Skip to content

Commit 43aa261

Browse files
Court72Court72
authored
Merge pull request #231002 from SnehaSudhirG/16Mar-UMC-WhatsNew
Updated What'sNew on new Pre-req and the recommendation info
2 parents 05e46ca + 4a1dff6 commit 43aa261

File tree

6 files changed

+295
-6
lines changed

6 files changed

+295
-6
lines changed

‎articles/update-center/manage-multiple-machines.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Manage multiple machines in update management center (preview)
33
description: The article details how to use Update management center (preview) in Azure to manage multiple supported machines and view their compliance state in the Azure portal.
44
ms.service: update-management-center
5-
ms.date: 04/11/2023
5+
ms.date: 04/26/2023
66
ms.topic: conceptual
77
author: SnehaSudhirG
88
ms.author: sudhirsneha
@@ -12,6 +12,10 @@ ms.author: sudhirsneha
1212

1313
**Applies to:** :heavy_check_mark: Windows VMs :heavy_check_mark: Linux VMs :heavy_check_mark: On-premises environment :heavy_check_mark: Azure Arc-enabled servers.
1414

15+
> [!IMPORTANT]
16+
> - For a seamless scheduled patching experience, we recommend that for all Azure VMs, you update the patch mode to *Azure orchestrated with user managed schedules (preview)* before **May 19, 2023**. If you fail to update the patch mode before **May 19, 2023**, you can experience a disruption in business continuity because the schedules will fail to patch the VMs.[Learn more](prerequsite-for-schedule-patching.md).
17+
> - To update the patch mode, go to **Update management center (Preview)** home page > **Update Settings**. In **Change update settings**, add the machines and under **Patch orchestration**, select *Azure-orchestrated-safe deployment*.
18+
1519
This article describes the various features that update management center (Preview) offers to manage the system updates on your machines. Using the update management center (preview), you can:
1620

1721
- Quickly assess the status of available operating system updates.
@@ -46,7 +50,7 @@ Instead of performing these actions from a selected Azure VM or Arc-enabled serv
4650
- **Reboot Required**—pending a reboot for the updates to take effect.
4751
- **No updates data**—no assessment data is available for these machines.
4852

49-
There following could be the reasons for no assessment data:
53+
The following could be the reasons for no assessment data:
5054
- No assessment has been done over the last seven days
5155
- The machine has an unsupported OS
5256
- The machine is in an unsupported region and you can't perform an assessment.
@@ -174,4 +178,4 @@ When the Resource Graph Explorer opens, it is automatically populated with the s
174178
## Next steps
175179

176180
* To set up and manage recurring deployment schedules, see [Schedule recurring updates](scheduled-patching.md)
177-
* To view update assessment and deployment logs generated by update management center (preview), see [query logs](query-logs.md).
181+
* To view update assessment and deployment logs generated by update management center (preview), see [query logs](query-logs.md).

