{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "slug": "dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision", "url": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/" }, "title": "Make Update Manager pre-check failure trigger an explicit cancellation decision", "summary": "Do not assume a failed pre-event handler automatically stops the scheduled patch run.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:13+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "Azure Update Manager maintenance configurations using pre-event runbooks or Azure Functions.", "dse_recommendation": "Build and test the cancellation path before depending on a pre-event as a patching gate.", "primary_source": { "name": "Manage the pre and post maintenance configuration events in Azure Update Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says a pre-event’s cancellation API call must occur at least ten minutes before the scheduled maintenance starts. Update Manager does not monitor the customer’s pre-check and automatically cancel for it; without cancellation, scheduled installation proceeds.

\n

The documentation separately describes system cancellation when an internal error prevents delivery of the pre-event. That delivery-failure behavior should not be confused with cancellation after a customer’s readiness check fails. Microsoft Learn.

\n

Applicability

\n

Identify the maintenance configuration, pre-event endpoint, run identity, readiness criteria and cancellation owner. Review the full event-handling procedure and timing before using a business readiness check to control a production patch window.

\n

DSE recommendation

\n

DSE recommends an explicit branch from failed readiness to the documented cancellation action, with evidence that the correct run was targeted. Define what operators should do if the decision or cancellation occurs too late. Make the failure visible outside the script’s own log and require an owner to resolve an uncertain cancellation result.

\n

Verification

\n

In an approved test schedule, exercise successful readiness, failed readiness with timely cancellation, and a missed cancellation deadline. Compare handler evidence with the maintenance run’s actual status and machine results. Do not accept a failed script job as proof the patch run stopped. Preserve the run identity, decision time, cancellation response and observed outcome as separate evidence.

\n

Official references

\n

Microsoft Learn: Manage the pre and post maintenance configuration events in Azure Update Manager. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft says a pre-event’s cancellation API call must occur at least ten minutes before the scheduled maintenance starts. Update Manager does not monitor the customer’s pre-check and automatically cancel for it; without cancellation, scheduled installation proceeds.\nThe documentation separately describes system cancellation when an internal error prevents delivery of the pre-event. That delivery-failure behavior should not be confused with cancellation after a customer’s readiness check fails. Microsoft Learn.\nApplicability\nIdentify the maintenance configuration, pre-event endpoint, run identity, readiness criteria and cancellation owner. Review the full event-handling procedure and timing before using a business readiness check to control a production patch window.\nDSE recommendation\nDSE recommends an explicit branch from failed readiness to the documented cancellation action, with evidence that the correct run was targeted. Define what operators should do if the decision or cancellation occurs too late. Make the failure visible outside the script’s own log and require an owner to resolve an uncertain cancellation result.\nVerification\nIn an approved test schedule, exercise successful readiness, failed readiness with timely cancellation, and a missed cancellation deadline. Compare handler evidence with the maintenance run’s actual status and machine results. Do not accept a failed script job as proof the patch run stopped. Preserve the run identity, decision time, cancellation response and observed outcome as separate evidence.\nOfficial references\nMicrosoft Learn: Manage the pre and post maintenance configuration events in Azure Update Manager. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft says a pre-event’s cancellation API call must occur at least ten minutes before the scheduled maintenance starts. Update Manager does not monitor the customer’s pre-check and automatically cancel for it; without cancellation, scheduled installation proceeds.\n\nThe documentation separately describes system cancellation when an internal error prevents delivery of the pre-event. That delivery-failure behavior should not be confused with cancellation after a customer’s readiness check fails. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events).\n\n## Applicability\n\nIdentify the maintenance configuration, pre-event endpoint, run identity, readiness criteria and cancellation owner. Review the full event-handling procedure and timing before using a business readiness check to control a production patch window.\n\n## DSE recommendation\n\nDSE recommends an explicit branch from failed readiness to the documented cancellation action, with evidence that the correct run was targeted. Define what operators should do if the decision or cancellation occurs too late. Make the failure visible outside the script’s own log and require an owner to resolve an uncertain cancellation result.\n\n## Verification\n\nIn an approved test schedule, exercise successful readiness, failed readiness with timely cancellation, and a missed cancellation deadline. Compare handler evidence with the maintenance run’s actual status and machine results. Do not accept a failed script job as proof the patch run stopped. Preserve the run identity, decision time, cancellation response and observed outcome as separate evidence.\n\n## Official references\n\n[Microsoft Learn: Manage the pre and post maintenance configuration events in Azure Update Manager](https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "url": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Make Update Manager pre-check failure trigger an explicit cancellation decision", "item": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "url": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/", "headline": "Make Update Manager pre-check failure trigger an explicit cancellation decision", "description": "Do not assume a failed pre-event handler automatically stops the scheduled patch run.", "abstract": "Do not assume a failed pre-event handler automatically stops the scheduled patch run.", "articleBody": "Source facts\nMicrosoft says a pre-event’s cancellation API call must occur at least ten minutes before the scheduled maintenance starts. Update Manager does not monitor the customer’s pre-check and automatically cancel for it; without cancellation, scheduled installation proceeds.\nThe documentation separately describes system cancellation when an internal error prevents delivery of the pre-event. That delivery-failure behavior should not be confused with cancellation after a customer’s readiness check fails. Microsoft Learn.\nApplicability\nIdentify the maintenance configuration, pre-event endpoint, run identity, readiness criteria and cancellation owner. Review the full event-handling procedure and timing before using a business readiness check to control a production patch window.\nDSE recommendation\nDSE recommends an explicit branch from failed readiness to the documented cancellation action, with evidence that the correct run was targeted. Define what operators should do if the decision or cancellation occurs too late. Make the failure visible outside the script’s own log and require an owner to resolve an uncertain cancellation result.\nVerification\nIn an approved test schedule, exercise successful readiness, failed readiness with timely cancellation, and a missed cancellation deadline. Compare handler evidence with the maintenance run’s actual status and machine results. Do not accept a failed script job as proof the patch run stopped. Preserve the run identity, decision time, cancellation response and observed outcome as separate evidence.\nOfficial references\nMicrosoft Learn: Manage the pre and post maintenance configuration events in Azure Update Manager. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:13+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Make Update Manager pre-check failure trigger an explicit cancellation decision" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage the pre and post maintenance configuration events in Azure Update Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events" } } ] } }