{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "slug": "dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades", "url": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/" }, "title": "Separate extension install-time version selection from ongoing Azure upgrades", "summary": "Why are AutoUpgradeMinorVersion and EnableAutomaticUpgrade separate decisions for an Azure VM extension?", "format": { "slug": "explainer", "name": "Explainer" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:32+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Operators configuring supported extensions on Azure virtual machines or virtual machine scale sets.", "dse_recommendation": "Record the creation-time and ongoing-upgrade settings separately for each extension, with an explicit major-version change owner.", "primary_source": { "name": "Automatic Extension Upgrade for VMs and scale sets in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-extension-upgrade", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

AutoUpgradeMinorVersion selects the latest stable minor extension version during VM creation or a configuration update. EnableAutomaticUpgrade governs later upgrades on existing VMs instead. Neither setting automatically crosses a major-version boundary. Each supported extension is enrolled separately. For a scale set using manual upgrade mode, changing its model does not propagate the setting to existing instances without an instance update. Microsoft Learn.

\n

Applicability

\n

Review the extension’s publisher, type, configured version, and automatic-upgrade support before deciding its policy. Distinguish an individual Azure VM from a scale-set model and its currently deployed instances. Do not use an extension-version decision as the approval for an operating-system image replacement.

\n

DSE recommendation

\n

Record the creation-time and ongoing-upgrade settings separately for each extension, with an explicit major-version change owner. Ask that owner to explain any pinned minor version and the condition for removing the pin. For manually managed scale sets, add a deliberate instance-update step to the change record rather than stopping after the model edit. Keep exceptions extension-specific instead of assigning one unexplained fleet-wide value.

\n

Verification

\n

Inspect the configured properties and the installed version on a representative existing instance and on an approved newly created instance. Compare both observations with the intended policy. Where a manual scale-set update is needed, confirm propagation on each targeted instance. Preserve failures and version mismatches for investigation; absence of a major-version change is not evidence that the minor-version controls failed.

\n

Official references

\n

Microsoft Learn: Automatic Extension Upgrade for VMs and scale sets in Azure. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAutoUpgradeMinorVersion selects the latest stable minor extension version during VM creation or a configuration update. EnableAutomaticUpgrade governs later upgrades on existing VMs instead. Neither setting automatically crosses a major-version boundary. Each supported extension is enrolled separately. For a scale set using manual upgrade mode, changing its model does not propagate the setting to existing instances without an instance update. Microsoft Learn.\nApplicability\nReview the extension’s publisher, type, configured version, and automatic-upgrade support before deciding its policy. Distinguish an individual Azure VM from a scale-set model and its currently deployed instances. Do not use an extension-version decision as the approval for an operating-system image replacement.\nDSE recommendation\nRecord the creation-time and ongoing-upgrade settings separately for each extension, with an explicit major-version change owner. Ask that owner to explain any pinned minor version and the condition for removing the pin. For manually managed scale sets, add a deliberate instance-update step to the change record rather than stopping after the model edit. Keep exceptions extension-specific instead of assigning one unexplained fleet-wide value.\nVerification\nInspect the configured properties and the installed version on a representative existing instance and on an approved newly created instance. Compare both observations with the intended policy. Where a manual scale-set update is needed, confirm propagation on each targeted instance. Preserve failures and version mismatches for investigation; absence of a major-version change is not evidence that the minor-version controls failed.\nOfficial references\nMicrosoft Learn: Automatic Extension Upgrade for VMs and scale sets in Azure. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAutoUpgradeMinorVersion selects the latest stable minor extension version during VM creation or a configuration update. EnableAutomaticUpgrade governs later upgrades on existing VMs instead. Neither setting automatically crosses a major-version boundary. Each supported extension is enrolled separately. For a scale set using manual upgrade mode, changing its model does not propagate the setting to existing instances without an instance update. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-extension-upgrade).\n\n## Applicability\n\nReview the extension’s publisher, type, configured version, and automatic-upgrade support before deciding its policy. Distinguish an individual Azure VM from a scale-set model and its currently deployed instances. Do not use an extension-version decision as the approval for an operating-system image replacement.\n\n## DSE recommendation\n\nRecord the creation-time and ongoing-upgrade settings separately for each extension, with an explicit major-version change owner. Ask that owner to explain any pinned minor version and the condition for removing the pin. For manually managed scale sets, add a deliberate instance-update step to the change record rather than stopping after the model edit. Keep exceptions extension-specific instead of assigning one unexplained fleet-wide value.\n\n## Verification\n\nInspect the configured properties and the installed version on a representative existing instance and on an approved newly created instance. Compare both observations with the intended policy. Where a manual scale-set update is needed, confirm propagation on each targeted instance. Preserve failures and version mismatches for investigation; absence of a major-version change is not evidence that the minor-version controls failed.\n\n## Official references\n\n[Microsoft Learn: Automatic Extension Upgrade for VMs and scale sets in Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-extension-upgrade). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "url": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate extension install-time version selection from ongoing Azure upgrades", "item": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "url": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/", "headline": "Separate extension install-time version selection from ongoing Azure upgrades", "description": "Why are AutoUpgradeMinorVersion and EnableAutomaticUpgrade separate decisions for an Azure VM extension?", "abstract": "Why are AutoUpgradeMinorVersion and EnableAutomaticUpgrade separate decisions for an Azure VM extension?", "articleBody": "Source facts\nAutoUpgradeMinorVersion selects the latest stable minor extension version during VM creation or a configuration update. EnableAutomaticUpgrade governs later upgrades on existing VMs instead. Neither setting automatically crosses a major-version boundary. Each supported extension is enrolled separately. For a scale set using manual upgrade mode, changing its model does not propagate the setting to existing instances without an instance update. Microsoft Learn.\nApplicability\nReview the extension’s publisher, type, configured version, and automatic-upgrade support before deciding its policy. Distinguish an individual Azure VM from a scale-set model and its currently deployed instances. Do not use an extension-version decision as the approval for an operating-system image replacement.\nDSE recommendation\nRecord the creation-time and ongoing-upgrade settings separately for each extension, with an explicit major-version change owner. Ask that owner to explain any pinned minor version and the condition for removing the pin. For manually managed scale sets, add a deliberate instance-update step to the change record rather than stopping after the model edit. Keep exceptions extension-specific instead of assigning one unexplained fleet-wide value.\nVerification\nInspect the configured properties and the installed version on a representative existing instance and on an approved newly created instance. Compare both observations with the intended policy. Where a manual scale-set update is needed, confirm propagation on each targeted instance. Preserve failures and version mismatches for investigation; absence of a major-version change is not evidence that the minor-version controls failed.\nOfficial references\nMicrosoft Learn: Automatic Extension Upgrade for VMs and scale sets in Azure. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:32+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-024-separate-extension-install-time-version-selection-from-ongoing-azure-upgrades/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate extension install-time version selection from ongoing Azure upgrades" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Explainer", "Information priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Automatic Extension Upgrade for VMs and scale sets in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-extension-upgrade" } } ] } }