‎articles/update-center/prerequsite-for-schedule-patching.md

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
---
2+
title: Configure schedule patching on Azure VMs to ensure business continuity in update management center (preview).
3+
description: The article describes the new prerequisites to configure scheduled patching to ensure business continuity in Update management center (preview).
4+
ms.service: update-management-center
5+
ms.date: 04/26/2023
6+
ms.topic: conceptual
7+
author: snehasudhirG
8+
ms.author: sudhirsneha
9+
---
10+
11+
# Configure schedule patching on Azure VMs to ensure business continuity
12+
13+
**Applies to:** :heavy_check_mark: Windows VMs :heavy_check_mark: Linux VMs :heavy_check_mark: Azure VMs.
14+
15+
This article is an overview on how to configure Schedule patching and Automatic guest VM patching on Azure VMs using the new prerequisite to ensure business continuity. The steps to configure both the patching options on Arc VMs remain the same.
16+
17+
Currently, you can enable [Automatic guest VM patching](../virtual-machines/automatic-vm-guest-patching.md) (Autopatch) by setting the patch mode to **Azure-orchestrated**/**AutomaticByPlatform** on Azure portal/REST API respectively, where patches are automatically applied during off-peak hours.
18+
19+
For customizing control over your patch installation, you can use [schedule patching](updates-maintenance-schedules.md#scheduled-patching) to define your maintenance window. You can [enable schedule patching](scheduled-patching.md#schedule-recurring-updates-on-single-vm) by setting the patch mode to **Azure orchestrated**/**AutomaticByPlatform** and attaching a schedule to the Azure VM. So, the VM properties couldn't be differentiated between **schedule patching** or **Automatic guest VM patching** as both had the patch mode set to *Azure-Orchestrated*.
20+
21+
Additionally, in some instances, when you remove the schedule from a VM, there is a possibility that the VM may be auto patched and rebooted. To overcome the limitations, we have introduced a new prerequisite - **ByPassPlatformSafetyChecksOnUserSchedule**, which can now be set to *true* to identify a VM using schedule patching. It means that VMs with this property set to *true* will no longer be auto patched when the VMs don't have an associated maintenance configuration.
22+
23+
> [!IMPORTANT]
24+
> For a continued scheduled patching experience, you must ensure that the new VM property, *BypassPlatformSafetyChecksOnUserSchedule*, is enabled on all your Azure VMs (existing or new) that have schedules attached to them **before May 19, 2023**. This setting will ensure machines are patched using your configured schedules and not autopatched. Failing to enable the pre-requisite will give an error that the prerequisites aren't met.
25+
26+
## Find VMs with associated schedules
27+
28+
To identify the list of VMs with the associated schedules for which you have to enable new VM property, follow these steps:
29+
30+
1. Go to **Update management center (Preview)** home page and select **Machines** tab.
31+
1. In **Patch orchestration** filter, select **Azure-orchestrated safe deployment**.
32+
1. Use the **Select all** option to select the machines and then select **Export to CSV**.
33+
1. Open the CSV file and in the column **Associated schedules**, select the rows that have an entry.
34+
35+
In the corresponding **Name** column, you can view the list the VMs to which you would need to enable the **ByPassPlatformSafetyChecksOnUserSchedule** flag.
36+
37+
38+
## Enable schedule patching on Azure VMs
39+
40+
# [Azure portal](#tab/new-prereq-portal)
41+
42+
**Prerequisite**
43+
44+
Patch orchestration = Customer managed schedules.
45+
46+
Select the patch orchestration option as **Customer managed schedules**.
47+
The new patch orchestration option enables the following VM properties on your behalf after receiving your consent:
48+
49+
- Patch mode = Azure-orchestrated
50+
- BypassPlatformSafetyChecksOnUserSchedule = TRUE
51+
52+
**Enable for new VMs**
53+
54+
You can select the patch orchestration option for new VMs that would be associated with the schedules:
55+
56+
To update the patch mode, follow these steps:
57+
58+
1. Sign in to the [Azure portal](https://portal.azure.com)
59+
1. Go to **Virtual machine**, and select **+Create** to open *Create a virtual machine* page.
60+
1. In **Basics** tab, complete all the mandatory fields.
61+
1. In **Management** tab, under **Guest OS updates**, for **Patch orchestration options**, select *Azure-orchestrated*.
62+
1. After you complete the entries in **Monitoring**, **Advanced** and **Tags** tabs.
63+
1. Select **Review + Create** and select **Create** to create a new VM with the appropriate patch orchestration option.
64+
65+
To schedule patch the newly created VMs, follow the procedure from step 2 in **Enable for existing VMs**.
66+
67+
68+
**Enable for existing VMs**
69+
70+
You can update the patch orchestration option for existing VMs that either already have schedules associated or are to be newly associated with a schedule:
71+
72+
> [!NOTE]
73+
> If the **Patch orchestration** is set as *Azure-orchestrated or Azure-orchestrated safe deployment (AutomaticByPlatform)*, the **BypassPlatformSafetyChecksOnUserSchedule** is set to *False* and there is no schedule associated, the VM(s) will be autopatched.
74+
75+
To update the patch mode, follow these steps:
76+
77+
1. Sign in to the [Azure portal](https://portal.azure.com)
78+
1. Go to **Update management center (Preview)**, select **Update Settings**.
79+
1. In **Change update settings**, select **+Add machine**.
80+
1. In **Select resources**, select your VMs and then select **Add**.
81+
1. In **Change update settings**, under **Patch orchestration**, select *Customer managed schedules* and then select **Save**.
82+
83+
Attach a schedule after you complete the above steps.
