Back to Blog
AzureAZ-104UpdatesAdminTutorial

Patch Management at Scale with Azure Update Manager

Complete AZ-104 tutorial on Azure Update Manager. Learn schedules, maintenance config, compliance.

Daniel Urbano
November 4, 2025
8 min read
Patch Management at Scale with Azure Update Manager

Patch Management at Scale with Azure Update Manager

Introduction

Azure Update Manager is a powerful tool designed for managing updates across your Azure and hybrid environments. With the increasing complexity of IT infrastructure, effective patch management is crucial for ensuring system security, compliance, and performance. Azure Update Manager allows administrators to monitor Windows and Linux update compliance across all machines, whether they are in Azure, on-premises, or connected through Azure Arc. This capability is essential for the AZ-104 exam, as it tests knowledge on Azure management and governance.

Key scenarios for using Azure Update Manager include scheduling updates during maintenance windows, applying patches in real-time, and managing compliance across multiple subscriptions. By leveraging Azure Update Manager, organizations can streamline their patch management processes, reduce downtime, and enhance security posture.

Prerequisites

  • Azure Subscription: Ensure you have an active Azure subscription with the necessary permissions.
  • User Roles: Role-Based Access Control (RBAC) permissions should include at least the Update Management Operator role.
  • Tools:
    • Azure Portal
    • Azure CLI
    • PowerShell
  • Services Enabled: Azure Update Manager must be enabled for all relevant virtual machines and Azure Arc-enabled servers.

Core Concepts

Definitions

  • Azure Update Manager: A service to manage and govern updates for Windows and Linux machines across Azure and hybrid environments.
  • Maintenance Configurations: Defined schedules for when updates should be applied.
  • Compliance: The state of machines in terms of whether they have the latest updates applied.

Architecture

Azure Update Manager integrates with Azure Resource Manager to manage updates. It operates by installing extensions on Azure VMs and Arc-enabled servers, allowing it to assess and apply updates automatically.

When to Use

Use Azure Update Manager when managing multiple machines, particularly in hybrid environments, to ensure consistent patching schedules, compliance tracking, and reduced manual intervention.

Limitations

  • Requires Azure Arc for non-Azure machines.
  • Patch management capabilities vary based on the operating system and machine configuration.

Pricing Notes

Azure Update Manager is billed based on the number of machines being managed. Costs may vary based on the type of updates and the scale of operations.

Syntax/Configuration

Azure CLI Commands

  1. Check for Updates:

    az update-manager machine show --name <machine-name> --resource-group <resource-group>

  2. Schedule Updates:

    az update-manager schedule create --frequency <frequency> --window <time-window> --resource-group <resource-group>

  3. Apply Updates Now:

    az update-manager updates apply --resource-group <resource-group> --machine-name <machine-name>

PowerShell Commands

  1. Get Update Compliance:

    Get-UpdateManagementUpdate -ResourceGroupName <resource-group> -MachineName <machine-name>

  2. Schedule Maintenance Window:

    New-AzureRmUpdateManagementMaintenanceWindow -ResourceGroupName <resource-group> -Frequency <frequency>

  3. Initiate One-time Update:

    Invoke-AzureRmUpdateManagementUpdate -ResourceGroupName <resource-group> -MachineName <machine-name>

Portal Steps

  1. Navigate to the Azure Portal.
  2. Search for Azure Update Manager.
  3. Select Machines to view and manage update compliance.
Parameter Description
<machine-name> Name of the target virtual machine
<resource-group> Azure resource group containing the VM
<frequency> Frequency of update checks (e.g., daily)
<time-window> Specific time for updates to occur

Practical Examples

Example 1: Check Update Compliance

To check the compliance status of a VM, use the following command:

az update-manager machine show --name myVM --resource-group myResourceGroup

This command retrieves the update compliance status for myVM.

Example 2: Schedule Updates Weekly

To create a weekly update schedule for a VM:

az update-manager schedule create --frequency Weekly --window "Sun 02:00" --resource-group myResourceGroup

This schedules updates to occur every Sunday at 2 AM.

Example 3: Apply Updates Immediately

To apply updates immediately:

az update-manager updates apply --resource-group myResourceGroup --machine-name myVM

This command triggers an immediate update for myVM.

