Azure VM OS Guest Patching

Azure VM Guest Patching mode helps with update management by automatically and safely patching virtual machines to maintain security compliance

  2 minute read  

Cloud Management Platform (CMP) reads the VM’s current mode from Azure and offers only the modes that the VM can move to. Refer to Microsoft’s documentation on Automatic Guest Patching for more information.

Enable OS Guest Patching

The action is not installed with CMP. Import it from the Content Library first.

  1. In the main menu, select Library, then filter Content Type to Server Actions.
  2. Locate the OS Guest Patching server action, then select the Download icon and choose Import.
  3. Go to an Azure server. OS Guest Patching appears with the server’s other actions, above the tabs. If the server has more than six actions, the rest are under More.
  4. Select OS Guest Patching.
  5. Select a New Patch Mode. Available modes depend on the Azure VM OS image and VM settings.
  6. Select Change Mode.

Patch modes

Mode Who applies patches
AutomaticByPlatform Azure.
AutomaticByOS The operating system.
Manual The user.
ImageDefault Determined by the OS image’s settings.

New Patch Mode never offers the current mode, and offered modes depend on the operating system. For Windows they also depend on whether the VM has automatic updates enabled, which Azure sets when the VM is created and cannot be changed afterwards.

  • Linux: AutomaticByPlatform or ImageDefault.
  • Windows with automatic updates enabled: AutomaticByPlatform or AutomaticByOS.
  • Windows with automatic updates disabled: a VM on AutomaticByPlatform can move to Manual. A VM on AutomaticByOS cannot change mode.
  • Server actions: how server actions are imported, enabled, and run.
  • Azure: create the resource handler these servers belong to.