Azure Update Manager

About Azure Update Manager

Azure Update Manager is Microsoft's unified patch-management service for Windows and Linux server workloads across Azure, on-premises environments, and other clouds connected through Azure Arc. It gives infrastructure teams one place to assess update compliance, install updates on demand, create recurring maintenance schedules, and govern patching across subscriptions without depending on the retired Azure Automation Update Management architecture or a Log Analytics workspace. It is best suited to organizations that need centralized server patch governance across Azure VMs and hybrid estates rather than client-device management.

What does Azure Update Manager do?

Azure Update Manager assesses operating-system updates and can install them on supported Azure virtual machines and Azure Arc-enabled servers. Microsoft supports Windows and Linux server workloads. Teams can run an on-demand compliance scan, install selected updates immediately, enable periodic assessments, or create recurring maintenance schedules. Microsoft states that periodic assessment can check for updates every 24 hours.

For Windows, Update Manager works with the Windows Update client and can use Microsoft Update or a configured Windows Server Update Services repository. For Linux, it uses the machine's configured package repositories. Update Manager does not replace those update sources, so repository health, network access, package policy, and operating-system support still affect whether a deployment succeeds.

How do scheduled patching and dynamic scopes work?

Scheduled patching uses Azure maintenance configurations. Teams define a maintenance window and update rules, then associate eligible machines with the schedule. Microsoft requires the patch orchestration setting for Azure machines to be Customer Managed Schedules when they participate in scheduled patching.

Dynamic scopes help larger estates apply maintenance configurations by matching Azure resource criteria instead of maintaining only static machine lists. This is useful when subscriptions, resource groups, locations, or tags are already used to organize infrastructure. Teams should test scope rules carefully because a broad filter can include more systems than intended, which can turn a patching mistake into a fleet-wide change.

What infrastructure and agents are required?

Update Manager is a native Azure service and does not require Azure Automation, Log Analytics, or the Azure Monitor Agent for core patch operations. For Azure VMs, it interacts with the Azure VM agent. For machines outside Azure, Azure Arc is mandatory and the Azure Connected Machine agent provides the management path.

When an assessment, one-time update, periodic assessment, or scheduled deployment runs, Update Manager can deploy the required patch extension automatically. Network access to the operating system's configured update source is still required. Organizations using WSUS, private Linux repositories, proxies, firewalls, or restricted outbound networking should validate those paths before depending on centralized schedules.

What changed for Hotpatch in 2026?

Microsoft states that, from May 19, 2026, Hotpatch on eligible Azure Arc-enabled machines running Windows Server 2025 Standard or Datacenter is available at no additional Hotpatch charge. Microsoft says there is no per-core meter, no hourly Hotpatch charge, and no separate Hotpatch line item for these eligible Arc-enabled servers. Existing enrolled machines keep their enrollment, and new eligible enrollments can use Hotpatch without a separate Hotpatch fee.

Hotpatch is not the same as universal reboot-free patching. Eligibility depends on the operating system and supported configuration, and some updates can still require restarts. Buyers should treat Hotpatch as a way to reduce reboot frequency on supported systems, not as permission to remove maintenance planning, workload testing, or restart procedures.

How much does Azure Update Manager cost?

Pricing was checked on September 4, 2026 against Microsoft's current Azure Update Manager, Azure Arc, and FAQ material. Microsoft states that Update Manager has no additional charge for managing Azure VMs and Azure Arc-enabled Azure Local VMs created through an Azure Arc resource bridge. For other Azure Arc-enabled servers, Microsoft currently lists a daily-prorated charge equivalent to up to USD 5 per server per month, assuming 31 days of connected managed usage.

Microsoft also documents exceptions. Existing Arc-enabled servers that used Azure Automation Update Management for free as of September 1, 2023 are not charged under the stated grandfathering condition. Microsoft also says customers with Defender for Servers Plan 2 do not pay Update Manager charges to remediate the specific update recommendations Microsoft lists in the FAQ. Other Arc-enabled-server scenarios can still be billable, so buyers should check the exact resource type, Defender plan, and connection history rather than assuming every hybrid server is free.

What data, reporting, and automation options are available?

Microsoft states that Update Manager stores update data in Azure Resource Graph. Teams can build custom reporting through Azure Workbooks and use Azure Resource Graph data for deeper compliance analysis. Azure Policy can be used to enable periodic assessment at scale and to support onboarding to schedules.

Update Manager also supports programmatic interaction through REST APIs, Azure CLI, and Azure PowerShell for Azure VMs and Azure Arc-enabled machines. This matters for organizations that want patch governance integrated into infrastructure automation instead of relying only on portal-based operations.

What are the main limitations and operational risks?

Update Manager is designed for server operating systems. Microsoft does not support Windows 10 or Windows 11 client-device patching through Update Manager and recommends Microsoft Intune for those endpoints. Non-Azure servers must be connected through Azure Arc. Linux machines require supported operating-system configurations and working repositories.

Microsoft's current FAQ also states that Update Manager does not support Azure Lighthouse integration. That can matter to managed service providers or organizations that rely heavily on delegated cross-tenant Azure administration. Multiple subscriptions are supported, but cross-tenant operating models should be validated separately.

Patching itself still carries application risk. A technically successful operating-system update can restart services, change dependencies, or expose an application incompatibility. Maintenance windows, staged rollout, preproduction testing, backup or rollback planning, service-owner approval, and post-patch validation remain necessary.

How does Update Manager differ from Azure Automation and Microsoft Intune?

Azure Update Manager is the current Azure-native server patch-management experience. It does not require an Automation account and Log Analytics workspace for core patch operations. Azure Automation remains a separate service for runbooks, process automation, and Hybrid Runbook Worker scenarios, so it should not be treated as the parent product for Update Manager.

Microsoft Intune serves a different endpoint-management audience. If the main requirement is Windows 10 or Windows 11 end-user device patching, compliance, configuration, and application management, Intune is the more appropriate Microsoft product. Update Manager fits server estates, especially where Azure VMs and Azure Arc-enabled Windows or Linux servers need a common compliance and scheduling layer.

Who is Azure Update Manager best suited for?

Azure Update Manager is a strong fit for infrastructure teams managing Azure VMs, hybrid Windows or Linux servers, and environments that already use Azure Arc. It is particularly useful when patch compliance needs to be viewed centrally, schedules must span subscriptions, role-based access is important, or update reporting must feed Azure governance workflows.

The service becomes more valuable as server count and governance requirements grow. Organizations with mature tagging, subscription design, maintenance ownership, and Azure Policy practices can use those structures to make patch scope and reporting more consistent.

Who should choose something else?

Choose another product if the environment is primarily employee laptops and desktops, because Microsoft directs Windows 10 and Windows 11 patching toward Intune. A third-party patch-management platform may fit better when one tool must manage a broad mix of client devices, unsupported operating systems, network appliances, or third-party application patching beyond what supported operating-system repositories provide.

Teams with only a few simple servers may prefer native operating-system update tooling if Azure Arc onboarding, policy, scheduling, and centralized governance would add more complexity than value. Managed service providers that depend on Azure Lighthouse should also confirm an alternative operating model because Microsoft currently states that Update Manager does not support Lighthouse integration.