Azure Update Manager: patch Windows and Linux

Load the network IDs and start both VMs:

$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
az vm start --resource-group rg-saat-vms --name web01
az vm start --resource-group rg-saat-vms --name win01

1Give the private subnets a way out

snet-web and snet-mgmt are private subnets (Lesson 11), so add the NAT Gateway from Lesson 13 for the patching window:

az network public-ip create --resource-group rg-saat-core --name pip-saat-natgw --sku Standard --location centralindia --tags course=saatvedha-azure lesson=30 -o none
az network nat gateway create --resource-group rg-saat-core --name natgw-saat --public-ip-addresses pip-saat-natgw --idle-timeout 4 --location centralindia --tags course=saatvedha-azure lesson=30 -o none
az network vnet subnet update --ids $v.'snet-web' --nat-gateway natgw-saat -o none
az network vnet subnet update --ids $v.'snet-mgmt' --nat-gateway natgw-saat -o none

2Set patch orchestration and periodic assessment

In the portal, open Azure Update Manager, then Machines. Tick web01 and win01, choose Settings, Update settings, and set Periodic assessment to Enable and Patch orchestration to Customer Managed Schedules. Save.

Check it from the CLI:

az vm show --resource-group rg-saat-vms --name web01 --query "osProfile.linuxConfiguration.patchSettings.{mode:patchMode, assessment:assessmentMode, bypass:automaticByPlatformSettings.bypassPlatformSafetyChecksOnUserSchedule}" -o table
az vm show --resource-group rg-saat-vms --name win01 --query "osProfile.windowsConfiguration.patchSettings.{mode:patchMode, assessment:assessmentMode, bypass:automaticByPlatformSettings.bypassPlatformSafetyChecksOnUserSchedule}" -o table

You should see this for both:

Mode                 Assessment           Bypass
-------------------  -------------------  --------
AutomaticByPlatform  AutomaticByPlatform  True

3Assess both VMs

Run this (a few minutes each):

az vm assess-patches --resource-group rg-saat-vms --name web01 --query "{status:status, criticalSecurity:criticalAndSecurityPatchCount, other:otherPatchCount, rebootPending:rebootPending}" -o table
az vm assess-patches --resource-group rg-saat-vms --name win01 --query "{status:status, criticalSecurity:criticalAndSecurityPatchCount, other:otherPatchCount, rebootPending:rebootPending}" -o table

You should see something like this:

Status     CriticalSecurity    Other    RebootPending
---------  ------------------  -------  ---------------
Succeeded  4                   11       False
Status     CriticalSecurity    Other    RebootPending
---------  ------------------  -------  ---------------
Succeeded  2                   1        False

4Install security updates on web01

Run this:

az vm install-patches --resource-group rg-saat-vms --name web01 --maximum-duration PT1H --reboot-setting IfRequired --classifications-to-include-linux Critical Security --query "{status:status, installed:installedPatchCount, failed:failedPatchCount, reboot:rebootStatus}" -o table

You should see something like this:

Status     Installed    Failed    Reboot
---------  -----------  --------  -----------
Succeeded  4            0         NotNeeded

5Create a weekly schedule and assign both VMs

Build the maintenance configuration (every Sunday 02:00 IST, 3 hours, Critical and Security):

$start = (Get-Date).Date.AddDays(7 - [int](Get-Date).DayOfWeek).ToString('yyyy-MM-dd') + ' 02:00'
$mc = @{
    location = 'centralindia'
    properties = @{
        maintenanceScope    = 'InGuestPatch'
        extensionProperties = @{ InGuestPatchMode = 'User' }
        maintenanceWindow   = @{ startDateTime = $start; duration = '03:00'; timeZone = 'India Standard Time'; recurEvery = 'Week Sunday' }
        visibility          = 'Custom'
        installPatches      = @{
            rebootSetting     = 'IfRequired'
            windowsParameters = @{ classificationsToInclude = @('Critical', 'Security') }
            linuxParameters   = @{ classificationsToInclude = @('Critical', 'Security') }
        }
    }
}
$mc | ConvertTo-Json -Depth 8 | Set-Content -Path C:\azure-lab\mc-weekly.json
$sub = az account show --query id -o tsv
$mcId = "/subscriptions/$sub/resourceGroups/rg-saat-vms/providers/Microsoft.Maintenance/maintenanceConfigurations/mc-saat-weekly"
az rest --method put --url "https://management.azure.com${mcId}?api-version=2023-04-01" --body '@C:\azure-lab\mc-weekly.json' --query "properties.maintenanceWindow" -o yaml

You should see something like this:

duration: 03:00
recurEvery: Week Sunday
startDateTime: 2026-10-25 02:00
timeZone: India Standard Time

Assign web01 and win01 to it:

Set-Content -Path C:\azure-lab\mc-assign.json -Value ('{"location": "centralindia", "properties": {"maintenanceConfigurationId": "' + $mcId + '"}}')
foreach ($vm in 'web01', 'win01') {
    $id = az vm show --resource-group rg-saat-vms --name $vm --query id -o tsv
    az rest --method put --url "https://management.azure.com${id}/providers/Microsoft.Maintenance/configurationAssignments/weekly?api-version=2023-04-01" --body '@C:\azure-lab\mc-assign.json' -o none
}
az rest --method get --url "https://management.azure.com${mcId}?api-version=2023-04-01" --query "name" -o tsv

You should see this:

mc-saat-weekly

In the portal, Update Manager, Machines now shows both VMs with the schedule. Assigning by tag with a dynamic scope is better at scale, because new VMs join the schedule by themselves.

✅ Checkpoint: Both VMs use Customer Managed Schedules with periodic assessment, web01 has its security updates, and mc-saat-weekly covers both.