Tutorial: Schedule updates on Dynamic scopes

Applies to: ✔️ Windows VMs ✔️ Linux VMs ✔️ On-premises environment ✔️ Azure VMs ✔️ Azure Arc-enabled servers.

This tutorial explains how you can create a dynamic scope, and apply patches based on the criteria.

In this tutorial, you learn how to:

• Create and edit groups
• Associate a schedule

If you don't have an Azure subscription, create a free account before you begin.

Prerequisites

Azure VMs

• Patch Orchestration must be set to Customer Managed Schedules. This sets patch mode to AutomaticByPlatform and the BypassPlatformSafetyChecksOnUserSchedule = True.
• Associate a Schedule with the VM.

Arc-enabled VMs

There are no prerequisites for patch orchestration. However, you must associate a schedule with the VM for Schedule patching. For more information, see Configure schedule patching on Azure VMs to ensure business continuity.

Create a Dynamic scope

To create a dynamic scope, follow these steps:

Azure portal

1. Sign in to the Azure portal and navigate to Azure Update Manager.
2. Select Overview > Schedule updates > Create a maintenance configuration.
3. In the Create a maintenance configuration page, enter the details in the Basics tab and select Maintenance scope as Guest (Azure VM, Arc-enabled VMs/servers).
4. Select Dynamic Scopes and follow the steps to Add Dynamic scope.
5. In Machines tab, select Add machines to add any individual machines to the maintenance configuration and select Updates.
6. In the Updates tab, select the patch classification that you want to include/exclude and select Tags.
7. Provide the tags in Tags tab.
8. Select Review and then Review + Create.

Note

A dynamic scope exists within the context of a schedule only. You can use one schedule to link to a machine, dynamic scope, or both. One dynamic scope cannot have more than one schedule.

Azure CLI

    az maintenance assignment create-or-update-subscription --maintenance-configuration-id "/subscriptions/{subscription_id}/resourcegroups/{rg}/providers/Microsoft.Maintenance/maintenanceConfigurations/clitestmrpconfinguestadvanced" --name cli_dynamicscope_recording01 --filter-locations eastus2euap centraluseuap --filter-os-types windows linux --filter-tags {{tagKey1:[tagKey1Val1,tagKey1Val2],tagKey2:[tagKey2Val1,tagKey2Val2]}} --filter-resource-group rg1, rg2 --filter-tags-operator All -l global

PowerShell

    New-AzConfigurationAssignment -ConfigurationAssignmentName $maintenanceConfigurationName -MaintenanceConfigurationId $maintenanceConfigurationInGuestPatchCreated.Id -FilterLocation eastus2euap,centraluseuap -FilterOsType Windows,Linux -FilterTag '{"tagKey1" : ["tagKey1Value1", "tagKey1Value2"], "tagKey2" : ["tagKey2Value1", "tagKey2Value2", "tagKey2Value3"] }' -FilterOperator "Any"

Provide the consent

Obtaining consent to apply updates is an important step in the workflow of scheduled patching and follow the steps on various ways to provide the consent.

Next steps

Learn about managing multiple machines.