# Azure VM OS Guest Patching

> Azure VM Guest Patching mode helps with update management by automatically and safely patching virtual machines to maintain security compliance

---

Site [llms.txt](/llms.txt)

---

Cloud Management Platform (CMP) reads the VM's current mode from Azure and offers only the modes that the VM can move to. Refer to [Microsoft's documentation on Automatic Guest Patching](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching) for more information.

## Enable OS Guest Patching

The action is not installed with CMP. Import it from the Content Library first.

1. In the main menu, select **Library**, then filter **Content Type** to **Server Actions**.
1. Locate the OS Guest Patching server action, then select the Download icon and choose **Import**.
1. Go to an Azure server. **OS Guest Patching** appears with the server's other actions, above the tabs. If the server has more than six actions, the rest are under **More**.
1. Select **OS Guest Patching**.
1. Select a **New Patch Mode**. Available modes depend on the Azure VM OS image and VM settings.
1. Select **Change Mode**.

## Patch modes

| Mode | Who applies patches |
| --- | --- |
| `AutomaticByPlatform` | Azure. |
| `AutomaticByOS` | The operating system. |
| `Manual` | The user. |
| `ImageDefault` | Determined by the OS image's settings. |

**New Patch Mode** never offers the current mode, and offered modes depend on the operating system. For Windows they also depend on whether the VM has automatic updates enabled, which Azure sets when the VM is created and cannot be changed afterwards.

- **Linux**: `AutomaticByPlatform` or `ImageDefault`.
- **Windows with automatic updates enabled**: `AutomaticByPlatform` or `AutomaticByOS`.
- **Windows with automatic updates disabled**: a VM on `AutomaticByPlatform` can move to `Manual`. A VM on `AutomaticByOS` cannot change mode.

<div class="alert alert-info" role="alert">


The list is empty when the VM's OS image does not support guest patching.
</div>


## Related

- [Server actions](/docs/cmp/use/orchestration/actions/server-actions/): how server actions are imported, enabled, and run.
- [Azure](/docs/cmp/configure/infrastructure/resource-handlers/azure/): create the resource handler these servers belong to.