Azure Update Manager / Azure Arc

Pablo Gil 20 Reputation points
2026-02-03T12:08:22.6633333+00:00

Hi,

I'm configuring Azure Update Manager (AUM) maintenance configurations for Azure Arc-enabled servers in my APAC production environment. I need clarification on patch classification behavior.

Current Setup:

  • Azure Arc machines (on-premises, not cloud VMs)

Maintenance configuration with InGuestPatchMode = "User"

Custom patch classifications: Critical, Security, UpdateRollup, Definition, Updates

Maintenance window: Monthly (3 months, first Saturday)

Questions:

With InGuestPatchMode = "User" and custom classifications: Will Definition updates (e.g., Windows Defender signature updates) be installed during the scheduled maintenance window?

With InGuestPatchMode = "Platform" (Azure-managed): The error message states "Patch configuration not supported for InGuestPatchMode = Platform." This suggests Platform mode doesn't support custom classifications. Does this mean only Critical and Security patches install with Platform mode, excluding Definition updates?

For Arc machines specifically: Are there any differences in patch orchestration behavior compared to cloud-based Azure VMs when using Update Manager?

Additional Context:

VMs will be configured with AutomaticByPlatform patch orchestration

Windows Auto-Updates will be disabled via GPO (AUOptions = 1)

Looking to ensure Definition updates are included in the patching schedule

Expected Behavior: Definition updates should install during the maintenance window configured in AUM.I'm configuring Azure Update Manager (AUM) maintenance configurations for Azure Arc-enabled servers in my APAC production environment. I need clarification on patch classification behavior.

Current Setup:

Azure Arc machines (on-premises, not cloud VMs)

Maintenance configuration with InGuestPatchMode = "User"

Custom patch classifications: Critical, Security, UpdateRollup, Definition, Updates

Maintenance window: Monthly (3 months, first Saturday)

Questions:

With InGuestPatchMode = "User" and custom classifications: Will Definition updates (e.g., Windows Defender signature updates) be installed during the scheduled maintenance window?

With InGuestPatchMode = "Platform" (Azure-managed): The error message states "Patch configuration not supported for InGuestPatchMode = Platform." This suggests Platform mode doesn't support custom classifications. Does this mean only Critical and Security patches install with Platform mode, excluding Definition updates?

For Arc machines specifically: Are there any differences in patch orchestration behavior compared to cloud-based Azure VMs when using Update Manager?

Additional Context:

VMs will be configured with AutomaticByPlatform patch orchestration

Windows Auto-Updates will be disabled via GPO (AUOptions = 1)

Looking to ensure Definition updates are included in the patching schedule

Expected Behavior:
Definition updates should install during the maintenance window configured in AUM.

Azure Update Manager
Azure Update Manager

An Azure service to centrally manages updates and compliance at scale.

0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-02-03T12:09:35.66+00:00

    With InGuestPatchMode = "User", Definition updates (such as Windows Defender signature updates) should be included in the scheduled maintenance window, as you have configured custom patch classifications that include Definition updates. Therefore, you can expect these updates to be installed during the maintenance window you have set up.

    In contrast, with InGuestPatchMode = "Platform", the error message indicates that custom classifications are not supported. This means that only Critical and Security patches will be installed in Platform mode, and Definition updates will be excluded.

    Regarding Azure Arc machines, the orchestration behavior for patching is similar to that of Azure VMs, but there are some limitations. Specifically, for Arc-enabled servers, certain features like Automatic VM Guest patching and Windows automatic updates are not supported. Therefore, you need to ensure that your maintenance configurations are set correctly to include the desired updates.

    In summary:

    • User Mode: Includes Definition updates during the maintenance window.
    • Platform Mode: Excludes Definition updates, only Critical and Security patches are installed.
    • Arc Machines: Similar orchestration behavior to Azure VMs, but with some limitations regarding supported features.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator
    2026-02-03T20:58:38.48+00:00

    Hello Pablo Gil, It looks like you're diving deep into configuring Azure Update Manager for your Azure Arc-enabled servers, and I understand you have some specific questions about patch classification behavior. Let’s break it down:

    1. With InGuestPatchMode = "User" and custom classifications: Definition updates, including Windows Defender signature updates, will not be packaged under the custom patch classifications you have listed. Typically, InGuestPatchMode = "User" allows for user-driven classifications. The expectation is that traditional updates (like OS critical patches) will be taken care of during the scheduled maintenance window, but not necessarily Defintion updates. To ensure they are applied, consider managing them separately or ensuring that your Windows Update settings on the server allow for these updates outside of the AUM schedule.
    2. With InGuestPatchMode = "Platform": You’re correct that this mode does not support custom classifications, which indicates that only the built-in classes, notably Critical and Security patches, would ordinarily be applied during scheduled maintenance. Definition updates will not be applied automatically in this mode since it essentially restricts you to the platform-managed patches.
    3. Differences in patch orchestration for Arc Machines vs. Azure VMs: Generally, Azure Arc-enabled servers have a similar orchestration behavior to Azure VMs with respect to Update Manager, as they both rely on the same update mechanisms via the Azure portal. However, operational differences may depend on how the connection is maintained (internet versus on-premises) and configuration specifics—like the patch settings you apply. The underlying infrastructure changes could impact availability and responsiveness, particularly if you’re managing local machines.

    References:

    I hope this provides clearer insights into your questions! If you have more details or need further assistance, feel free to ask.

    If the provided answer was helpful, please click Accept the Answer and upvote if the above was helpful.

    Thanks

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.