Implementing Azure Update Manager

Below is a concise, step-by-step path to implement Azure Update Manager for Azure VMs, including third‑party updates.

1. Discover and view machines in Azure Update Manager
   1. Sign in to the Azure portal.
   2. Search for Azure Update Manager and open the service.
   3. Under Manage > Machines, select the subscription to list all machines.
   4. Use filters to verify that all required Azure VMs appear and to review their update status.
2. Decide and configure update sources
   1. For each Windows VM, decide whether it should use:
      • Windows Update / Microsoft Update, or
      • WSUS (required if using third‑party updates on Windows).
   2. Azure Update Manager always uses the repository the VM is already configured to use:
      • Windows: Windows Update, Microsoft Update, or WSUS.
      • Linux: apt / yum repositories configured on the VM.
   3. For third‑party updates on Windows:
      • Configure WSUS and publish third‑party updates to WSUS.
      • Ensure VMs are configured to scan against that WSUS server.
   4. For third‑party updates on Linux:
      • Add the third‑party repositories to the Linux package manager configuration on each VM.
3. Prepare WSUS for Azure Update Manager (if using WSUS and third‑party updates)
   1. If WSUS is already used with Microsoft Configuration Manager (MCM):
      • Ensure the WSUS instance used for Azure Update Manager is not managing software updates directly for clients if reconfigured.
      • Prefer a standalone WSUS server with its own SUSDB not associated to MCM.
   2. First‑party (Microsoft) updates:
      • Configure WSUS to approve required Windows and Microsoft updates, for example by using an auto‑approval rule.
   3. Third‑party updates:
      • Continue publishing third‑party updates from MCM into WSUS.
      • Once published to WSUS, Azure Update Manager can detect and install them on VMs that point to that WSUS.
4. Enable Azure Update Manager integration on individual VMs (SQL VM example) For SQL Server on Azure VMs (Windows):
   1. Open the SQL virtual machines resource in the Azure portal.
   2. Go to Updates under Settings.
   3. Disable Automated Patching (it is incompatible with Azure Update Manager).
   4. Select Try Azure Update Manager to switch to the new Updates experience.
   5. On the Updates page, go to Settings and select Enable Microsoft updates so the VM receives SQL and other Microsoft product updates. For Linux SQL VMs:
   6. Open the Linux VM resource.
   7. Go to Updates under Operations.
   8. Disable Automated Patching.
   9. Select Try Azure Update Manager to enable the new experience.
5. Configure assessment and patching policies
   1. In Azure Update Manager, after machines are visible:
      • Choose the appropriate assessment options to control how update compliance is evaluated.
      • Choose patching options (maintenance schedules) to define when updates are installed.
   2. For patch orchestration, decide between:
      • Azure Managed – Safe Deployment (Automatic VM guest patching):
        • Automatically applies Critical and Security updates.
        • Azure controls timing and orchestration, following availability‑first principles.
        • Enable by going to Update Settings and setting Patch Orchestration to Azure Managed-Safe Deployment.
      • Or custom maintenance configurations and schedules for more granular control.
6. Create and assign maintenance schedules
   1. In Azure Update Manager, create maintenance configurations that define:
      • Schedule (day, time, duration).
      • Scope (which VMs or resource groups).
      • Update classifications and behavior.
   2. Assign VMs to the appropriate maintenance configurations.
   3. For SQL VMs and other critical workloads, design schedules to avoid overlapping maintenance on dependent components (for example, Always On replicas).
7. Run assessments and patching
   1. From the VM’s Updates blade or from Azure Update Manager:
      • Trigger Check for updates (assessment) to refresh the list of available updates.
   2. Patch using one of the following:
      • On‑demand updates (one‑time/manual deployment) for ad‑hoc patching.
      • Scheduled updates (automatic) via maintenance schedules.
      • Programmatically via Azure Update Manager APIs.
   3. For third‑party updates:
      • Ensure they are present in WSUS (Windows) or in the Linux package repositories.
      • Azure Update Manager will then include them in assessment and installation.
8. Monitor and iterate
   1. Use Azure Update Manager’s machine views and filters to monitor compliance and patch status.
   2. For Automatic VM guest patching:
      • Rely on Azure’s availability‑first orchestration and health monitoring.
   3. Adjust schedules, classifications, and WSUS approvals as needed to refine the patching process.

Key limitations and considerations

• Orchestration groups with pre/post scripts from Configuration Manager are not available in Azure Update Manager.
• Automated Patching for SQL VMs must be disabled when using Azure Update Manager.
• Azure Update Manager can patch OS, SQL, and third‑party software only if the underlying repositories (Windows Update, Microsoft Update, WSUS, or Linux repos) contain those updates.

References:

• Guidance on migrating virtual machines from Microsoft Configuration Manager to Azure Update Manager
• Update options and orchestration in Azure Update Manager
• Supported update sources, types, Microsoft application updates and Third party updates
• Azure Update Manager for SQL Server on Azure VMs