Azure Update Management Center

Azure Update Management Center (UMC) is a Microsoft Azure service that provides a unified, cloud-based solution for managing operating system updates across your entire environment. It supersedes the older Azure Automation Update Management solution (which relied on Log Analytics and Azure Automation accounts) and is now the recommended method for update management. UMC supports:

UMC is built on top of Azure Resource Graph and Azure Policy, allowing you to assess compliance, deploy updates, and enforce update policies at scale.

Before UMC, update management in Azure was fragmented. You had the Azure Automation Update Management solution (which required a Log Analytics workspace, an Automation account, and the Microsoft Monitoring Agent), Windows Update Service, and third-party tools. UMC simplifies this by providing a single pane of glass that does not require a separate Automation account or Log Analytics workspace (though you can still integrate with them for advanced reporting). Key drivers:

UMC operates through a combination of agents, Azure Resource Manager (ARM) APIs, and background assessment jobs.

1. Agents involved:

2. Assessment process:

When you trigger an assessment (manually or via schedule), UMC sends a command to the VM agent (or Arc agent) to scan the machine for available updates. The agent uses the native update mechanism on the OS:

The results are sent back to Azure Resource Graph, where they are stored as resources of type Microsoft.ResourceGraph/queries and Microsoft.Compute/virtualMachines/assessments. The assessment data includes:

3. Deployment process:

When you deploy updates, UMC creates a deployment resource (Microsoft.Compute/updateDeployments) that specifies:

The deployment is executed as a series of ARM API calls to each machine. The agent on each machine receives the update instructions and installs the updates using native OS tools. Progress is reported back to the deployment resource, which you can monitor in the portal.

4. Scheduling:

You can schedule recurring deployments using Azure Scheduler (or via Azure Automation runbooks). UMC itself does not have a built-in scheduler; instead, you can create a schedule in the portal that triggers a deployment at a specified time. This schedule is backed by an Azure Automation job (if you link an Automation account) or a simpler ARM template deployment.

Via Azure CLI:

# Check update assessment for a VM
az vm assess-patches --resource-group myRG --name myVM

# Trigger update deployment
az vm update-patches --resource-group myRG --name myVM --install all --maximum-duration PT3H55M --reboot-setting IfRequired

Via Azure PowerShell:

# Check assessment
Invoke-AzVMPatchAssessment -ResourceGroupName myRG -VMName myVM

# Deploy updates
Invoke-AzVMInstallPatch -ResourceGroupName myRG -VMName myVM -Windows -RebootSetting IfRequired -MaximumDuration 3:55

Via REST API:

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}/assessPatches?api-version=2023-03-01

A large bank runs 2,000 Azure VMs and 500 on-premises servers (Windows and Linux). They need to ensure all servers are patched within 7 days of patch Tuesday. They use UMC with periodic assessment enabled on all machines via Azure Policy. They schedule a deployment every Saturday at 2 AM with a 4-hour maintenance window. They use dynamic queries to include all machines in production resource groups. They log deployment results to a Log Analytics workspace and create an alert if any machine fails to patch after two attempts. The challenge is that some legacy on-premises servers cannot run the Arc agent; those are managed separately via System Center. Misconfiguration: initially, they set the maintenance window to 1 hour, causing many deployments to timeout. After increasing to 4 hours, success rate improved to 99%.

A retail company runs 1,000 Ubuntu VMs on Azure. They use UMC to manage updates. They discovered that UMC does not classify Linux updates (no Critical/Security). To work around this, they created a custom script that runs before assessment to tag updates based on severity from Ubuntu's security mailing list. They also use Azure Policy to enforce that all VMs have periodic assessment enabled. They schedule weekly deployments with a 2-hour window. One issue: they initially selected 'Include third-party updates' but their custom repositories were not being scanned because they were not configured in the OS package manager sources. They resolved this by ensuring all custom repos are in /etc/apt/sources.list.

An MSP manages 500 customer subscriptions. They use UMC with Azure Lighthouse to manage updates across tenants. They create Azure Policy assignments at the management group level to enforce periodic assessment and require a minimum of 95% compliance. They use Azure Resource Graph cross-tenant queries to generate consolidated reports. They schedule deployments using Azure Automation runbooks that iterate over all subscriptions. The main challenge is that some customers have Azure VMs that are deallocated for cost savings; those VMs cannot be assessed or updated. They now have a process to start VMs before patch windows. Another issue: they initially tried to use the 'One-time update' feature for all customers, but it does not scale to thousands of VMs. They now use ARM templates and PowerShell scripts for bulk deployments.