Azure VMs set to the Manual patch mode, where no OS updates install automatically

Four patch modes, one of which does nothing

Every Azure VM has a patch orchestration mode in its OS profile. The automatic guest patching reference defines them:

• AutomaticByPlatform: Azure orchestrates patch installation.
• AutomaticByOS: Windows Automatic Updates installs patches (a Windows mode).
• ImageDefault: the Linux image’s own update configuration applies.
• Manual: a Windows mode with automatic updates turned off.

In Manual, no mechanism in the VM or the platform applies OS updates. Unless someone runs patching by hand or another tool does it, the VM falls further behind every patch Tuesday.

Finding Manual-mode VMs

az vm list \
  --query "[?osProfile.windowsConfiguration.patchSettings.patchMode=='Manual'].{name:name, rg:resourceGroup}" \
  -o table

az vm assess-patches --resource-group my-rg --name my-vm shows how many updates a VM is missing.

Only the Manual value fires

ZopNight reads the raw patch mode from the VM’s OS profile and fires only on Manual, compared without regard to case. It does not rely on a simpler “automatic patching on or off” reading, which would lump the Windows and Linux defaults together with Manual and wrongly report VMs that do update themselves.

VMs that are not flagged

VMs on AutomaticByOS, ImageDefault or AutomaticByPlatform are never flagged. A VM with no patch mode in its definition is treated as unknown rather than unpatched. Tags are ignored; there is no tag that stands in for the real patch mode.

Vulnerability exposure, not spend

No saving is attached. The risk is a VM carrying publicly known, already-fixed vulnerabilities because nothing installed the fixes.

Getting the VM patched automatically

1. Switch to Azure-orchestrated patching. Microsoft supports moving between Manual and AutomaticByPlatform on VMs where automatic updates are disabled:

az vm update --resource-group my-rg --name my-vm \
  --set osProfile.windowsConfiguration.patchSettings.patchMode=AutomaticByPlatform

2. Or manage the VM in Azure Update Manager with a maintenance schedule that suits the workload.
3. Run az vm assess-patches again after the first cycle to confirm updates landed.