINE_NAME}}" \
 --name "WindowsPatchExtension"

# Extension will auto-reinstall on next operation

Best Practices​

PracticeRecommendation
Classification selectionAlways include Critical and Security
Maintenance durationMinimum 2 hours for thorough patching
Reboot handlingUse IfRequired for most scenarios
Pre/post scriptsUse for application-specific actions
Dynamic scopesTag-based for automatic inclusion
TestingPatch dev/test before production

Variables Reference​

VariableDescriptionExample
{{MAINTENANCE_CONFIG_NAME}}Maintenance configuration namemc-prod-saturday-patch
{{MAINTENANCE_START_TIME}}Scheduled start time23:00
{{MAINTENANCE_DURATION}}Duration in hours3
{{TIME_ZONE}}Time zone for scheduleCentral Standard Time

Next Steps​

After configuring Azure Update Manager:

  1. ➡️ Phase 21: Licensing and Telemetry — Configure Azure Benefits and Windows licensing
  2. Create update rings (dev → test → prod)
  3. Document exception procedures for emergency patches
  4. Configure compliance alerts and notifications
  5. Schedule monthly patch review meetings
PreviousUpNext
← Task 04: Security LoggingPhase 04: Security & GovernancePhase 05: Licensing & Telemetry →
VersionDateAuthorChanges
1.0.02026-03-24Azure Local Cloudnology TeamInitial release