Azure Update Manager - Configuration Maintenance Query

Question

Azure Update Manager - Configuration Maintenance Query

Andrea Guido 0

Hi,

I am trying to setup an Azure Update Manager alert rule to send out an email when a specific Maintenance Configuration starts and ends.

I should manage a Kusto query, but checking Update, Patchinstallationsresources, Maintenanceresources samples, I am not able to find the proper one.

Any help?

Thanks.

Andrea

Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-18T05:16:25.5333333+00:00
Hello Andrea Guido

Thank you for posting your query on Microsoft Q&A platform.

Azure Update Manager does not expose “maintenance configuration start/end events” in Log Analytics tables such as Update, patchinstallationresources, or patchassessmentresources. This is by design.

Where the data actually exists: Maintenance configuration execution (start, in‑progress, completion) is recorded only in Azure Resource Graph (ARG) under maintenance-related resource types, not in Log Analytics.

Update assessments and patch installations are stored in Azure Resource Graph, exposed via:

patchassessmentresources

patchinstallationresources

These tables only contain machine‑level patch results, not maintenance window lifecycle events.

There is no Log Analytics table that records:

Maintenance Configuration start

Maintenance Configuration end

Maintenance window lifecycle status

This is why no sample KQL exists in Update or PatchInstallationResources for maintenance start/end.

Maintenance execution data is available via Azure Resource Graph under Microsoft.Maintenance resources.

Azure Resource Graph exposes:

Maintenance configurations

Maintenance execution status

Start / end times inside JSON properties, not as columns

As a resolution follow below supported approach:

Use Azure Monitor alert rules

Data source: Azure Resource Graph

Query microsoft.maintenance/* resources

Parse properties.startTime, properties.endTime, status

Maintenance execution events are recorded only in Azure Resource Graph under Microsoft.Maintenance resources.

The provided query works by filtering maintenance execution records (applyUpdates) and reading the startTime, endTime, and status values from the resource properties.

Query 1: Maintenance Configuration STARTED / IN‑PROGRESS

Use this to detect when a specific Maintenance Configuration starts.

maintenanceresources | where type =~ "microsoft.maintenance/maintenanceconfigurations/applyupdates" | extend props = parse_json(properties) | where tostring(props.maintenanceConfigurationId) == "<FULL_MAINTENANCE_CONFIGURATION_RESOURCE_ID>" | where tostring(props.status) == "InProgress" | project Time = todatetime(props.startTime), Status = props.status, CorrelationId = props.correlationId, MaintenanceConfigurationId = props.maintenanceConfigurationId

Reference: https://learn.microsoft.com/en-us/azure/update-manager/query-logs

Query 2: Maintenance Configuration COMPLETED (End): Use this to detect when maintenance ends (Succeeded or Failed).

maintenanceresources | where type =~ "microsoft.maintenance/maintenanceconfigurations/applyupdates" | extend props = parse_json(properties) | where tostring(props.maintenanceConfigurationId) == "<FULL_MAINTENANCE_CONFIGURATION_RESOURCE_ID>" | where tostring(props.status) in ("Succeeded", "Failed") | project Time = todatetime(props.endTime), Status = props.status, CorrelationId = props.correlationId, MaintenanceConfigurationId = props.maintenanceConfigurationId

endTime is only populated after execution completes, which is why this query works reliably.

These queries must be executed in:

Azure Monitor → Alerts → Custom log search

Data source: Azure Resource Graph

They will NOT work in:

Log Analytics workspace

Update, patchinstallationresources, or patchassessmentresourcesThese queries must be executed in:

Azure Monitor → Alerts → Custom log search

Data source: Azure Resource Graph

They will NOT work in:

Log Analytics workspace

Update, patchinstallationresources, or patchassessmentresources

Referral documents

Sample Query Logs and Results from Azure Update Manager | Microsoft Learn

Query Resources with Azure Resource Graph in Azure Update Manager | Microsoft Learn

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,

Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-20T03:00:28.93+00:00

Hello @Andrea Guido@Andrea Guido Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-02-20T10:41:38.4466667+00:00

Hi Suchitra,

unfortunately the 2 queries are not triggering the Maintenance Configuration start and stop (No results found even the MC has been executed).

Running the following query you see the Maintenance Configuration execution has been triggered in the same time range for the same Maintenance Configuration:

Shall we change the 2 provided queries to achieve our target?

Thanks for your help!

