Merge pull request #81737 from Tbohunek/extensionupdates

Clarify VM Extensions automatic updates

Author: ktoliver

articles/azure-monitor/agents/agent-manage.md

@@ -18,7 +18,7 @@ The Log Analytics agent for Windows and Linux can be upgraded to the latest rele
 
 | Environment | Installation Method | Upgrade method |
 |--------|----------|-------------|
-| Azure VM | Log Analytics agent VM extension for Windows/Linux | Agent is automatically upgraded by default unless you configured your Azure Resource Manager template to opt out by setting the property *autoUpgradeMinorVersion* to **false**. |
+| Azure VM | Log Analytics agent VM extension for Windows/Linux | Agent is automatically upgraded by default [after the VM model changes](../../virtual-machines/extensions/features-linux.md#how-do-agents-and-extensions-get-updated), unless you configured your Azure Resource Manager template to opt out by setting the property *autoUpgradeMinorVersion* to **false**. |
 | Custom Azure VM images | Manual install of Log Analytics agent for Windows/Linux | Updating VMs to the newest version of the agent needs to be performed from the command line running the Windows installer package or Linux self-extracting and installable shell script bundle.|
 | Non-Azure VMs | Manual install of Log Analytics agent for Windows/Linux | Updating VMs to the newest version of the agent needs to be performed from the command line running the Windows installer package or Linux self-extracting and installable shell script bundle. |
 
@@ -290,4 +290,4 @@ Perform the following steps to configure the Log Analytics agent for Linux to re
 
 - Review [Troubleshooting the Linux agent](agent-linux-troubleshoot.md) if you encounter issues while installing or managing the Linux agent.
 
-- Review [Troubleshooting the Windows agent](agent-windows-troubleshoot.md) if you encounter issues while installing or managing the Windows agent.
+- Review [Troubleshooting the Windows agent](agent-windows-troubleshoot.md) if you encounter issues while installing or managing the Windows agent.

articles/virtual-machines/extensions/features-linux.md

@@ -206,9 +206,9 @@ Moving the **command to execute** property to the **protected** configuration se
 
 ### How do agents and extensions get updated?
 
-The Agents and Extensions share the same update mechanism. Some updates do not require additional firewall rules.
+Agents and extensions share the same automatic update mechanism.
 
-When an update is available, it is only installed on the VM when there is a change to extensions, and other VM Model changes such as:
+When an update is available and automatic updates are enabled, the update is installed on the VM only after there is a change to an extension or after other VM model changes, such as:
 
 - Data disks
 - Extensions
@@ -217,8 +217,14 @@ When an update is available, it is only installed on the VM when there is a chan
 - VM size
 - Network profile
 
+> [!IMPORTANT]
+> The update is installed only after there is a change to the VM model.
+
 Publishers make updates available to regions at different times, so it is possible you can have VMs in different regions on different versions.
 
+> [!NOTE]
+> Some updates might require additional firewall rules. See [Network access](#network-access).
+
 #### Agent updates
 
 The Linux VM Agent contains *Provisioning Agent Code* and *Extension Handling code*  in one package, which cannot be separated. You can disable the *Provisioning Agent* when you want to provision on Azure using cloud-init. To do this, see [using cloud-init](../linux/using-cloud-init.md).
@@ -253,7 +259,9 @@ It is highly recommended that you always have auto update for the agent, [AutoUp
 
