How to Schedule Recurring Updates with Azure Update Manager

Patching by hand doesn’t scale, and patching at random times is how maintenance turns into an outage. Azure Update Manager lets you define a recurring maintenance window and have Azure apply updates to your VMs on that schedule. This guide follows Microsoft’s procedure for creating a schedule in the Azure portal, attaching machines, and staying inside the service’s limits.

Before you start

1. Review the general Update Manager prerequisites, including permissions. Microsoft’s scheduling page doesn’t list specific RBAC roles.
2. Set the patch orchestration option for each Azure VM to Customer Managed Schedules. This isn’t required for Azure Arc-enabled machines.

Step 1: Create the maintenance configuration

1. Sign in to the Azure portal and open Azure Update Manager.
2. Select Overview (or Machines), then Schedule updates.
3. On the Basics tab, choose the subscription, resource group and instance details.
4. Set Maintenance scope to Guest (Azure VM, Azure Arc-enabled VMs/servers).

Step 2: Define the schedule

Select Add a schedule and configure:

• Start on: when the first window opens.
• Maintenance window: its length in hours. For a single VM the maximum is 3 hours 55 minutes.
• Repeats: daily, weekly or monthly. Monthly can use a calendar date (optionally the last day of the month) or an nth weekday with an optional offset of +6 to -6 days.
• Add end date: optional.

Hourly schedules aren’t available in the portal. Use the API for those.

Step 3: Pick machines and updates

1. Machines tab: select the VMs to patch. Currently the VMs and the maintenance configuration must be in the same subscription.
2. Updates tab: choose the update classifications, and add or exclude specific KB IDs or packages with Include KB ID/package and Exclude KB ID/package. Driver updates aren’t supported.
3. Tags tab: add tags if you use them.
4. Review + create: verify the settings and select Create.

Reboot behavior: the schedule’s reboot setting can be overridden by registry keys described in Microsoft’s Windows Automatic Updates documentation. A reboot can happen even if you choose Never Reboot, so review those keys for your environment.

Attach more machines later

1. In Azure Update Manager, select Machines, then your subscription and the machine.
2. On the Updates pane, select Scheduled updates.
3. On the Scheduling tab, select Attach maintenance configuration.
4. Choose the configuration and select Attach.

A configuration can be attached to many machines, either at creation or afterwards.

Check and manage your schedules

• Search for Maintenance configurations in the portal. Guest OS configurations have the scope InGuestPatch.
• To change update criteria, revisit the Updates tab in the same flow.
• To review runs, use Update deployment history by maintenance run ID.

How the maintenance window is used

Update Manager checks how much time is left before starting each step. Using Microsoft’s example of a 3-hour window starting at 3:00 PM:

If a step doesn’t have enough time left, it is skipped. After a reboot, Update Manager waits up to 15 minutes for Azure VMs (25 for Arc servers) before marking it failed.

Limits to plan around

• 250 schedules per subscription per region.
• 3,000 resource associations per schedule.
• Dynamic scope limits of 1,000 resource associations per scope, 250 scopes per resource group or subscription per region, and 200 scopes per schedule.
• VMs in the same availability set aren’t patched concurrently. If several schedules patch machines from one availability set at the same time, patching may be missed or fail when the window runs out, so lengthen the window or stagger the schedules.
• Update Manager doesn’t stop starting new updates near the end of the window and doesn’t terminate in-progress updates. Updates that haven’t started are skipped, so allow enough time.

Scale it with Azure Policy

To apply schedules across many machines, assign the built-in policy Schedule recurring updates using Azure Update Manager. Set the scope and parameters (maintenance configuration ARM ID, resource groups, OS, locations, tags), and use a system-assigned managed identity with Contributor permissions for remediation. The policy also enforces Customer Managed Schedules. Check compliance under Policy Assignments > View compliance.

Sources

• Schedule recurring updates in Azure Update Manager – Microsoft Learn