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-26T06:45:45.8566667+00:00
Hello @Andrea Guido@Andrea Guido

This is expected behavior and not a query issue.

Azure Update Manager does NOT persist an InProgress maintenance execution state in Azure Resource Graph.

Only finalized maintenance executions are written back to maintenanceresources.

What this means in practice:

InProgress is transient and not queryable

Azure Resource Graph stores only completed executions

Therefore, queries filtering on properties.status == "InProgress" will always return no results.

Your second query works because it does not filter on InProgress and instead reads the completed execution records, which are persisted.

Corrected & supported queries to Detect Maintenance Configuration execution (start time available).

startTime is populated only after execution completes There is no real‑time start trigger

arg("").maintenanceresources | where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates" | where properties.maintenanceConfigurationId == "/subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.Maintenance/maintenanceConfigurations/<MC-name>" | project MaintenanceStart = todatetime(properties.startTime), MaintenanceEnd = todatetime(properties.endTime), Status = tostring(properties.status)

Because live start events are not exposed, Microsoft‑supported alerting is:

Trigger alert when a maintenance execution record appears

Use Table rows ≥ 1 as condition

Data source: Azure Resource Graph

Maintenance Configuration executions are written to Azure Resource Graph only after completion, which is why queries filtering on properties.status == "InProgress" return no results. Only finalized states such as Succeeded or Failed are stored and queryable.

To track Maintenance Configuration execution, use Azure Resource Graph queries against maintenanceresources and alert on the presence of completed execution records, as this is the only Microsoft‑supported model today.

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-26T09:04:21.75+00:00

Hello @Andrea Guido@Andrea Guido Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-03-02T09:36:46.3266667+00:00

Hi Suchitra,

the query is retrieving all the Maintenance Configuration executions (Succeeded) even though the Time Range is 24 hours:

Not sure that is correct and I was expecting that the email notification is sent out when a new "Succeeded" condition is met, but this isn't the case.

The (email) Action Group works (tested), so it looks like around Threshold (set Equal or Larger than 1) or something else in the Condition.

Any help on this?

Thanks.

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-03T21:32:18.8333333+00:00
Hello @Andrea Guido@Andrea Guido

Azure Resource Graph does NOT have a native TimeGenerated column like Log Analytics.

What this means in practice:

The Alert rule time range (Last 24 hours) is NOT applied automatically

ARG returns all matching records, regardless of when the maintenance actually ran

Azure Monitor re-evaluates the same “Succeeded” rows every time

Since the result count is always >= 1, the alert never transitions from “false → true”, so no new email is sent

This is documented behavior for ARG-based alerts and is why you’re seeing:

Multiple old Succeeded rows

No alert trigger for “new” executions

Your Action Group is working, Your query is returning valid data and The alert condition is not time-bound

As a resolution you must explicitly filter on the maintenance execution time (startTime or endTime) inside the query.

Use properties.endTime as the time filter

This ensures only new executions within the alert window are returned.

arg("") maintenanceresources | where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates" | extend endTime = todatetime(properties.endTime) | where endTime >= ago(24h) | where tostring(properties.status) == "Succeeded" | project MaintenanceEndTime = endTime, Status = tostring(properties.status), MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId), CorrelationId = tostring(properties.correlationId)

To configure the Alert rule,

In Azure Monitor → Alerts → Condition:

Signal type: Custom log search

Data source: Azure Resource Graph

Query: use the query above

Time range: Last 24 hours

Frequency: Every 5 or 15 minutes

Threshold: Table rows ≥ 1

Now the alert only fires when a NEW “Succeeded” execution appears.

properties.endTime is written only when the maintenance finishes

Old executions fall outside ago(24h)

New execution → row count changes from 0 → 1

Azure Monitor detects the state change → email sent

This is the only supported way to alert on “new” Maintenance executions with ARG.

Azure Resource Graph does not apply the alert time range automatically. To trigger alerts only for new Maintenance Configuration executions, the query must explicitly filter on properties.endTime using ago().

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-03-04T14:31:56.64+00:00
Hi Suchitra,based on feedback received, it seems the following query is giving back the information we need:

arg("").maintenanceresources

| where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates"

| where properties.maintenanceConfigurationId == "maintenanceconfigurationID"

| extend endTime = todatetime(properties.endDateTime)

| where endTime >= ago(1d)

| where tostring(properties.status) == "Succeeded"

| project

MaintenanceEndTime = endTime, Status = tostring(properties.status), MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId), CorrelationId = tostring(properties.correlationId)

But, for any reason, the email is not delivered (Action Group tested successfully), do you see any reason?