84+
85+
To check if the **BypassPlatformSafetyChecksOnUserSchedule** is enabled, go to **Virtual machine** home page > **Overview** tab > **JSON View**.
86+
87+
# [REST API](#tab/new-prereq-rest-api)
88+
89+
**Prerequisite**
90+
91+
- Patch mode = AutomaticByPlatform
92+
- BypassPlatformSafetyChecksOnUserSchedule = TRUE
93+
94+
**Enable on Windows VMs**
95+
96+
```
97+
PUT on `/subscriptions/subscription_id/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVirtualMachine?api-version=2023-03-01`
98+
```
99+
100+
```json
101+
{
102+
"location":"<location>",
103+
"properties": {
104+
"osProfile": {
105+
"windowsConfiguration": {
106+
"provisionVMAgent": true,
107+
"enableAutomaticUpdates": true,
108+
"patchSettings": {
109+
"patchMode": "AutomaticByPlatform",
110+
"automaticByPlatformSettings":{
111+
"bypassPlatformSafetyChecksOnUserSchedule":true
112+
}
113+
}
114+
}
115+
}
116+
}
117+
}
118+
119+
```
120+
**Enable on Linux VMs**
121+
122+
```
123+
PUT on `/subscriptions/subscription_id/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVirtualMachine?api-version=2023-03-01`
124+
```
125+
126+
```json
127+
{
128+
129+
"location":"<location>",
130+
"properties": {
131+
"osProfile": {
132+
" linuxConfiguration": {
133+
"provisionVMAgent": true,
134+
"enableAutomaticUpdates": true,
135+
"patchSettings": {
136+
"patchMode": "AutomaticByPlatform",
137+
"automaticByPlatformSettings":{
138+
"bypassPlatformSafetyChecksOnUserSchedule":true
139+
}
140+
}
141+
}
142+
}
143+
}
144+
}
145+
```
146+
---
147+
148+
> [!NOTE]
149+
> Currently, you can only enable the new prerequisite for schedule patching via Azure portal and REST API. It cannot be enabled via Azure CLI and PowerShell.
150+
151+
152+
## Enable automatic guest VM patching on Azure VMs
153+
154+
To enable automatic guest VM patching on your Azure VMs now, follow these steps:
155+
156+
# [Azure portal](#tab/auto-portal)
157+
158+
**Prerequisite**
159+
160+
Patch mode = Azure-orchestrated
161+
162+
**Enable for new VMs**
163+
164+
You can select the patch orchestration option for new VMs that would be associated with the schedules:
165+
166+
To update the patch mode, follow these steps:
167+
168+
1. Sign in to the [Azure portal](https://portal.azure.com)
169+
1. Go to **Virtual machine**, and select **+Create** to open *Create a virtual machine* page.
170+
1. In **Basics** tab, complete all the mandatory fields.
171+
1. In **Management** tab, under **Guest OS updates**, for **Patch orchestration options**, select *Azure-orchestrated*.
172+
1. After you complete the entries in **Monitoring**, **Advanced** and **Tags** tabs.
173+
1. Select **Review + Create** and select **Create** to create a new VM with the appropriate patch orchestration option.
174+
175+
176+
**Enable for existing VMs**
177+
178+
To update the patch mode, follow these steps:
179+
180+
1. Sign in to the [Azure portal](https://portal.azure.com)
181+
1. Go to **Update management center (Preview)**, select **Update Settings**.
182+
1. In **Change update settings**, select **+Add machine**.
183+
1. In **Select resources**, select your VMs and then select **Add**.
184+
1. In **Change update settings**, under **Patch orchestration**, select *Azure-orchestrated-safe deployment* and then select **Save**.
185+
186+
187+
# [REST API](#tab/auto-rest-api)
188+
189+
**Prerequisites**
190+
191+
- Patch mode = AutomaticByPlatform
192+
- BypassPlatformSafetyChecksOnUserSchedule = FALSE
193+
194+
**Enable on Windows VMs**
195+
196+
```
197+
PUT on `/subscriptions/subscription_id/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVirtualMachine?api-version=2023-03-01`
198+
```
199+
200+
```json
201+
{
202+
203+
"location":"<location>",
204+
"properties": {
205+
"osProfile": {
206+
"windowsConfiguration": {
207+
"provisionVMAgent": true,
208+
"enableAutomaticUpdates": true,
209+
"patchSettings": {
210+
"patchMode": "AutomaticByPlatform",
211+
"automaticByPlatformSettings":{
212+
"bypassPlatformSafetyChecksOnUserSchedule":false
213+
}
214+
}
215+
}
216+
}
217+
}
218+
}
219+
```
220+
221+
**Enable on Linux VMs**
222+
223+
```
224+
PUT on `/subscriptions/subscription_id/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVirtualMachine?api-version=2023-03-01`
225+
```
226+
227+
```json
228+
{
229+
"location":"<location>",
230+
"properties": {
231+
"osProfile": {
232+
" linuxConfiguration": {
233+
"provisionVMAgent": true,
234+
"enableAutomaticUpdates": true,
235+
"patchSettings": {
236+
"patchMode": "AutomaticByPlatform",
237+
"automaticByPlatformSettings":{
238+
"bypassPlatformSafetyChecksOnUserSchedule":false
239+
}
240+
}
241+
}
242+
}
243+
}
244+
}
245+
```
246+
---
247+
248+
249+
## User scenarios
250+
251+
**Scenarios** | **Azure-orchestrated** | **BypassPlatformSafetyChecksOnUserSchedule** | **Schedule Associated** |**Expected behavior in Azure** |
252+
--- | --- | --- | --- | ---|
253+
Scenario 1 | Yes | True | Yes | The schedule patch runs as defined by user. |
254+
Scenario 2 | Yes | True | No | Neither autopatch nor the schedule patch will run.|
255+
Scenario 3 | Yes | False | Yes | Neither autopatch nor schedule patch will run. You'll get an error that the prerequisites for schedule patch aren't met.|
256+
Scenario 4 | Yes | False | No | The VM is autopatched.|
257+
Scenario 5 | No | True | Yes | Neither autopatch nor schedule patch will run. You'll get an error that the prerequisites for schedule patch aren't met. |
258+
Scenario 6 | No | True | No | Neither the autopatch nor the schedule patch will run.|
259+
Scenario 7 | No | False | Yes | Neither autopatch nor schedule patch will run. You'll get an error that the prerequisites for schedule patch aren't met.|
260+
Scenario 8 | No | False | No | Neither the autopatch nor the schedule patch will run.|
261+
262+
## Next steps
263+
264+
* To troubleshoot issues, see the [Troubleshoot](troubleshoot.md) update management center (preview).

