AZ-802 Study Guide: Azure Update Manager Fleet Patching (Part 6)

📖 AZ-802 Study Series: This is Part 6 of my hands-on lab series leading up to the Microsoft AZ-802 exam. To see the preceding steps, check out Part 5: Onboarding Servers to Azure Arc, Part 4: Bridging On-Prem AD with Entra ID, Part 3: Automating Replica Domain Controller Promotion, Part 2: Automating Windows Server Lab Setup, and Part 1: Building a Multi-DC Active Directory Forest, or check out The Ultimate Guide to Windows Server Hybrid Administrator Associate (AZ-802) Study Guide for the complete roadmap.

For SREs and sysadmins, patch management across hybrid environments is a constant operational challenge. In modern hybrid server management (and on the Microsoft AZ-802 exam), standard WSUS is increasingly replaced by cloud-native solutions like Azure Update Manager — a single service that assesses and installs updates for Windows and Linux across Azure, on-premises, and other clouds from one dashboard.

In Part 5 we laid the foundation by onboarding our servers to Azure Arc. Because those machines now carry an Azure resource ID, Update Manager can query their update state and orchestrate patch windows natively — no per-server WSUS, no Log Analytics workspace, and no Automation account required. This guide builds directly on that foundation.

[!NOTE]
Prerequisite: Your servers must already be Azure Arc-enabled (or Azure VMs). If you have not onboarded them yet, complete Part 5: Onboarding Servers to Azure Arc first — Update Manager has nothing to manage until the machines exist in Azure.

🎓 Exam Alignment (Hybrid Update Management):
Managing updates with Azure Update Manager is an explicit bullet under the "Manage Windows Server instances and workloads by using Azure services in a hybrid environment" objective of the AZ-802: Administering Windows Server Hybrid Infrastructure exam, and it connects to Troubleshoot Windows Update in the monitoring domain. You must understand:

• Assessment: Enabling periodic assessment so machines regularly report missing updates and compliance state.
• Patch orchestration modes: The difference between Customer Managed Schedules, Automatic by OS, and Image Default / Manual, and which one scheduled patching requires.
• Maintenance configurations: Designing schedules, selecting update classifications, controlling reboots, and including/excluding specific KBs or Linux packages.
• On-demand patching & compliance: Installing one-time updates and reviewing fleet compliance reports.
• OS integration: Managing Windows Update client settings and Group Policy so local orchestration does not conflict with Update Manager.

Architecture: Patching on Top of Azure Arc

Update Manager reads and acts on the Arc resource — the same Microsoft.HybridCompute/machines object created in Part 5. There is no additional agent to install for patching; it rides on the Connected Machine Agent:

graph TD
    subgraph Local Homelab
        WinVM["REPRO-DC01 (Windows Server)"] -->|Connected Machine Agent| ArcControl["Azure Arc Control Plane"]
        LinVM["repro-linux01 (Ubuntu)"] -->|Connected Machine Agent| ArcControl
    end
    subgraph Azure Cloud
        ArcControl --> AzureUpdateManager["Azure Update Manager"]
        AzureUpdateManager --> Schedule["Maintenance Configuration (Schedule)"]
    end

Step 1: Enabling Periodic Assessment

Before you can schedule patching, Update Manager needs to know what is missing. Periodic assessment makes each machine scan for available updates roughly every 24 hours and report compliance, rather than only checking on demand.

1. In the Azure Portal, search for Azure Update Manager and open Machines.
2. Select your Arc-enabled servers, choose Update settings → Periodic assessment, and set it to Enable.
3. To enforce this across the whole fleet automatically, assign the built-in Azure Policy "Configure periodic checking for missing system updates on Azure Arc-enabled servers" to the resource group holding your machines — new servers then inherit assessment as soon as they are onboarded.

Step 2: Choosing a Patch Orchestration Mode

This is a favourite exam distinction. Each machine has a patch orchestration setting that decides who installs updates:

• Customer Managed Schedules (AutomaticByPlatform): Update Manager installs updates according to a maintenance configuration you define. This mode is required for scheduled patching — a schedule will not apply to a machine unless its orchestration is set this way.
• Automatic by OS: The operating system's own automatic updates apply patches (Windows Update installs at its default time). Update Manager schedules are ignored.
• Image Default / Manual: No automatic installation. Updates only happen when you trigger a one-time install (Step 4).

Set orchestration to Customer Managed Schedules on the machines you intend to schedule:

1. In Azure Update Manager → Machines, select the servers.
2. Choose Update settings → Patch orchestration and set it to Customer Managed Schedules.

Step 3: Building the Maintenance Configuration (Schedule)

Maintenance Configurations group servers and bind them to an installation window:

1. Navigate to Azure Update Manager → Schedules → Create maintenance configuration (or Maintenance Configurations under Azure Maintenance).
2. Define the schedule:
   • Maintenance Scope: Select Guest (Azure VM, Arc-enabled VMs/Servers).
   • Schedule: Set the recurrence and window (e.g. every Sunday 03:00, 3-hour duration). A window of at least 1 hour 30 minutes is recommended so reboots complete.
   • Reboot setting: Choose Reboot if required, Never reboot, or Always reboot to match your change policy.
3. On the Updates tab, filter what gets installed:
   • Classifications: e.g. Critical and Security updates for Windows; for Linux, classifications such as Security and Other.
   • Include/Exclude: Pin or block specific KB IDs (Windows) or package names (Linux) — invaluable for holding back a known-bad update.
4. On the Machines tab, add your Arc servers directly, or use dynamic scoping to attach every machine matching a resource group / tag (e.g. Environment=Lab) so the fleet self-populates.
5. Create. Machines in scope with Customer Managed Schedules orchestration will now patch inside the window.

Step 4: One-Time Updates and Compliance

Between scheduled runs you can patch immediately — useful for a zero-day fix:

1. In Azure Update Manager → Machines, select the target servers.
2. Choose One-time update → Install now.
3. Pick classifications or specific updates, set the reboot behaviour, and deploy.

After any run, the History and Machines views show per-machine results — installed, pending, and failed updates — giving you the compliance evidence auditors (and exam questions) expect.

Key Gotcha: Local Update Settings Overrides

[!WARNING]
Azure Update Manager will fail to install updates if your local Windows Update configuration or Group Policy Objects (GPO) are configured to block updates entirely or require manual admin approval.

To avoid scheduling failures, ensure the local Windows Update registry settings (or AD GPOs) allow the OS to delegate execution to the orchestrator:

• Configure the GPO Configure Automatic Updates to 5 - Allow local admin to choose setting, or leave it Not Configured.
• Avoid a GPO that sets a competing automatic install time — that is effectively Automatic by OS behaviour and will fight the schedule.
• This allows the Azure Update Manager orchestrator to trigger installations on-demand during the maintenance window.

Key Takeaways

1. Patching rides on Arc: No separate patch agent and no Log Analytics or Automation account — Update Manager works natively against the Arc resource you created in Part 5.
2. Orchestration mode is the gatekeeper: Scheduled patching only fires when a machine's patch orchestration is set to Customer Managed Schedules (AutomaticByPlatform). This is the single most common reason a schedule "does nothing."
3. Design schedules like change windows: Combine classifications, KB/package include-exclude lists, reboot policy, and dynamic tag-based scoping to build maintenance windows that scale to a whole mixed Windows/Linux fleet from one dashboard.

Don't forget to explore the rest of our website as we build out more content. Stay tuned for more tutorials, tips, and tricks to help you make tech work for you.

If you want to stay up-to-date with regular updates, make sure to subscribe to our free mailing list.