{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "slug": "dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition", "url": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/" }, "title": "Read the Windows VM creation flag before planning a patch-mode transition", "summary": "Can an existing Azure Windows VM switch freely between AutomaticByOS and Manual patch modes?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:31+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Azure Windows VMs using the documented supported platform images and reviewing patch-orchestration transitions.", "dse_recommendation": "Include enableAutomaticUpdates in the before-state record for a Windows patch-mode change.", "primary_source": { "name": "Automatic Guest Patching for Azure Virtual Machines and Scale Sets - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

An Azure Windows VM’s enableAutomaticUpdates property is set only when the VM is created. With that property false, Microsoft supports transitions between AutomaticByPlatform and Manual; with it true, transitions are between AutomaticByPlatform and AutomaticByOS. Switching between AutomaticByOS and Manual is unsupported. AutomaticByOS uses native Windows updates, while Manual disables them. Microsoft Learn.

\n

Applicability

\n

Use this check before planning the return path from platform-orchestrated guest patching. The source limits automatic guest patching to its listed platform-image combinations and excludes custom images, so validate the image as well as the Windows configuration.

\n

DSE recommendation

\n

Include enableAutomaticUpdates in the before-state record for a Windows patch-mode change. Have the patch owner identify the current value and the supported destination mode before approving the change. Record who will manage updates after platform orchestration is disabled. Do not assume that selecting a different label can override a creation-time property, and do not leave the replacement update mechanism unspecified.

\n

Verification

\n

In a representative approved test, compare the resource’s actual patch settings with the planned transition and inspect the resulting guest update configuration. Verify an authorized assessment or update outcome through the intended mechanism. If the requested transition is unsupported, redesign the plan rather than repeatedly editing the immutable flag. Preserve the selected mode and its operational owner in the maintenance record.

\n

Official references

\n

Microsoft Learn: Automatic Guest Patching for Azure Virtual Machines and Scale Sets. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAn Azure Windows VM’s enableAutomaticUpdates property is set only when the VM is created. With that property false, Microsoft supports transitions between AutomaticByPlatform and Manual; with it true, transitions are between AutomaticByPlatform and AutomaticByOS. Switching between AutomaticByOS and Manual is unsupported. AutomaticByOS uses native Windows updates, while Manual disables them. Microsoft Learn.\nApplicability\nUse this check before planning the return path from platform-orchestrated guest patching. The source limits automatic guest patching to its listed platform-image combinations and excludes custom images, so validate the image as well as the Windows configuration.\nDSE recommendation\nInclude enableAutomaticUpdates in the before-state record for a Windows patch-mode change. Have the patch owner identify the current value and the supported destination mode before approving the change. Record who will manage updates after platform orchestration is disabled. Do not assume that selecting a different label can override a creation-time property, and do not leave the replacement update mechanism unspecified.\nVerification\nIn a representative approved test, compare the resource’s actual patch settings with the planned transition and inspect the resulting guest update configuration. Verify an authorized assessment or update outcome through the intended mechanism. If the requested transition is unsupported, redesign the plan rather than repeatedly editing the immutable flag. Preserve the selected mode and its operational owner in the maintenance record.\nOfficial references\nMicrosoft Learn: Automatic Guest Patching for Azure Virtual Machines and Scale Sets. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAn Azure Windows VM’s enableAutomaticUpdates property is set only when the VM is created. With that property false, Microsoft supports transitions between AutomaticByPlatform and Manual; with it true, transitions are between AutomaticByPlatform and AutomaticByOS. Switching between AutomaticByOS and Manual is unsupported. AutomaticByOS uses native Windows updates, while Manual disables them. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching).\n\n## Applicability\n\nUse this check before planning the return path from platform-orchestrated guest patching. The source limits automatic guest patching to its listed platform-image combinations and excludes custom images, so validate the image as well as the Windows configuration.\n\n## DSE recommendation\n\nInclude enableAutomaticUpdates in the before-state record for a Windows patch-mode change. Have the patch owner identify the current value and the supported destination mode before approving the change. Record who will manage updates after platform orchestration is disabled. Do not assume that selecting a different label can override a creation-time property, and do not leave the replacement update mechanism unspecified.\n\n## Verification\n\nIn a representative approved test, compare the resource’s actual patch settings with the planned transition and inspect the resulting guest update configuration. Verify an authorized assessment or update outcome through the intended mechanism. If the requested transition is unsupported, redesign the plan rather than repeatedly editing the immutable flag. Preserve the selected mode and its operational owner in the maintenance record.\n\n## Official references\n\n[Microsoft Learn: Automatic Guest Patching for Azure Virtual Machines and Scale Sets](https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "url": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Read the Windows VM creation flag before planning a patch-mode transition", "item": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "url": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/", "headline": "Read the Windows VM creation flag before planning a patch-mode transition", "description": "Can an existing Azure Windows VM switch freely between AutomaticByOS and Manual patch modes?", "abstract": "Can an existing Azure Windows VM switch freely between AutomaticByOS and Manual patch modes?", "articleBody": "Source facts\nAn Azure Windows VM’s enableAutomaticUpdates property is set only when the VM is created. With that property false, Microsoft supports transitions between AutomaticByPlatform and Manual; with it true, transitions are between AutomaticByPlatform and AutomaticByOS. Switching between AutomaticByOS and Manual is unsupported. AutomaticByOS uses native Windows updates, while Manual disables them. Microsoft Learn.\nApplicability\nUse this check before planning the return path from platform-orchestrated guest patching. The source limits automatic guest patching to its listed platform-image combinations and excludes custom images, so validate the image as well as the Windows configuration.\nDSE recommendation\nInclude enableAutomaticUpdates in the before-state record for a Windows patch-mode change. Have the patch owner identify the current value and the supported destination mode before approving the change. Record who will manage updates after platform orchestration is disabled. Do not assume that selecting a different label can override a creation-time property, and do not leave the replacement update mechanism unspecified.\nVerification\nIn a representative approved test, compare the resource’s actual patch settings with the planned transition and inspect the resulting guest update configuration. Verify an authorized assessment or update outcome through the intended mechanism. If the requested transition is unsupported, redesign the plan rather than repeatedly editing the immutable flag. Preserve the selected mode and its operational owner in the maintenance record.\nOfficial references\nMicrosoft Learn: Automatic Guest Patching for Azure Virtual Machines and Scale Sets. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:31+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-025-read-the-windows-vm-creation-flag-before-planning-a-patch-mode-transition/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Read the Windows VM creation flag before planning a patch-mode transition" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Automatic Guest Patching for Azure Virtual Machines and Scale Sets - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching" } } ] } }