‎articles/update-center/scheduled-patching.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Scheduling recurring updates in Update management center (preview)
33
description: The article details how to use update management center (preview) in Azure to set update schedules that install recurring updates on your machines.
44
ms.service: update-management-center
5-
ms.date: 04/11/2023
5+
ms.date: 04/26/2023
66
ms.topic: conceptual
77
author: SnehaSudhirG
88
ms.author: sudhirsneha
@@ -12,6 +12,10 @@ ms.author: sudhirsneha
1212

1313
**Applies to:** :heavy_check_mark: Windows VMs :heavy_check_mark: Linux VMs :heavy_check_mark: On-premises environment :heavy_check_mark: Azure Arc-enabled servers.
1414

15+
> [!IMPORTANT]
16+
> - For a seamless scheduled patching experience, we recommend that for all Azure VMs, you update the patch mode to *Azure orchestrated with user managed schedules (preview)* before **May 19, 2023**. If you fail to update the patch mode before **May 19, 2023**, you can experience a disruption in business continuity because the schedules will fail to patch the VMs.[Learn more](prerequsite-for-schedule-patching.md).
17+
> - To update the patch mode, go to **Update management center (Preview)** home page > **Update Settings**. In **Change update settings**, add the machines and under **Patch orchestration**, select *Azure-orchestrated-safe deployment*.
18+
1519
You can use update management center (preview) in Azure to create and save recurring deployment schedules. You can create a schedule on a daily, weekly or hourly cadence, specify the machines that must be updated as part of the schedule, and the updates to be installed. This schedule will then automatically install the updates as per the created schedule for single VM and at scale.
1620

1721
Update management center (preview) uses maintenance control schedule instead of creating its own schedules. Maintenance control enables customers to manage platform updates. For more information, see [Maintenance control documentation](/azure/virtual-machines/maintenance-control).
@@ -22,7 +26,7 @@ Update management center (preview) uses maintenance control schedule instead of
2226
1. Patch orchestration of the Azure machines should be set to **Azure Orchestrated (Automatic By Platform)**. For Azure Arc-enabled machines, it isn't a requirement.
2327