Thanks.

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-04T19:16:29.5866667+00:00
Hello @Andrea Guido@Andrea Guido

You already validated this by testing it manually. So delivery, permissions, and email configuration are working correctly.

Azure Monitor log alerts (including Azure Resource Graph–based alerts) only fire when the condition changes from False → True.

If the condition is already true during the first evaluation, no alert is fired and no email is sent.

Azure Monitor alerts are state-based, not event-based. An alert fires when the condition is met and transitions from false to true.

What is happening in your case:

Your query:

Always returns ≥ 1 row (Succeeded executions already exist)

Threshold is set to “Table rows ≥ 1”

So the alert condition is already TRUE

There is no state change

Result: No alert, no email

Even though a new maintenance execution finishes, Azure Monitor sees:

“Condition was already true → still true → do nothing”

Why Time range = “Last 24 hours” doesn’t help:

For Azure Resource Graph alerts:

The alert time range is NOT automatically applied

ARG does not have TimeGenerated

Azure Monitor does not treat rows as events

You must filter by execution time inside the query

Reference: Azure Resource Graph returns the current state of resources, not event streams https://learn.microsoft.com/azure/governance/resource-graph/overview

You must ensure the query returns ZERO rows between executions, so the alert can reset.

Use a short lookback window on properties.endDateTime

Please use below shared query and check if it is helpfull or not:

arg("") | maintenanceresources | where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates" | extend endTime = todatetime(properties.endDateTime) | where endTime > ago(10m) | where tostring(properties.status) == "Succeeded" | project MaintenanceEndTime = endTime, Status = tostring(properties.status), MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId), CorrelationId = tostring(properties.correlationId)

Alert rule settings:

Evaluation frequency: 5 or 10 minutes

Time range: 10 minutes

Threshold: Table rows ≥ 1

Result:

Before execution → 0 rows (condition = False)

New execution finishes → 1 row appears (False → True)

Alert fires

Email sent

As a Best Practice Use Split by CorrelationId so each maintenance run triggers independently.

Azure Monitor alerts are state‑based and fire only when the condition transitions from false to true. Because Azure Resource Graph returns persisted maintenance execution records (not events), the query must explicitly filter on properties.endDateTime with a short lookback window. Once the query returns zero rows between executions, the alert will correctly trigger and the Action Group email will be delivered.

Thanks,
Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-05T09:50:31.1033333+00:00

Hello @Andrea Guido@Andrea Guido

Kindly let us know if the solution shared helped?

Thanks,
Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-05T20:05:32.56+00:00

Hello @Andrea Guido@Andrea Guido

We haven't heard back from you. Kindly let us know if the solution provided worked for you. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-03-06T09:56:57.06+00:00

Hi Suchitra,

unfortunately same issue: the query is able to return the MC session properly, but no email is sent out.

Threshold is correctly configured >=1, so I don'r get where the problem is.

Andrea

Suchitra Suregaunkar 9,495 Microsoft External Staff Moderator

Hello @Andrea Guido@Andrea Guido

From the screenshot resource ID column is Missing, so please update it and check if alert has been triggered or not?

User's image

In Alert logic → Split by dimensions:

Resource ID column → select ResourceId

You can use below query:

arg("")
| maintenanceresources
| where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates"
| where properties.maintenanceConfigurationId == "maintenanceconfigurationID"
| extend endTime = todatetime(properties.endDateTime)
| where endTime >= ago(10m)
| where tostring(properties.status) == "Succeeded"
| project
    ResourceId = tostring(id),
    MaintenanceEndTime = endTime,
    Status = tostring(properties.status),
    MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId),
    CorrelationId = tostring(properties.correlationId)

Once the query projects a Resource ID and the alert rule is configured to use it, the alert fires correctly and the Action Group email is delivered.

Thanks,

Suchitra.

Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-11T21:24:12.32+00:00

Hello @Andrea Guido@Andrea Guido

Have you got any chance to look into above comment?

Thanks,
Suchitra.

1 answer

Your answer

Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-20T03:00:28.93+00:00

Hello @Andrea Guido@Andrea Guido Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-02-20T10:41:38.4466667+00:00

Hi Suchitra,

unfortunately the 2 queries are not triggering the Maintenance Configuration start and stop (No results found even the MC has been executed).

