Preserve Update Manager evidence before its query windows expire

Source facts

Microsoft’s Update Manager guidance specifies seven days of recent assessment history and 30 days of installation history available through Resource Graph. These are different windows; a report should not assume the longer installation window also covers assessments.

The documented assessment records distinguish an operation-level summary from individual available software updates. Installation records likewise distinguish the run summary from individual update results. Microsoft Learn.

Applicability

Identify the report’s required period, machine population, record types, and evidence owner. Separate a current assessment question from proof of an earlier installation; absence outside the query window should remain an evidence limitation.

DSE recommendation

DSE recommends exporting the required results before the shorter relevant window closes and retaining them under the organization’s approved evidence policy. Preserve machine identity, operation identity, record type, and timestamps so later reviewers can reconnect summary and per-update evidence. Make a missed export visible rather than filling the historical gap with current state.

Verification

Test retrieval for known assessment and installation operations, comparing summary rows with their per-update records. Check the report’s date boundaries and confirm an intentionally out-of-window query is labeled appropriately. Verify that the retained export remains readable and attributable after the live query no longer supplies the original records.

Official references

Microsoft Learn: Query Resources with Azure Resource Graph in Azure Update Manager. Source retrieved September 9, 2026.