Keep Azure Connected Machine agents inside their one-year support window

Source facts: Arc management has a locally installed lifecycle

Microsoft’s Connected Machine agent maintenance guidance says the agent is updated regularly for bug fixes, stability improvements, and new functionality. Azure Advisor can identify machines that are not using the latest version. Microsoft recommends the most recent release and states that the product group officially supports only Connected Machine agent versions released within the last year.

Windows and Linux use different delivery paths. Microsoft lists manual installation and Azure Update Manager for both platform families, Microsoft Update for Windows, and the appropriate apt, yum, or zypper package workflow for Linux. Installing, upgrading, or uninstalling the agent does not require a server restart. If a connected machine needs a specific older version, Microsoft instructs administrators to uninstall the current version and install the target version; the existing Arc connection does not need to be disconnected for that version change.

Windows Server does not check Microsoft Update for other Microsoft products by default. A server expected to receive the agent that way must be configured accordingly. Environments using WSUS or Configuration Manager must synchronize the Azure Connected Machine Agent product, including its suboptions, and approve the Critical Updates and Updates classifications. Linux machines need access to Microsoft’s package repository through the organization’s package-management design.

The absence of a reboot does not remove change risk. The installed agent carries the machine’s connection to Azure Arc and supports downstream management functions. A successful package transaction therefore needs a separate check that the resource reconnects and the intended Arc capabilities still operate.

DSE recommendation: manage version, connection, and function separately

Create one operational record for every Arc-enabled server and reconcile it with the Azure resource. Do not use resource existence as the sole health signal.

1. Inventory the control path. Record server owner, operating system, environment, Arc resource ID and region, Connected Machine agent version, connection state, outbound proxy, update authority, installed extensions, assigned policy, maintenance window, and last successful check-in.
2. Set an internal age limit. Calculate version age from Microsoft’s release history and remediate comfortably before the one-year support boundary. Give every freeze or compatibility exception an owner, justification, expiry date, and tested recovery plan.
3. Prove delivery. For Windows, verify that Microsoft Update or the organization’s approved WSUS, Configuration Manager, or Azure Update Manager path includes the Connected Machine agent. For Linux, verify repository configuration, trust, package visibility, proxy behavior, and the intended automated or controlled approval process.
4. Pilot representative servers. Include each supported operating-system family, proxy route, network zone, extension pattern, update tool, and important workload class. Capture the pre-change version and connection state, package result, setup or package-manager log, post-change version, and elapsed reconnection time.
5. Test the service after the package. Confirm the Arc resource is connected, inventory is current, assigned policy reports, expected extensions remain healthy, remote management used by the organization works, and monitoring has not gone silent. Application checks remain necessary even when no restart occurs.
6. Reconcile failure states. Alert on disconnected agents, unsupported versions, repeated upgrade failures, missing repositories or update products, proxy errors, duplicate or abandoned Arc resources, and machines that no longer have an accountable owner.

Track the percentage on the approved release, oldest version age, disconnected duration, upgrade success by platform, exception age, and the time between a successful package installation and a healthy Arc check-in. Keep agent upgrades in the same maintenance register as operating-system and extension changes, while preserving their separate status. The useful result is a management channel that remains supported and demonstrably functional—not merely an Azure inventory row that still has a familiar server name.

Official references

• Microsoft Learn, Manage Azure Connected Machine agent versions for Azure Arc-enabled servers, April 28, 2026.
• Microsoft Learn, What’s new with the Azure Connected Machine agent; release history reviewed August 11, 2026.