Example 4: Configure Periodic Assessment

Enable periodic assessments to check for updates every 24 hours:

az policy assignment create --name "PeriodicAssessmentPolicy" --policy <policy-definition-id>

This sets up periodic checks for compliance.

Example 5: Use Hotpatching

To enable hotpatching for a VM:

az update-manager update-config set --hotpatch true --resource-group myResourceGroup --machine-name myVM

This command configures the VM to apply updates without requiring a reboot.

Example 6: Custom Reporting

Create a custom report for update compliance:

Get-UpdateManagementReport -ResourceGroupName myResourceGroup

This generates a report detailing the update status across machines.

Example 7: Dynamic Scoping

To create a dynamic scope for targeting specific machines:

az update-manager dynamic-scope create --resource-group myResourceGroup --scope-name myScope --criteria <criteria>

This command defines a new dynamic group based on specified criteria.

Example 8: Manage Multiple Subscriptions

To apply patches across multiple subscriptions:

az update-manager cross-subscription patch --subscription <subscription-id> --resource-group myResourceGroup

This applies updates to resources across specified subscriptions.

Real-World Scenarios

Scenario 1: Enterprise Patch Management

An organization with multiple Azure subscriptions can leverage Azure Update Manager to manage updates centrally. By defining maintenance windows and compliance policies, IT can ensure consistent security updates across all resources.

Scenario 2: Hybrid Environment Compliance

In a hybrid environment with both on-prem and Azure resources, Azure Update Manager enables administrators to view compliance from a single dashboard, allowing for efficient management of updates and reducing the risk of vulnerabilities.

Scenario 3: Critical System Updates

For critical systems requiring minimal downtime, enabling hotpatching allows for the application of security updates without rebooting. This is particularly beneficial for high-availability services where uptime is paramount.

Best Practices

  1. Automate Assessments: Enable periodic assessments to monitor compliance automatically.
  2. Define Maintenance Windows: Schedule updates during off-peak hours to minimize disruption.
  3. Use Dynamic Scoping: Group machines based on tags or resource groups for targeted updates.
  4. Monitor Compliance Regularly: Utilize custom dashboards to keep track of update statuses.
  5. Implement RBAC: Ensure proper access controls are in place for managing updates.

Common Errors

Error 1: Update Failed

Message: "Update failed on machine."
Cause: Insufficient permissions or conflicting updates.
Fix: Ensure the user has the correct RBAC roles and check for conflicting updates.

Error 2: No Updates Available

Message: "No updates available for the selected machine."
Cause: Machine already up-to-date or network issues.
Fix: Verify network connectivity and check the update configuration.

Error 3: Maintenance Window Overlap

Message: "Maintenance window overlaps with another schedule."
Cause: Conflicting schedules defined.
Fix: Adjust maintenance windows to avoid overlaps.

Error 4: Dynamic Scope Not Defined

Message: "No machines found in the dynamic scope."
Cause: Incorrect criteria specified.
Fix: Review and correct the criteria for dynamic grouping.

Related Services/Commands

Service/Command Description
Azure Automation Automates tasks across Azure resources
Azure Monitor Monitors performance and health
Azure Policy Enforces compliance across resources
WSUS Windows Server Update Services

Automation Script

Here is a PowerShell script to automate the scheduling of updates across multiple VMs:

# PowerShell script to schedule updates
$resourceGroupName = "myResourceGroup"
$vmList = @("VM1", "VM2", "VM3")

foreach ($vm in $vmList) {
    New-AzureRmUpdateManagementMaintenanceWindow -ResourceGroupName $resourceGroupName -MachineName $vm -Frequency "Weekly" -Time "Sun 02:00"
    Write-Output "Scheduled updates for $vm"
}

This script iterates through a list of VMs and schedules weekly updates.

Conclusion

Azure Update Manager is a vital service for managing updates and ensuring compliance across your Azure and hybrid environments. By leveraging its capabilities, administrators can streamline patch management, enhance security, and maintain system performance. To prepare for the AZ-104 exam, familiarize yourself with the commands, configurations, and best practices outlined in this tutorial.

For further learning, consider exploring the following resources:

References