2428
> [!Note]
25-
> If you set the patch orchestration mode to Azure orchestrated (Automatic By Platform) but don't attach a maintenance configuration to an Azure machine, it is treated as [Automatic Guest patching](../virtual-machines/automatic-vm-guest-patching.md) enabled machine and Azure platform will automatically install updates as per its own schedule.
29+
> If you set the patch orchestration mode to Azure orchestrated (AutomaticByPlatform) but don't attach a maintenance configuration to an Azure machine, it is treated as [Automatic Guest patching](../virtual-machines/automatic-vm-guest-patching.md) enabled machine and Azure platform will automatically install updates as per its own schedule.
2630

2731

2832
## Schedule recurring updates on single VM

‎articles/update-center/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
items:
1717
- name: Update and maintenance options
1818
href: updates-maintenance-schedules.md
19+
- name: Schedule patching configuration on Azure VMs for business continuity
20+
href: prerequsite-for-schedule-patching.md
1921
- name: Assessment options
2022
href: assessment-options.md
2123
- name: Query resources with Azure Resource Graph

‎articles/update-center/updates-maintenance-schedules.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Updates and maintenance in update management center (preview).
33
description: The article describes the updates and maintenance options available in Update management center (preview).
44
ms.service: update-management-center
5-
ms.date: 04/21/2022
5+
ms.date: 04/26/2023
66
ms.topic: conceptual
77
author: snehasudhirG
88
ms.author: sudhirsneha
@@ -12,6 +12,11 @@ ms.author: sudhirsneha
1212

1313
**Applies to:** :heavy_check_mark: Windows VMs :heavy_check_mark: Linux VMs :heavy_check_mark: On-premises environment :heavy_check_mark: Azure Arc-enabled servers.
1414

15+
> [!IMPORTANT]
16+
> - For a seamless scheduled patching experience, we recommend that for all Azure VMs, you update the patch mode to *Azure orchestrated with user managed schedules (preview)* before **May 19, 2023**. If you fail to update the patch mode before **May 19, 2023**, you can experience a disruption in business continuity because the schedules will fail to patch the VMs.[Learn more](prerequsite-for-schedule-patching.md).
17+
> - To update the patch mode, go to **Update management center (Preview)** home page > **Update Settings**. In **Change update settings**, add the machines and under **Patch orchestration**, select *Azure-orchestrated-safe deployment*.
18+
19+
1520
This article provides an overview of the various update and maintenance options available by update management center (preview).
1621

1722
Update management center (preview) provides you the flexibility to take an immediate action or schedule an update within a defined maintenance window. It also supports new patching methods such as [automatic VM guest patching](../virtual-machines/automatic-vm-guest-patching.md), [Hotpatching](../automanage/automanage-hotpatch.md?context=%2fazure%2fvirtual-machines%2fcontext%2fcontext) and so on.

‎articles/update-center/whats-new.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,16 @@ ms.date: 03/03/2023
1212

1313
[Update management center (preview)](overview.md) helps you manage and govern updates for all your machines. You can monitor Windows and Linux update compliance across your deployments in Azure, on-premises, and on the other cloud platforms from a single dashboard. This article summarizes new releases and features in Update management center (Preview).
1414

15+
## April 2023
16+
17+
### New prerequisite for scheduled patching
18+
19+
A new patch mode - **Azure orchestrated with user managed schedules (Preview)** is introduced as a prerequisite to enable scheduled patching on Azure VMs. The new patch enables the *Azure-orchestrated using Automatic guest patching* and *BypassPlatformSafteyChecksOnUserSchedule* VM properties on your behalf after receiving the consent. [Learn more](prerequsite-for-schedule-patching.md).
20+
21+
> [!IMPORTANT]
22+
> For a seamless scheduled patching experience, we recommend that for all Azure VMs, you update the patch mode to *Azure orchestrated with user managed schedules (preview)* before **May 19, 2023**. If you fail to update the patch mode before **May 19, 2023**, you can experience a disruption in business continuity because the schedules will fail to patch the VMs.
23+
24+
1525
## November 2022
1626

1727
### New region support

0 commit comments

Comments
 (0)