# Make Update Manager pre-check failure trigger an explicit cancellation decision

> Do not assume a failed pre-event handler automatically stops the scheduled patch run.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:13+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Do not assume a failed pre-event handler automatically stops the scheduled patch run.

## Potentially affected

Azure Update Manager maintenance configurations using pre-event runbooks or Azure Functions.

## DSE recommendation

Build and test the cancellation path before depending on a pre-event as a patching gate.

## Article

## Source facts

Microsoft says a pre-event’s cancellation API call must occur at least ten minutes before the scheduled maintenance starts. Update Manager does not monitor the customer’s pre-check and automatically cancel for it; without cancellation, scheduled installation proceeds.

The documentation separately describes system cancellation when an internal error prevents delivery of the pre-event. That delivery-failure behavior should not be confused with cancellation after a customer’s readiness check fails. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events).

## Applicability

Identify the maintenance configuration, pre-event endpoint, run identity, readiness criteria and cancellation owner. Review the full event-handling procedure and timing before using a business readiness check to control a production patch window.

## DSE recommendation

DSE recommends an explicit branch from failed readiness to the documented cancellation action, with evidence that the correct run was targeted. Define what operators should do if the decision or cancellation occurs too late. Make the failure visible outside the script’s own log and require an owner to resolve an uncertain cancellation result.

## Verification

In an approved test schedule, exercise successful readiness, failed readiness with timely cancellation, and a missed cancellation deadline. Compare handler evidence with the maintenance run’s actual status and machine results. Do not accept a failed script job as proof the patch run stopped. Preserve the run identity, decision time, cancellation response and observed outcome as separate evidence.

## Official references

[Microsoft Learn: Manage the pre and post maintenance configuration events in Azure Update Manager](https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events). Source retrieved September 9, 2026.

## Primary reference

- Name: Manage the pre and post maintenance configuration events in Azure Update Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/update-manager/manage-pre-post-events
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Make Update Manager pre-check failure trigger an explicit cancellation decision,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-223-make-update-manager-pre-check-failure-trigger-an-explicit-cancellation-decision/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.