Patch Azure VMs and Arc Servers with PowerShell 7 and Azure Update Manager

Patching is the job nobody thanks you for.

Until a server misses a security update. Then everyone asks why.

Azure Update Manager can patch Azure VMs and on premises servers through Azure Arc. The portal is fine for one machine. For fifty, I want a CSV.

So I cleaned up the checks I use and shared them on GitHub. This toolkit uses PowerShell 7, the Az modules and Azure Resource Graph.

Repo: azure-update-manager-powershell-toolkit

The problem it solves

An Arc server goes quiet, and nobody notices until patch night.

A security team asks "are we patched for this KB?" and you have to click through every machine.

A VM is not on any patch schedule, so it never gets updates.

The morning after patching, you need to know what failed. Fast.

These scripts make those checks quick and repeatable.

Highlight scripts

Get-AzUpdateComplianceSummary.ps1

One row per machine with Critical, Security and Other update counts. It also shows a pending reboot and flags old assessments. One Resource Graph query covers every subscription.

./Get-AzUpdateComplianceSummary.ps1 -MaxAssessmentAgeDays 3

Get-AzPendingUpdateReport.ps1

Every missing update on every machine. Filter by classification or by KB number.

./Get-AzPendingUpdateReport.ps1 -KbId 5000000

Get-AzMaintenanceScheduleReport.ps1

Lists your patch schedules and which machine is on which one. Most important, it lists machines with no schedule at all.

./Get-AzMaintenanceScheduleReport.ps1

Get-AzUpdateInstallationHistory.ps1

The morning after report. It shows each run with installed, failed and pending counts.

./Get-AzUpdateInstallationHistory.ps1 -Days 2 -FailedOnly

Other scripts cover Arc server health, failed Arc extensions, on demand assessments, setting the VM patch mode that schedules need, and assigning machines to schedules from a CSV.

How the scripts are built

• PowerShell 7.4 or later.
• Comment based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Assessments only scan. They never install or reboot.
• Certificate (app only) or interactive sign in for Azure.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a test subscription first. Read each script before you run it.

My usual workflow

Every Monday, I run the Arc inventory and the compliance summary.

A few days before patch night, I check that every machine has a schedule.

Test machines patch first. Production waits a few days.

The morning after, I run the history report with -FailedOnly and fix what broke.

One tip. If scheduled patching skips an Azure VM, check the patch mode. It must be AutomaticByPlatform with the schedule bypass turned on.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/azure-update-manager-powershell-toolkit.git
cd azure-update-manager-powershell-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot source it, then connect.

# Interactive sign in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Azure -Interactive -SubscriptionId 00000000-0000-0000-0000-000000000000

# Or app only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
$env:AZ_SUBSCRIPTION_ID   = '00000000-0000-0000-0000-000000000000'
Connect-M365Admin -Service Azure

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have more free toolkits that use the same pattern, including azure-governance-powershell-toolkit, azure-backup-dr-powershell-toolkit and active-directory-hybrid-powershell-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.