{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "slug": "dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement", "url": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/" }, "title": "Prepare scale-set workloads for automatic OS disk replacement", "summary": "What must be reproducible before an Azure scale set receives automatic OS image upgrades?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:34+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 255, "potentially_affected": "Operators considering automatic OS image upgrades for Azure Virtual Machine Scale Sets.", "dse_recommendation": "Prove that the application can be reconstructed from the scale-set model before enabling automatic image replacement.", "primary_source": { "name": "Automatic OS image upgrades with Azure Virtual Machine Scale Sets - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

An automatic OS image upgrade replaces each instance’s operating-system disk, reruns configured extensions and custom-data scripts, and preserves attached data disks. Microsoft requires the image version to be latest. Non-Service Fabric scale sets need application-health monitoring, using either the health extension or a load-balancer probe, not both. For multiple placement groups, the documented probe requirement specifies a Standard Load Balancer. Automatic image upgrades must not be combined with AutomaticByPlatform guest-patch orchestration. Microsoft Learn.

\n

Applicability

\n

Scope this readiness check to Uniform orchestration outside Service Fabric. The documentation identifies automatic OS upgrades for Flexible orchestration as preview and gives that mode additional restrictions. Check the supported image list before choosing the mechanism. Mode and image requirements.

\n

DSE recommendation

\n

Prove that the application can be reconstructed from the scale-set model before enabling automatic image replacement. Ask its owner to identify every change made manually inside an instance, then decide where each required setting or artifact will be maintained. Include bootstrap credentials and the intended data-disk attachment behavior in that review. Choose an application-health response that represents readiness to serve the actual workload.

\n

Verification

\n

Use an approved test scale set to observe an image transition. Compare the resulting application configuration with the declared model, exercise the service transaction, and record the health signal that allowed progression. Resolve missing customizations before expanding the rollout. Preserve upgrade-history evidence alongside the tested image reference; do not treat a deployment flag alone as acceptance.

\n

Official references

\n

Microsoft Learn: Automatic OS image upgrades with Azure Virtual Machine Scale Sets. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAn automatic OS image upgrade replaces each instance’s operating-system disk, reruns configured extensions and custom-data scripts, and preserves attached data disks. Microsoft requires the image version to be latest. Non-Service Fabric scale sets need application-health monitoring, using either the health extension or a load-balancer probe, not both. For multiple placement groups, the documented probe requirement specifies a Standard Load Balancer. Automatic image upgrades must not be combined with AutomaticByPlatform guest-patch orchestration. Microsoft Learn.\nApplicability\nScope this readiness check to Uniform orchestration outside Service Fabric. The documentation identifies automatic OS upgrades for Flexible orchestration as preview and gives that mode additional restrictions. Check the supported image list before choosing the mechanism. Mode and image requirements.\nDSE recommendation\nProve that the application can be reconstructed from the scale-set model before enabling automatic image replacement. Ask its owner to identify every change made manually inside an instance, then decide where each required setting or artifact will be maintained. Include bootstrap credentials and the intended data-disk attachment behavior in that review. Choose an application-health response that represents readiness to serve the actual workload.\nVerification\nUse an approved test scale set to observe an image transition. Compare the resulting application configuration with the declared model, exercise the service transaction, and record the health signal that allowed progression. Resolve missing customizations before expanding the rollout. Preserve upgrade-history evidence alongside the tested image reference; do not treat a deployment flag alone as acceptance.\nOfficial references\nMicrosoft Learn: Automatic OS image upgrades with Azure Virtual Machine Scale Sets. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAn automatic OS image upgrade replaces each instance’s operating-system disk, reruns configured extensions and custom-data scripts, and preserves attached data disks. Microsoft requires the image version to be latest. Non-Service Fabric scale sets need application-health monitoring, using either the health extension or a load-balancer probe, not both. For multiple placement groups, the documented probe requirement specifies a Standard Load Balancer. Automatic image upgrades must not be combined with AutomaticByPlatform guest-patch orchestration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade).\n\n## Applicability\n\nScope this readiness check to Uniform orchestration outside Service Fabric. The documentation identifies automatic OS upgrades for Flexible orchestration as preview and gives that mode additional restrictions. Check the supported image list before choosing the mechanism. [Mode and image requirements](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade).\n\n## DSE recommendation\n\nProve that the application can be reconstructed from the scale-set model before enabling automatic image replacement. Ask its owner to identify every change made manually inside an instance, then decide where each required setting or artifact will be maintained. Include bootstrap credentials and the intended data-disk attachment behavior in that review. Choose an application-health response that represents readiness to serve the actual workload.\n\n## Verification\n\nUse an approved test scale set to observe an image transition. Compare the resulting application configuration with the declared model, exercise the service transaction, and record the health signal that allowed progression. Resolve missing customizations before expanding the rollout. Preserve upgrade-history evidence alongside the tested image reference; do not treat a deployment flag alone as acceptance.\n\n## Official references\n\n[Microsoft Learn: Automatic OS image upgrades with Azure Virtual Machine Scale Sets](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "url": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Prepare scale-set workloads for automatic OS disk replacement", "item": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "url": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/", "headline": "Prepare scale-set workloads for automatic OS disk replacement", "description": "What must be reproducible before an Azure scale set receives automatic OS image upgrades?", "abstract": "What must be reproducible before an Azure scale set receives automatic OS image upgrades?", "articleBody": "Source facts\nAn automatic OS image upgrade replaces each instance’s operating-system disk, reruns configured extensions and custom-data scripts, and preserves attached data disks. Microsoft requires the image version to be latest. Non-Service Fabric scale sets need application-health monitoring, using either the health extension or a load-balancer probe, not both. For multiple placement groups, the documented probe requirement specifies a Standard Load Balancer. Automatic image upgrades must not be combined with AutomaticByPlatform guest-patch orchestration. Microsoft Learn.\nApplicability\nScope this readiness check to Uniform orchestration outside Service Fabric. The documentation identifies automatic OS upgrades for Flexible orchestration as preview and gives that mode additional restrictions. Check the supported image list before choosing the mechanism. Mode and image requirements.\nDSE recommendation\nProve that the application can be reconstructed from the scale-set model before enabling automatic image replacement. Ask its owner to identify every change made manually inside an instance, then decide where each required setting or artifact will be maintained. Include bootstrap credentials and the intended data-disk attachment behavior in that review. Choose an application-health response that represents readiness to serve the actual workload.\nVerification\nUse an approved test scale set to observe an image transition. Compare the resulting application configuration with the declared model, exercise the service transaction, and record the health signal that allowed progression. Resolve missing customizations before expanding the rollout. Preserve upgrade-history evidence alongside the tested image reference; do not treat a deployment flag alone as acceptance.\nOfficial references\nMicrosoft Learn: Automatic OS image upgrades with Azure Virtual Machine Scale Sets. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:34+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-022-prepare-scale-set-workloads-for-automatic-os-disk-replacement/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Prepare scale-set workloads for automatic OS disk replacement" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 255, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Automatic OS image upgrades with Azure Virtual Machine Scale Sets - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade" } } ] } }