# Azure VM Update Management Not Enabled

> Azure exposes 4 patch orchestration modes, and only Manual leaves OS patching with no automatic channel. AutomaticByOS, ImageDefault, and AutomaticByPlatform all patch through some mechanism. RC-1303 therefore fires solely when patchSettings.patchMode equals Manual, avoiding the false claim that every non-Azure-orchestrated VM goes unpatched.

Source: https://zop.dev/integrations/azure/recommendations/azure-vm-update-management-not-enabled
Updated: 2026-08-19

---

## Four patch modes, one genuinely unpatched

Azure's `patchSettings.patchMode` takes four values, and they are not interchangeable
synonyms for "managed" versus "unmanaged". `AutomaticByPlatform` is Azure-orchestrated
patching. `AutomaticByOS` is the Windows default, where Windows Update installs patches on its
own schedule. `ImageDefault` is the Linux default, deferring to whatever the image configures.
`Manual` alone means the platform installs nothing and nothing inside the guest is expected
to either. Per Microsoft's automatic guest patching reference, Manual is the only mode where
no automatic patch channel exists, so Manual is the only value this rule fires on.

## How a boolean flattened three modes into a false alarm

The discoverer also derives a coarse `update_management` boolean, true only for
`AutomaticByPlatform`. An earlier revision of this rule keyed on that boolean, which collapsed
AutomaticByOS, ImageDefault, and Manual into one "false" bucket and produced a near-universal,
factually wrong "not patched" claim against VMs that patch themselves perfectly well through
Windows Update or their image defaults. The current rule reads the raw `patch_mode` string
instead, compares case-insensitively against Manual, and abstains fail-closed when no
`patchSettings` block was surfaced at all. There is no tag fallback, because no customer tag
carries the raw mode.

## Why a Manual fleet is an incident waiting on a CVE

A VM in Manual mode accumulates missing OS patches until a human intervenes per machine. When
the next actively-exploited CVE ships a fix, the window between patch availability and
deployment is entirely manual toil. Audit frameworks treat systematic patching as table
stakes, so a Manual production fleet reads as a control failure even before an exploit lands.

## Read the mode straight off the VM

```bash
az vm show -g <rg> -n <vm> \
  --query "osProfile.{win:windowsConfiguration.patchSettings.patchMode, linux:linuxConfiguration.patchSettings.patchMode}"
```

One of the two fields is populated depending on OS; `Manual` there is what triggers RC-1303.

## Getting out of Manual

Switch the mode to `AutomaticByPlatform` and pair it with Azure Update Manager maintenance
schedules for control over when reboots happen, then track compliance from Update Manager's
reports. Reader alone reproduces this detection; ZopNight does not change patch settings.