Azure Update Manager - patching 3rd party apps on servers

Question

Hi, today I started using Azure Update Manager for patching on-premises servers in DMZ forest (test environment) and so far, everything has been working as expected.

I guess answer to the following question is no (hopefully someone can prove me wrong) - can Azure Update Manager handle patching of 3rd party apps installed on servers without local WSUS instance? In production, we use Configuration Manager with 3rd party apps updates published to WSUS using Patch My PC Publishing Service.

Answer 1

Hi Bojan Zivkovic

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Azure Update Manager uses WSUS to manage updates for both first-party and third-party applications. For third-party apps, you need to publish the updates to WSUS, which will then allow Azure Update Manager to detect and install them.
https://learn.microsoft.com/en-us/azure/update-manager/guidance-migration-azure

If you use Patch My PC to send third-party updates to WSUS, Azure Update Manager can use it. But without WSUS, Azure Update Manager can't manage or update third-party apps.
https://azure.microsoft.com/en-us/products/azure-update-management-center/

Right now, Azure Update Manager can't handle third-party patching without WSUS. So, you need a WSUS instance for complete patch management, including third-party apps.

If you have any further queries, do let us know.

---

If the answer is helpful, please and "Upvote it".

Answer 2

Unfortunately you are right, Azure Update Manager can't handle 3rd Party Apps without WSUS.Other solutions would be to use Machine Configuration in Combination with xPSDesiredStateConfiguration - using the xMsiPackage: https://github.com/dsccommunity/xPSDesiredStateConfiguration/wiki/xMsiPackage

For Windows Server 2025 you could use as well winget.

Answer 3

I assume not: There are some limitations to enabling authentication. Any WSUS server you want to authenticate must be in an Active Directory environment. Also, if the WSUS servers are in different forests, there has to be trust between forests for this authentication method to succeed.

Source: https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127589#adding-authentication-between-chained-wsus-servers-in-an-active-directory-environment