Why Move Beyond WSUS?
Microsoft deprecated WSUS on September 20, 2024, and retired the old Automation-account-based Azure Update Management on August 31, 2024 — so the modern migration path is WSUS → Azure Update Manager, using Azure Arc to bring on-premises and multi-cloud servers under one cloud patching plane without a VPN, a Log Analytics workspace, or an Automation account. Update Manager runs as a native VM extension, patches Windows and Linux, and reports compliance across every machine that is an Azure resource or Arc-enabled.
That is the summary an AI Overview will give you. What it can't show you is the sequence — which agent goes where, what you turn off and when, and how to keep patching continuous while WSUS is still live. Below is an animated four-phase migration flow, a corrected comparison table (the retired service still appears in most older guides), and the exact commands, so you don't rebuild an architecture Microsoft already sunset.
While WSUS has served organizations well for years, modern IT environments demand more sophisticated update management capabilities. The traditional on-premises model struggles with cloud workloads, remote devices, and the complexity of hybrid infrastructures.
WSUS Limitations in Modern IT
| Challenge | WSUS impact | Azure Update Manager solution |
|---|---|---|
| Cloud workloads | Cannot manage cloud VMs effectively | Native Azure resource integration |
| Remote workers | Requires VPN for device access | Internet-based, agent-driven management |
| Scalability | Hardware limits, single point of failure | Cloud-scale, no patching infrastructure to run |
| Multi-platform | Windows-only | Windows and Linux from one plane |
| Automation | Limited scripting | Policy, scheduled patching, and API/CLI orchestration |
⚠️ Correction most guides miss: WSUS was formally deprecated on September 20, 2024 — no new features, but still supported and still shipping as a role in Windows Server 2025. Separately, the old Automation-account-based "Azure Update Management" was retired on August 31, 2024. Its replacement is Azure Update Manager, which needs neither a Log Analytics workspace nor an Automation account. If a tutorial tells you to spin up an Automation account to patch servers, it is describing the retired service. This guide targets Update Manager.
Azure Update Manager: Next-Generation Patching
Azure Update Manager transforms traditional patch management into a cloud-native service that provides comprehensive automation, cross-platform support, and compliance analytics for modern IT environments — as a native extension on Azure VMs and Azure Arc-enabled servers, with no supporting infrastructure of its own.
Key Features and Capabilities
- Automated Patch Scheduling – Define maintenance windows with automatic installation
- Cross-Platform Support – Manage Windows and Linux systems from a single interface
- Advanced Analytics – Rich reporting and compliance tracking through Azure Monitor
- Flexible Deployment – Support for Azure VMs, on-premises systems, and other clouds
- Integration with DevOps – API-driven automation and CI/CD pipeline integration
WSUS vs. Update Manager vs. the retired Automation service
| Capability | WSUS (on-prem) | Azure Automation Update Management (retired) | Azure Update Manager |
|---|---|---|---|
| Status | Deprecated 2024, still supported | Retired Aug 31, 2024 | Current, recommended |
| Supporting infrastructure | WSUS server + IIS + WID/SQL | Log Analytics workspace + Automation account | None — native VM extension |
| Reaches on-prem / other cloud | LAN / VPN only | Via Log Analytics agent + Arc | Via Azure Arc agent |
| OS coverage | Windows only | Windows + Linux | Windows + Linux |
| Cost model | Owned hardware | Log Analytics ingestion charges | Free for Azure VMs; per-server/mo for Arc |
| Which should I use / when | Only for air-gapped or legacy fleets during transition | Do not build new — migrate off | Default for every server going forward |
Azure Arc: Unified Hybrid Management
Azure Arc extends Azure's management capabilities to any infrastructure, enabling consistent governance and policy enforcement across on-premises, multi-cloud, and edge environments. It serves as the bridge that brings Azure services to your existing infrastructure.
Core Azure Arc Capabilities
- Unified Resource Management – Manage servers, Kubernetes clusters, and databases as Azure resources
- Policy Enforcement – Apply Azure Policy and governance across all environments
- Security Integration – Extend Azure Security Center and Sentinel to hybrid resources
- DevOps Integration – Deploy applications using GitOps and Azure DevOps
- Data Services – Run Azure SQL Database and PostgreSQL on any infrastructure
Azure Arc for Update Management
# Install Azure Arc agent on servers
# Download and run the installation script
# Windows PowerShell
Invoke-WebRequest -Uri https://gbl.his.arc.azure.com/azcmagent/latest/AzureConnectedMachineAgent.msi -OutFile AzureConnectedMachineAgent.msi
msiexec /i AzureConnectedMachineAgent.msi /l*v installationlog.txt /qn
# Connect to Azure Arc
azcmagent connect --resource-group "myResourceGroup" --tenant-id "myTenantId" --location "eastus" --subscription-id "mySubscriptionId"
# Verify connection
azcmagent show
Strategic Migration Planning
Successful migration from WSUS to Azure requires careful planning, phased implementation, and thorough testing to ensure seamless continuity of patch management operations.
