Read the Windows VM creation flag before planning a patch-mode transition

Source facts

An Azure Windows VM’s enableAutomaticUpdates property is set only when the VM is created. With that property false, Microsoft supports transitions between AutomaticByPlatform and Manual; with it true, transitions are between AutomaticByPlatform and AutomaticByOS. Switching between AutomaticByOS and Manual is unsupported. AutomaticByOS uses native Windows updates, while Manual disables them. Microsoft Learn.

Applicability

Use this check before planning the return path from platform-orchestrated guest patching. The source limits automatic guest patching to its listed platform-image combinations and excludes custom images, so validate the image as well as the Windows configuration.

DSE recommendation

Include enableAutomaticUpdates in the before-state record for a Windows patch-mode change. Have the patch owner identify the current value and the supported destination mode before approving the change. Record who will manage updates after platform orchestration is disabled. Do not assume that selecting a different label can override a creation-time property, and do not leave the replacement update mechanism unspecified.

Verification

In a representative approved test, compare the resource’s actual patch settings with the planned transition and inspect the resulting guest update configuration. Verify an authorized assessment or update outcome through the intended mechanism. If the requested transition is unsupported, redesign the plan rather than repeatedly editing the immutable flag. Preserve the selected mode and its operational owner in the maintenance record.

Official references

Microsoft Learn: Automatic Guest Patching for Azure Virtual Machines and Scale Sets. Source reviewed September 9, 2026.