I want to patch Arc machines using customer managed schedules in Azure Update manager. How to do it?

Hello @Ajit Sane@Ajit Sane Thank you for posting your query on Microsoft Q&A platform.

Yes, Azure Update Manager supports patching Azure Arc–enabled servers using customer‑managed schedules, and the only supported way to do scheduled patching for Arc machines is by using a Maintenance Configuration.

Please have a look into below supported scenarios:

• Azure Arc–enabled Windows and Linux servers
• Customer‑managed schedules using Maintenance Configuration
• Assessment and patch installation during the defined maintenance window

Important: Azure‑managed safe deployment (automatic monthly patching) is NOT supported for Arc‑enabled servers. Only Maintenance Configuration–based scheduling is supported.

Reference: https://docs.azure.cn/en-us/update-manager/manage-update-settings?tabs=manage-single-overview%2Cmanage-scale-overview

Please have a look into below configuration updates:

On the Azure side

• The servers must be onboarded to Azure Arc and in a healthy state.
• Use Azure Update Manager and create a Maintenance Configuration that defines:
  • Schedule and recurrence
    • Maintenance window
      • Patch classifications
• Assign the Maintenance Configuration to the Arc machines (directly or via scope).

On the machine side:

Windows Arc machines

• The Windows Update client must already be configured to use Microsoft Update or WSUS (Update Manager does not override this).
• Patch settings must be set as below (this is required):

"windowsConfiguration": {
  "patchSettings": {
    "assessmentMode": "AutomaticByPlatform",
    "patchMode": "AutomaticByPlatform"
  }
}

Linux Arc machines:

• A supported Linux distribution must be used.
• Python (2.7+ or 3.x) must be installed, and the machine must allow root/sudo access.
• Patch settings should be configured as:

"linuxConfiguration": {
  "patchSettings": {
    "assessmentMode": "AutomaticByPlatform",
    "patchMode": "AutomaticByPlatform"
  }
}

No manual VM extension installation is required. Azure Update Manager automatically deploys the required extensions when patching is triggered.

Once the Maintenance Configuration is assigned:

• Azure Update Manager assesses and installs updates only during the defined maintenance window
• Patches are downloaded from the machine’s configured update source
• Reboots occur only if required and allowed by the configuration

Important clarification:

• Supported: Customer‑managed schedules using Maintenance Configuration.
• Not supported for Arc: Azure‑managed safe deployment (automatic monthly patching).

References:

Prerequisites for Azure Update Manager:
https://learn.microsoft.com/en-us/azure/update-manager/prerequisites

Customer‑managed schedules and update settings:

https://learn.microsoft.com/en-us/azure/update-manager/manage-update-settings?tabs=manage-single-overview%2Cmanage-scale-overview

Azure Update Manager overview (Arc behavior):

https://learn.microsoft.com/en-us/azure/update-manager/overview

To patch Azure Arc–enabled Windows and Linux machines on a schedule, you must use Azure Update Manager with a Maintenance Configuration. PatchMode and AssessmentMode must be set to AutomaticByPlatform, and updates are applied only during the configured maintenance window. Azure‑managed safe deployment is not supported for Arc machines.

Thanks,
Suchitra.