# Review Azure control-plane implications before a Windows Server in-place upgrade

> DSE recommends documenting the update capabilities the workload needs before selecting an upgrade method.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-038-review-azure-control-plane-implications-before-a-windows-server-in-place-upgrade/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:22+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends documenting the update capabilities the workload needs before selecting an upgrade method.

## Potentially affected

Use this review before choosing an in-place Windows Server upgrade for an Azure VM whose operational plan depends on Azure-managed update capabilities.

## DSE recommendation

DSE recommends documenting the update capabilities the workload needs before selecting an upgrade method.

## Article

## Source facts

Microsoft cautions that an in-place Windows Server upgrade leaves the VM’s source-image properties, including publisher, offer, and plan, unchanged. The same warning says automatic guest patching, automatic OS image upgrades, Hotpatching, and Azure Update Manager are not officially supported with this process and can fail. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows-in-place-upgrade)

## Applicability

Use this review before choosing an in-place Windows Server upgrade for an Azure VM whose operational plan depends on Azure-managed update capabilities.

## DSE recommendation

DSE recommends documenting the update capabilities the workload needs before selecting an upgrade method. Compare those requirements with the source warning, and ask the service owner to decide whether deploying a new VM is the appropriate route. If an in-place upgrade remains under consideration, record the resulting management limitation explicitly alongside the recovery plan and application compatibility review. Do not use the guest version alone to describe the platform configuration.

## Verification

Inspect both the guest OS version and the Azure source-image properties after any approved test. Review each required management capability against the documented support boundary and the selected deployment method. Keep a successful OS installation separate from operational acceptance, and leave unsupported dependencies unresolved until the service owner chooses a supported design.

## Official references

- [Microsoft: Windows in-place upgrade – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows-in-place-upgrade)

## Primary reference

- Name: Windows in-place upgrade - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/windows-in-place-upgrade
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review Azure control-plane implications before a Windows Server in-place upgrade,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-038-review-azure-control-plane-implications-before-a-windows-server-in-place-upgrade/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.