WSUS is deprecated, not shutting down overnight
Microsoft is no longer developing new WSUS features. The role remains supported for production deployments and receives security and quality updates according to the product lifecycle. Deprecation is therefore neither a universal shutdown date nor a reason to hastily uninstall a server that still distributes patches.
The real decision separates three needs: obtaining updates, deciding when to install them, and proving that systems work afterward. Azure Update Manager mainly addresses the latter two. A successful transition can start by retaining WSUS as the source.
What Azure Update Manager replaces — and what it does not
Update Manager targets Windows and Linux server operating systems. For Windows 10/11 endpoints, plan a separate strategy using Intune or Windows Autopatch according to eligibility. Do not extend a server patching project to the entire WSUS fleet without separating these populations.
The modern service does not require Azure Automation, Log Analytics or Azure Monitor Agent for its core capabilities. It uses machine extensions; servers outside Azure connect through Azure Arc.
| Component | Responsibility | Important distinction |
|---|---|---|
| WSUS | Local Windows update source, approvals and distribution | An Azure schedule does not automatically transfer these rules |
| Azure Arc | Connect and manage servers outside Azure | VMs remain on their existing infrastructure |
| Azure Update Manager | Patch assessment and orchestration | Not a download repository or cache |
| Windows Update or Linux package manager | Find and install updates from the configured source | Repositories and connectivity remain necessary |
1. Prepare scope and connectivity
Inventory operating systems, versions, Azure regions, applications, allowed reboots, criticality, patch sources and owners. Check supported systems against Microsoft's prerequisites; appearing in Arc does not automatically make a machine eligible for every Update Manager capability.
The Connected Machine agent needs the documented Azure destinations, generally over outbound HTTPS. Windows and Linux downloads also require their own destinations. A working Arc proxy does not prove that WSUS, Microsoft Update or Linux repositories are reachable.
Keep a virtualization console or an independent recovery access path. In a network genuinely isolated from Azure, cloud-based management is not a direct replacement for local management.
- Verify required resource providers, including Microsoft.HybridCompute and Microsoft.Maintenance, with the Azure team.
- Test DNS, proxy, certificates, disk space and package-manager health before installing the first patch.
- Do not expose an inbound Internet port on a server solely for the Arc agent.
2. Keep WSUS initially and control Group Policy
On an Arc server, Update Manager does not replace Windows Update registry settings. Initially retain WSUS and its approvals while handing the installation window to the new tool. Review source, automatic installation and restart GPOs: they can conflict with Azure scheduling.
The Specify intranet Microsoft update service location policy is under Computer Configuration > Administrative Templates > Windows Components > Windows Update; subfolders vary with ADMX versions. Remove that configuration only in a separate phase after validating access to the new source.
Missing registry keys are not sufficient to establish the entire effective configuration. Also inspect resultant policy and run a real assessment. If Configuration Manager manages patching, remove that responsibility for the pilot before handing control to Update Manager; do not leave competing orchestrators.
Get-Service wuauserv,bits | Select-Object Name,Status,StartType
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
-ErrorAction SilentlyContinue | Select-Object WUServer,WUStatusServer
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
-ErrorAction SilentlyContinue | Select-Object UseWUServer,AUOptions
& "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" show3. Start with assessment, not installation
In Azure Update Manager > Machines, select a small group and run Check for updates. Review errors before enabling Periodic assessment. Periodic assessment checks for updates approximately every 24 hours; it is not an authorization to install them.
Azure Policy can enable this setting at scale. Choose the definition for Azure Arc-enabled servers, restrict its assignment to the pilot resource group and review Windows/Linux parameters. A remediation task handles existing resources. Review its managed identity permissions instead of unnecessarily widening scope.
A clean assessment means the consulted source reports no missing applicable updates. It proves neither absence of vulnerabilities nor business application health.
4. Create an operationally useful maintenance window
Under Schedule updates, create a Maintenance Configuration with Guest scope (InGuestPatch). Define time zone, recurrence, duration, selected classifications or KBs/packages, and restart behaviour. Customer Managed Schedules is a prerequisite for Azure VMs; Arc servers do not require that orchestration setting.
