I've been testing AUM recently and trying to understand the docs around this. The 'Update options and orchestration in Azure Update Manager' doc ( here ) states: "For Azure Arc-enabled servers, the updates and maintenance options such as automatic VM guest patching in Azure, Windows automatic updates, and hot patching aren't supported." The actual AUM UI for assigning Patch Orchestration has the following note: "Patch orchestration is not applicable to Arc-enabled servers." So ... what exactly ... are my patch scheduling options for Arc-Enabled servers that are not Azure VMs? Now, I wouldn't expect things like VM Guest patching to work but if the built in Windows Automatic Updates is not supported AND creating an AUM schedule (patch orchestration) is not supported ... then what the heck IS supported in these scenarios? Nothing?

Hi, Guest Patching via Azure Update Manager is supported for Arc servers . What is not supported is all other options. What that means? It means you cannot configure any of the other options via the Arc server Azure resource. You are still able to use those options within the VM where applicable. For example, you can login to the Arc server and configure Windows Update settings on Windows Server but you are not able to configure that via the settings on the Arc server resources. Note that Azure VMs have two guest patching options: one is that is controlled by Azure and it is done automatically without you having to configure maintenance windows and the other is by using Azure Update Manager and configuring maintenance windows. Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

Scheduling Options for on-prem Arc-Enabled Servers

Accepted answer

Stanislav Zhelyazkov 24,766 Reputation points MVP

2024-10-14T05:49:15.17+00:00

Hi,

Guest Patching via Azure Update Manager is supported for Arc servers. What is not supported is all other options. What that means? It means you cannot configure any of the other options via the Arc server Azure resource. You are still able to use those options within the VM where applicable. For example, you can login to the Arc server and configure Windows Update settings on Windows Server but you are not able to configure that via the settings on the Arc server resources. Note that Azure VMs have two guest patching options: one is that is controlled by Azure and it is done automatically without you having to configure maintenance windows and the other is by using Azure Update Manager and configuring maintenance windows.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Bryan Dam 30 Reputation points

2024-10-14T13:40:33.5333333+00:00

Ok, just to make this clear then, for on-prem servers (Guest Patching) Azure (Arc) Update Management doesn't actively control or schedule the patches? It is up to the admin to schedule those ... somehow ... using GPO or some other method?

Bryan Dam 30 Reputation points

2024-10-14T19:22:23.3066667+00:00

I think what's throwing me off is the wording being used in the docs and UI.

I was able to (from the AUM portal) click "Schedule Updates" which then created a Maintenance Configuration. There I could pick my on-prem (Guest) server, create a schedule, specify the size of the maintenance window, select what updates to apply, and create any pre/post events.

However, within the AUM portal again I can go to Settings > Update Settings where it has a note saying "Note: Patch orchestration is not applicable to Arc-enabled servers.". Further, for my on-prem server I can't select anything under Patch Orchestration.

So it's just not clear to me how all of these things work together. Should I expect the Maintenance Configuration I applied to my on-prem Guest to install patches at the time I scheduled there?

Stanislav Zhelyazkov 24,766 Reputation points MVP

2024-10-15T06:08:00.8333333+00:00

Hi,

Guest patching for Arc servers is done via Azure Update Manager. Azure Update Management is no longer supported and it is deprecated. You control the installation of updates by assigning maintenance windows (maintenance configurations). Maintenance configurations are Azure resource.

As mentioned before the only option for installing patches for Arc servers via Azure is by using Azure Update Manager and by assigning maintenance configurations. Unlike Azure VMs, Arc servers only have this option. Azure VMs has different options thus for them you can configure the patching method. As Arc servers have only that option from Azure there is nothing to configure. You can only enable/disable Periodic assessment on Arc servers. If the server will be patched by Azure Update Manager depends if it has maintenance window assigned. Period assessment assess every 24 hours for the available patches that can be installed on the server. If the Arc Server is online during the time of the maintenance window to start the updates specified in the maintenance window configuration will be installed. Note that the server OS must be supported by Azure Update Manager.

Bryan Dam 30 Reputation points

2024-10-15T17:19:32.2533333+00:00

Ok, so if I got this right then, Maintenance Configurations are how AUM provides a custom patching schedule that managed by AUM. For Arc-enabled guests, that's the only option if you want AUM to control the update schedule.

However, for Azure VMs there are different options that allow something outside of AUM to manage the installation of updates: Azure Managed, Windows Automatic Updates, Manual updates, and so on. For these types of devices, if you want AUM to control the schedule, you need to make sure they're configured with 'Customer Managed Schedules'.

Sorry if I used Azure Update Manager and Azure Update Management interchangeably, though let's keep the blame where it belongs: Microsoft marketing. In this thread, I was only intending to refer to the new Azure Arc solution. I'm familiar with the now deprecated Azure Automation and trying to do the mental shift, but the docs made my brain hurt.

Thanks for all the clarifications Stanislav, much appreciated.

Stanislav Zhelyazkov 24,766 Reputation points MVP

2024-10-16T06:41:06.3866667+00:00

Correct. Yes, I often do not agree with the marketing nonsense sometimes.

Bryan Dam 30 Reputation points

2024-10-16T13:19:00.92+00:00

Yea, I'm an MVP in Intune and ... well ... yea ... marketing. Sheesh.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Scheduling Options for on-prem Arc-Enabled Servers

0 additional answers

Your answer