 #### Extension updates
 
-When an extension update is available, the Linux Agent downloads and upgrades the extension. Automatic extension updates are either *Minor* or *Hotfix*. You can opt in or opt out of extensions *Minor* updates when you provision the extension. The following example shows how to automatically upgrade minor versions in a Resource Manager template with *autoUpgradeMinorVersion": true,'*:
+When an extension update is available and automatic updates are enabled, after a [change to the VM model](#how-do-agents-and-extensions-get-updated) occurs, the Linux Agent downloads and upgrades the extension.
+
+Automatic extension updates are either *Minor* or *Hotfix*. You can opt in or opt out of extension *Minor* updates when you provision the extension. The following example shows how to automatically upgrade minor versions in a Resource Manager template with *"autoUpgradeMinorVersion": true,*:
 
 ```json
     "publisher": "Microsoft.Azure.Extensions",
@@ -269,6 +277,8 @@ When an extension update is available, the Linux Agent downloads and upgrades th
 
 To get the latest minor release bug fixes, it is highly recommended that you always select auto update in your extension deployments. Hotfix updates that carry security or key bug fixes cannot be opted out.
 
+If you disable extension automatic updates or you need to upgrade a major version, use [az vm extension set](/cli/azure/vm/extension#az_vm_extension_set) and specify the target version.
+
 ### How to identify extension updates
 
 #### Identifying if the extension is set with autoUpgradeMinorVersion on a VM

articles/virtual-machines/extensions/features-windows.md

@@ -116,7 +116,7 @@ Set-AzVMCustomScriptExtension -ResourceGroupName "myResourceGroup" `
     -Run "Create-File.ps1" -Location "West US"
 ```
 
-In the following example, the VM Access extension is used to reset the administrative password of a Windows VM to a temporary password. For more information on the VM Access extension, see [Reset Remote Desktop service in a Windows VM](/troubleshoot/azure/virtual-machines/reset-rdp). Once you have run this, you should reset the password at first login:
+In the following example, the VM Access extension is used to reset the administrative password of a Windows VM to a temporary password. For more information on the VM Access extension, see [Reset Remote Desktop service in a Windows VM](/troubleshoot/azure/virtual-machines/reset-rdp). After you have run this, you should reset the password at first login:
 
 ```powershell
 $cred=Get-Credential
@@ -247,9 +247,9 @@ These certificates secure the communication between the VM and its host during t
 
 ### How do agents and extensions get updated?
 
-The Agents and Extensions share the same update mechanism. Some updates do not require additional firewall rules.
+Agents and extensions share the same automatic update mechanism.
 
-When an update is available, it is only installed on the VM when there is a change to extensions, and other VM Model changes such as:
+When an update is available and automatic updates are enabled, the update is installed on the VM only after there is a change to an extension or other VM model changes, such as:
 
 - Data disks
 - Extensions
@@ -258,8 +258,14 @@ When an update is available, it is only installed on the VM when there is a chan
 - VM size
 - Network profile
 
+> [!IMPORTANT]
+> The update is installed only after there is a change to the VM model.
+
 Publishers make updates available to regions at different times, so it is possible you can have VMs in different regions on different versions.
 
+> [!NOTE]
+> Some updates might require additional firewall rules. See [Network access](#network-access).
+
 #### Listing Extensions Deployed to a VM
 
 ```powershell
@@ -283,7 +289,10 @@ To check what version you are running, see [Detecting installed Windows Guest Ag
 
 #### Extension updates
 
-When an extension update is available, the Windows Guest Agent downloads and upgrades the extension. Automatic extension updates are either *Minor* or *Hotfix*. You can opt in or opt out of extensions *Minor* updates when you provision the extension. The following example shows how to automatically upgrade minor versions in a Resource Manager template with *autoUpgradeMinorVersion": true,'*:
+
+When an extension update is available and automatic updates are enabled, after a [change to the VM model](#how-do-agents-and-extensions-get-updated) occurs, the Windows Guest Agent downloads and upgrades the extension.
+
+Automatic extension updates are either *Minor* or *Hotfix*. You can opt in or opt out of extension *Minor* updates when you provision the extension. The following example shows how to automatically upgrade minor versions in a Resource Manager template with *"autoUpgradeMinorVersion": true,*:
 
 ```json
     "properties": {
@@ -300,6 +309,8 @@ When an extension update is available, the Windows Guest Agent downloads and upg
 
 To get the latest minor release bug fixes, it is highly recommended that you always select auto update in your extension deployments. Hotfix updates that carry security or key bug fixes cannot be opted out.
 
+If you disable extension automatic updates or you need to upgrade a major version, use [Set-AzVMExtension](/powershell/module/az.compute/set-azvmextension) and specify the target version.
+
 ### How to identify extension updates
 
 #### Identifying if the extension is set with autoUpgradeMinorVersion on a VM