# Check both extension upgrade settings before enabling the VM watch preview

> DSE recommends inventorying the existing extension before modifying it.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-029-check-both-extension-upgrade-settings-before-enabling-the-vm-watch-preview/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:31+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

DSE recommends inventorying the existing extension before modifying it.

## Potentially affected

Use this installation check during an authorized evaluation of the VM watch preview on an Azure VM with an existing Application Health extension. Confirm that the documented preview registration prerequisites have also been met before applying the procedure.

## DSE recommendation

DSE recommends inventorying the existing extension before modifying it.

## Article

## Source facts

Microsoft delivers the VM watch preview through the Application Health VM extension. For an existing Application Health extension, the installation guide requires both autoUpgradeMinorVersion and enableAutomaticUpgrade to be true. The guide separately verifies VM watch enablement by inspecting the VM configuration for vmWatchSettings with enabled set to true. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/install-vm-watch)

## Applicability

Use this installation check during an authorized evaluation of the VM watch preview on an Azure VM with an existing Application Health extension. Confirm that the documented preview registration prerequisites have also been met before applying the procedure.

## DSE recommendation

DSE recommends inventorying the existing extension before modifying it. Record its operating-system type, current upgrade settings and intended VM watch configuration with the evaluation request. Ask the extension owner to review the requested upgrade behavior and agree the test scope. Keep the extension installation observation and the VM watch enablement observation as separate acceptance items so an already present extension does not prematurely close the task.

## Verification

After the approved configuration change, inspect both upgrade properties and the VM watch settings in the actual resource configuration. Compare them with the planned values and retain the resource identifier with the observation. Investigate a missing setting or unexpected extension state before expanding the evaluation. Do not infer that preview enablement succeeded merely because Application Health appears in the installed-extension list.

## Official references

- [Microsoft: Install VM Watch – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/install-vm-watch)

## Primary reference

- Name: Install VM Watch - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/install-vm-watch
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check both extension upgrade settings before enabling the VM watch preview,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-029-check-both-extension-upgrade-settings-before-enabling-the-vm-watch-preview/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.