Running the following query you see the Maintenance Configuration execution has been triggered in the same time range for the same Maintenance Configuration:

Shall we change the 2 provided queries to achieve our target?

Thanks for your help!

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-02-26T09:04:21.75+00:00

Hello @Andrea Guido@Andrea Guido Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-03-02T09:36:46.3266667+00:00

Hi Suchitra,

the query is retrieving all the Maintenance Configuration executions (Succeeded) even though the Time Range is 24 hours:

Not sure that is correct and I was expecting that the email notification is sent out when a new "Succeeded" condition is met, but this isn't the case.

The (email) Action Group works (tested), so it looks like around Threshold (set Equal or Larger than 1) or something else in the Condition.

Any help on this?

Thanks.

Andrea
Andrea Guido 0 Reputation points

2026-03-04T14:31:56.64+00:00

Hi Suchitra,based on feedback received, it seems the following query is giving back the information we need:

arg("").maintenanceresources

| where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates"

| where properties.maintenanceConfigurationId == "maintenanceconfigurationID"

| extend endTime = todatetime(properties.endDateTime)

| where endTime >= ago(1d)

| where tostring(properties.status) == "Succeeded"

| project

MaintenanceEndTime = endTime, Status = tostring(properties.status), MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId), CorrelationId = tostring(properties.correlationId)

But, for any reason, the email is not delivered (Action Group tested successfully), do you see any reason?

Thanks.

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-05T09:50:31.1033333+00:00

Hello @Andrea Guido@Andrea Guido

Kindly let us know if the solution shared helped?

Thanks,
Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-05T20:05:32.56+00:00

Hello @Andrea Guido@Andrea Guido

We haven't heard back from you. Kindly let us know if the solution provided worked for you. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,

Suchitra.
Andrea Guido 0 Reputation points

2026-03-06T09:56:57.06+00:00

Hi Suchitra,

unfortunately same issue: the query is able to return the MC session properly, but no email is sent out.

Threshold is correctly configured >=1, so I don'r get where the problem is.

Andrea
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-09T15:01:09.9+00:00

Hello @Andrea Guido@Andrea Guido

From the screenshot resource ID column is Missing, so please update it and check if alert has been triggered or not?

In Alert logic → Split by dimensions:

Resource ID column → select ResourceId

You can use below query:

arg("") | maintenanceresources | where type == "microsoft.maintenance/maintenanceconfigurations/applyupdates" | where properties.maintenanceConfigurationId == "maintenanceconfigurationID" | extend endTime = todatetime(properties.endDateTime) | where endTime >= ago(10m) | where tostring(properties.status) == "Succeeded" | project ResourceId = tostring(id), MaintenanceEndTime = endTime, Status = tostring(properties.status), MaintenanceConfigurationId = tostring(properties.maintenanceConfigurationId), CorrelationId = tostring(properties.correlationId)

Once the query projects a Resource ID and the alert rule is configured to use it, the alert fires correctly and the Action Group email is delivered.

Thanks,

Suchitra.
Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator

2026-03-11T21:24:12.32+00:00

Hello @Andrea Guido@Andrea Guido

Have you got any chance to look into above comment?

Thanks,
Suchitra.

Answer 1

To set up an Azure Update Manager alert rule that sends an email when a specific Maintenance Configuration starts and ends, you will need to create a custom Kusto query that targets the relevant maintenance configuration events. While the specific query for your use case isn't provided in the context, you can use the following approach to create your alert rule:

Identify the Maintenance Configuration: You need to know the specific maintenance configuration you want to monitor. This includes the resource ID or name of the configuration.

Create a Kusto Query: You can start with a query that filters maintenance events. For example, you could use a query similar to this:

   maintenanceresources  
   | where type =~ "microsoft.maintenance/maintenanceconfigurations/applyupdates"  
   | where properties.correlationId has "<your-maintenance-configuration-id>"
   | project startTime = properties.startTime, endTime = properties.endTime, status = properties.status

Replace <your-maintenance-configuration-id> with the actual ID of your maintenance configuration.

Set Up the Alert Rule: Once you have your query, you can proceed to create the alert rule in the Azure portal under Azure Update Manager. Follow the steps to create a new alert rule and use your Kusto query as the basis for the alert condition.
Configure Notifications: In the alert rule settings, ensure to configure the notification settings to send an email when the alert is triggered.

This should help you set up the alert for the specific maintenance configuration you are interested in.

Share via

Azure Update Manager - Configuration Maintenance Query

1 answer

Your answer