Migration Challenges and Solutions
| Challenge | Impact | Mitigation strategy |
|---|---|---|
| Infrastructure differences | Workflow disruption | Gradual migration with parallel WSUS + Update Manager operation |
| Historical data | Loss of approval/compliance history | Export WSUS reports; establish a fresh compliance baseline in Azure |
| Team training | Operational delays | Early enablement on Arc onboarding and maintenance configurations |
| Network dependencies | Connectivity issues | Assess bandwidth; allow outbound to Azure Arc + Microsoft Update endpoints (no inbound rules) |
Four-Phase Migration Strategy
Assessment and Planning
- Inventory current WSUS infrastructure and dependencies
- Identify target Azure architecture requirements
- Create detailed migration timeline and resource allocation
- Establish success criteria and rollback procedures
Preparation and Testing
- Set up Azure Log Analytics workspace and Automation account
- Deploy Azure Arc agents to pilot systems
- Configure update management policies and schedules
- Test update deployment on non-critical systems
Phased Migration
- Start with non-critical servers and workstations
- Gradually include production systems in waves
- Maintain WSUS for legacy systems during transition
- Monitor and adjust configurations based on feedback
Optimization and Decommission
- Fine-tune update schedules and maintenance windows
- Implement advanced automation and reporting
- Decommission WSUS infrastructure after full migration
- Document new processes and train remaining staff
Implementation Best Practices
Azure Update Manager Configuration
There is no Automation account or Log Analytics workspace to create — that was the retired model. With Update Manager you trigger assessment and scheduled patching directly against the machine (Azure VM or Arc-enabled server) and attach a maintenance configuration for recurring windows.
# Modern Azure Update Manager — no Automation account, no Log Analytics
# Assumes the machine is already an Azure VM or Arc-enabled server
# One-off assessment (see what's missing)
Invoke-AzRestMethod -Path "/subscriptions/<sub>/resourceGroups/UpdateMgmt-RG/providers/Microsoft.Compute/virtualMachines/web01/assessPatches?api-version=2024-07-01" -Method POST
# Create a recurring maintenance configuration (patch window)
New-AzMaintenanceConfiguration -ResourceGroupName "UpdateMgmt-RG" -Name "monthly-patch-window" `
-Location "eastus2" -MaintenanceScope "InGuestPatch" -StartDateTime "2026-08-09 02:00" `
-Duration "03:00" -RecurEvery "1Month Second Saturday" -Timezone "UTC" `
-InstallPatchRebootSetting "IfRequired"
# Assign the schedule to a VM / Arc server (via dynamic scope or direct assignment)
New-AzConfigurationAssignment -ResourceGroupName "UpdateMgmt-RG" `
-Location "eastus2" -ResourceName "web01" -ResourceType "virtualMachines" `
-ProviderName "Microsoft.Compute" -ConfigurationAssignmentName "monthly-patch-window" `
-MaintenanceConfigurationId "<maintenanceConfigResourceId>"
Security and Compliance Considerations
- Identity and Access Management – Implement Azure AD integration with role-based access control
- Network Security – Configure private endpoints and service endpoints for secure communication
- Compliance Monitoring – Use Azure Policy to enforce update compliance across all resources
- Audit and Logging – Enable comprehensive logging for all update management activities
🚀 Migration Success Factors
- Start with comprehensive discovery and assessment
- Implement pilot testing with non-critical systems
- Ensure robust rollback procedures are in place
- Train teams on new tools and processes early
- Monitor performance and adjust configurations continuously
- Maintain documentation for troubleshooting and compliance
Cost Optimization Strategies
| Cost element | Optimization approach | Potential savings |
|---|---|---|
| Azure VM patching | Update Manager is free for Azure VMs — no add-on charge | Full cost of the retired Log Analytics ingestion model |
| Arc-enabled servers | Cover with WS2025 pay-as-you-go or ESU where eligible | Per-server monthly Update Manager fee |
| On-prem hardware | Eliminate the WSUS server, IIS, and its SQL/WID backend | Hardware refresh + maintenance costs |
| Operations | Maintenance configurations + dynamic scoping replace manual approvals | Administrative time per patch cycle |
Future-Ready Update Management
The migration from WSUS to Azure Update Manager represents more than a technology upgrade—it's a strategic transformation that positions organizations for modern IT challenges. Azure's cloud-native approach provides scalability, automation, and integration capabilities that traditional on-premises solutions simply cannot match.
Long-term Benefits
- Reduced Infrastructure Burden – Eliminate server maintenance and hardware refresh cycles
- Enhanced Security Posture – Benefit from Microsoft's cloud security investments and updates
- Improved Compliance – Automated compliance reporting and policy enforcement
- Greater Agility – Rapid deployment of new capabilities and integrations
- Cost Predictability – Operational expense model with predictable monthly costs
Organizations that proactively migrate to Azure's modern update management platform will be better positioned to handle the evolving demands of hybrid work, cloud adoption, and digital transformation initiatives.