Maximizing Your Security with Azure Update Management

Azure Update Management also provides support for Azure Log Analytics Workspaces as well as deployment schedules for software patches and updates. With its comprehensive features, users can configure guest patching settings, determine which updates should be installed on specific machines, create custom classifications for software updates, and more. Additionally, Azure Automation Update Management integrates with Azure Log Analytics and Azure Monitor to provide complete visibility into update installation activities within an organization’s environment.

Key Features of Azure Update Management

• Centralized solution for managing updates to VMs: Azure Update Management provides a centralized solution for managing updates to VMs in Azure or on-premises. This allows administrators to easily manage updates from a single location rather than manually updating each VM.
• Automated process for installing updates: The solution automates the process of installing updates to VMs, reducing the workload for administrators and improving efficiency.
• Scheduling update installations: Administrators can schedule update installations to be performed during a maintenance window or at a convenient time for their organization.
• Specifying updates to install or skip: Azure Update Management also allows administrators to specify which updates to install or skip, providing more control over the update process and ensuring that only necessary updates are installed.
• Support for Windows and Linux machines: you can centrally manage all your servers and no need for separate solutions for non-windows machines.
• Pre and Post Activities: Update Management is built on Azure Automation and this allows us to define custom actions before the installation of the update and after. If needed, you can extend the Runbooks even to your on-premises using the Azure Automation Hybrid Runbook Worker.

Prerequisites

Before configuring Update Management, it’s important to understand the prerequisites that must be in place.

• Azure Automation Account
• Azure Log Analytics Workspace
  • All data will be stored in the Azure Log Analytics workspace
• An Azure Subscription
  • Permissions to deploy resources and services to that service
• One or more virtual machines (VMs) running in Azure or on-premises
• Azure Update Management integrates with the following solutions. These are all optional integrations:
  • Configuration Manager (SCCM)
  • Windows Server Update Services (WSUS)
  • Active Directory
  • Windows Admin Center

Setting Up Update Management

Setting up Azure Update Management is a straightforward process and can help organizations ensure that their Azure resources are running smoothly, securely and optimally.

Create a Resource Group

1. Log in to the Azure portal (portal.azure.com).
2. Click the “Create a resource” button (+) in the upper-left corner of the screen.
3. In the “New” page, search for “Resource group” in the search box and select “Resource group” from the results.
4. In the “Resource Group” page, click the “Create” button.
5. In the “Basics” tab, fill in the following information:
6. Subscription: select the subscription that you want to use for the resource group.
7. Resource group: enter a unique name for your resource group, for example, RG-PROD-AZ-UPDATE-MGMT-WE
8. Region: select the region where you want to create the resource group.
9. Click the “Review + create” button to go to the “Review + create” tab.
10. Review the settings and click the “Create” button to create the resource group.
11. Once the resource group is created, you can see it listed in the “Resource groups” section of the Azure portal.

Create an Automation Account

1. Log in to the Azure portal (portal.azure.com)
2. Click the “Create a resource” button (+) in the upper-left corner of the screen
3. Search for “Automation” in the search box and select “Automation” from the results
4. Click the “Create” button
5. Fill in the required information

• • Subscription
  • Resource Group
  • Name – for example, PROD-IT-SRV-PATCHING-WE
  • Region

6. Click the “Review + create” button to go to the “Review + create” tab.
7. Click “Create” to create the Automation account.

Create a Log Analytics Workspace

1. Log in to the Azure portal (portal.azure.com).
2. Click the “Create a resource” button (+) in the upper-left corner of the screen.
3. In the “New” page, search for “Log Analytics workspace” in the search box and select “Log Analytics workspace” from the results.
4. In the “Log Analytics workspace” page, click the “Create” button.
5. In the “Basics” tab, fill in the following information:

• • Subscription: select the subscription that you want to use for the Log Analytics workspace.
  • Resource group: use the same resource group that you created for Azure Automation Account, RG-PROD-AZ-UPDATE-MGMT-WE
  • Workspace name: enter a unique name for your Log Analytics workspace. For example, PROD-LAW-WE
  • Region: select the region where you want to create the Log Analytics workspace.

6. Click the “Review + create” button to go to the “Review + create” tab.

7. Review the settings and click the “Create” button to create the Log Analytics workspace.

8. Once the workspace is created, you can see it listed in the “Log Analytics workspaces” section of the Azure portal.

Enable Update Management

Once you have an Automation account, you can enable Update Management. Here are the steps to do so:

1. Open your Automation account, i.e. ROD-IT-SRV-PATCHING-WE
2. Click “Update Management” in the left-hand menu
3. Choose the Subscription and Log Analytics Workspace
4. Click the “Enable” button