A window does not abruptly terminate an installation already in progress. Allow time for downloads, reboots and tests; examine partial runs. Never reboot does not neutralize every other operating-system restart policy.
- Example design: weekday pilot, application servers after validation, databases and critical infrastructure in separate windows.
- Do not assume one schedule understands SQL Always On, clusters or application ordering: explicitly arrange failover, draining and health checks.
- Name the person who approves the next wave and the person who responds when a service fails to return.
5. Use dynamic scopes without surprises
A dynamic scope selects machines by subscription, resource group, location, OS and tags. Selection is recalculated at execution time: the preview is not a frozen list.
For example, use PatchRing=Pilot and Owner=Infrastructure. Changing a tag then becomes an operational change. Restrict who can do so, review static and dynamic assignments, and avoid overlapping windows.
resources
| where type =~ 'microsoft.hybridcompute/machines'
| project name, resourceGroup, location,
ArcStatus=tostring(properties.status),
PatchRing=tostring(tags.PatchRing),
Owner=tostring(tags.Owner)
| order by PatchRing asc, name asc6. Delegate operations without making everyone an Owner
Separate reading results, triggering assessment, installing patches and changing windows. For Arc, assessPatches/action and installPatches/action are under Microsoft.HybridCompute/machines; configurations and assignments are under Microsoft.Maintenance.
Built-in roles may exceed actual needs. Build a custom role from Microsoft's permission matrix where appropriate, then test both an allowed and a forbidden operation. Also protect Azure administrative accounts with suitable MFA and Conditional Access.
7. Budget before enabling the whole fleet
Azure VMs have no additional Update Manager charge. For other Arc servers, billing depends on connected and managed days: an assessment or schedule association can count even when no patch is installed.
Exemptions exist for certain Defender for Servers Plan 2, ESU and eligible Windows Server Software Assurance or subscription scenarios. Validate the exact conditions, including onboarding method and activated benefits; free Arc connectivity does not mean every connected service is free.
For budgeting, use billable server count × applicable rate × prorated usage. Illustration only: 40 servers at a hypothetical USD 5/month rate yield USD 200/month before other services and CAD conversion. Confirm contractual pricing in the Azure calculator and review Cost Management during the pilot.
8. Document Windows, Linux and service limitations
On Linux, validate configured repositories, subscriptions, and any package locks or competing automatic update tools. A package absent from its repository does not become available because the server is connected to Arc. Separate Windows and Linux rings when their tests and constraints differ.
Update Manager does not distribute patches itself or replace a general software deployment platform. Application updates depend on their availability in supported sources. Driver installation is unsupported; maintain a separate process for firmware, drivers and major upgrades.
9. Validate, retain evidence and prepare rollback
Returning to the previous orchestrator means removing pilot assignments, preventing Policy from recreating them and restoring documented settings. This does not uninstall patches already applied. Removal depends on the update and operating system; for major failures, plan a tested, application-consistent restore, not just a snapshot.
Review errors, remaining updates and pending reboots, then test the application. Resource Graph retains assessments for 7 days and installation results for 30 days: export evidence when policy requires longer retention. A server missing from the report must not be considered compliant.
| Phase | Validation | Stop condition |
|---|---|---|
| Observation | Consistent source and assessment | Disconnected agent or incomplete inventory |
| Pilot | Successful installation, reboot and business transaction | Application failure or excessive duration |
| Expansion | Owner approves the next wave | Uncontrolled dependency or window |
| Source change | Updates accessible without WSUS | Network block or missing category |
| WSUS retirement | No dependent clients remain; evidence retained | Forgotten endpoints or servers |
Modernize control before removing the source
The first milestone can be modest: a few visible servers, a reliable window and a repeatable business test. Remove WSUS afterward if dependencies, bandwidth and control requirements allow it.
For a critical fleet, consulting should primarily clarify responsibilities, rings, exceptions and recovery. Choosing a portal does not replace this preparation.
About the author
Marc-Antoine Lambert
Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.
Discuss your environment →