VMs whose patch orchestration mode is set to Manual
What does ZopNight detect here?
Azure exposes 4 patch orchestration modes, and only Manual leaves OS patching with no automatic channel. AutomaticByOS, ImageDefault, and AutomaticByPlatform all patch through some mechanism. RC-1303 therefore fires solely when patchSettings.patchMode equals Manual, avoiding the false claim that every non-Azure-orchestrated VM goes unpatched.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1303 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | vm_update_mgmt.go |
Where it applies
Four patch modes, one genuinely unpatched
Azure’s patchSettings.patchMode takes four values, and they are not interchangeable
synonyms for “managed” versus “unmanaged”. AutomaticByPlatform is Azure-orchestrated
patching. AutomaticByOS is the Windows default, where Windows Update installs patches on its
own schedule. ImageDefault is the Linux default, deferring to whatever the image configures.
Manual alone means the platform installs nothing and nothing inside the guest is expected
to either. Per Microsoft’s automatic guest patching reference, Manual is the only mode where
no automatic patch channel exists, so Manual is the only value this rule fires on.
How a boolean flattened three modes into a false alarm
The discoverer also derives a coarse update_management boolean, true only for
AutomaticByPlatform. An earlier revision of this rule keyed on that boolean, which collapsed
AutomaticByOS, ImageDefault, and Manual into one “false” bucket and produced a near-universal,
factually wrong “not patched” claim against VMs that patch themselves perfectly well through
Windows Update or their image defaults. The current rule reads the raw patch_mode string
instead, compares case-insensitively against Manual, and abstains fail-closed when no
patchSettings block was surfaced at all. There is no tag fallback, because no customer tag
carries the raw mode.
Why a Manual fleet is an incident waiting on a CVE
A VM in Manual mode accumulates missing OS patches until a human intervenes per machine. When the next actively-exploited CVE ships a fix, the window between patch availability and deployment is entirely manual toil. Audit frameworks treat systematic patching as table stakes, so a Manual production fleet reads as a control failure even before an exploit lands.
Read the mode straight off the VM
az vm show -g <rg> -n <vm> \ --query "osProfile.{win:windowsConfiguration.patchSettings.patchMode, linux:linuxConfiguration.patchSettings.patchMode}"One of the two fields is populated depending on OS; Manual there is what triggers RC-1303.
Getting out of Manual
Switch the mode to AutomaticByPlatform and pair it with Azure Update Manager maintenance
schedules for control over when reboots happen, then track compliance from Update Manager’s
reports. Reader alone reproduces this detection; ZopNight does not change patch settings.