Patch Management¶
Any virtual machine the platform or a workload runs must be kept up to date with operating system security patches. PaaS services, such as Static Web Apps, App Service and managed databases, are patched by Microsoft and aren't covered here.
Status: not needed yet
The platform runs no VMs today. This page sets the standard for the first one.
Prefer not to have VMs¶
Every VM brings patching, backup, endpoint protection and access management. Choose PaaS or containers first. Use a VM only when nothing else fits, and record why.
Standard for VMs¶
| Item | Standard |
|---|---|
| Tool | Azure Update Manager, which works for Azure VMs and Arc-connected servers with no agent to maintain |
| Assessment | Periodic assessment on, so missing updates are reported every 24 hours. Enforce with the built-in Configure periodic checking for missing system updates policy. |
| Critical and security updates | Installed automatically in a weekly maintenance window |
| Other updates | Monthly |
| Production | Patch non-production first, then production a few days later |
| Maintenance configurations | Defined in Terraform (azurerm_maintenance_configuration) and assigned by tag or resource group |
| Reboots | Allowed during the maintenance window only |
Reporting¶
- The Update Manager compliance view shows each machine's patch status.
- Defender for Servers adds vulnerability data, including missing patches mapped to CVEs. See Defender Plans.
- A machine missing critical updates past the fix deadline is a finding for its owner.