Manage a Dynamic scope

  • Article

Applies to: ✔️ Windows VMs ✔️ Linux VMs ✔️ On-premises environment ✔️ Azure Arc-enabled servers.

This article describes how to view, add, edit and delete a dynamic scope.

Prerequisites

  • Patch Orchestration must be set to Customer Managed Schedules. This sets patch mode to AutomaticByPlatform and the BypassPlatformSafetyChecksOnUserSchedule = True.
  • Associate a Schedule with the VM.

Add a Dynamic scope

To add a Dynamic scope to an existing configuration, follow these steps:

  1. Sign in to the Azure portal and navigate to Azure Update Manager.

  2. Select Machines > Maintenance configurations.

  3. In the Maintenance configurations page, select the name of the maintenance configuration for which you want to add a Dynamic scope.

  4. In the given maintenance configuration page > select Dynamic scopes > Add a dynamic scope.

  5. In the Add a dynamic scope page, select subscriptions (mandatory).

  6. In Filter by, choose Select and in the Select Filter by, specify the Resource group, Resource type, Location, Tags and OS type and then select Ok. These filters are optional fields.

  7. In the Preview of machines based on above scope, you can view the list of machines for the selected criteria and then select Save.

    Note

    The list of machines may be different at run time.

  8. In the Configure Azure VMs for schedule updates page, select any one of the following options to provide your consent:

    1. Change the required options to ensure schedule supportability ensures that the machines are patched as per schedule and not autopatched. By selecting this option, you are confirming that you want to update the patch orchestration to Customer Managed Schedules: This updates the following two properties on your behalf:

      • Patch mode = AutomaticByPlatform
      • Set the BypassPlatformSafetyChecksOnUserSchedule = True.

    2. Continue with supported machines only - this option confirms that you want to proceed with only the machines that already have patch orchestration set to Customer Managed Schedules.

    Note

    In the Preview of machines based on above scope page, you can view only the machines that don't have patch orchestration set to Customer Managed Schedules.

  9. Select Save. Notification confirms that the Dynamic scopes are successfully applied.

  10. In the Maintenance configuration | Dynamic scopes page, you can view and edit the Dynamic scopes that were created.

View Dynamic scope

To view the list of Dynamic scopes associated to a given maintenance configuration, follow these steps:

  1. Sign in to the Azure portal and navigate to Azure Update Manager.
  2. Select Machines > Maintenance configurations.
  3. In the Maintenance configurations page, select the name of the maintenance configuration for which you want to view the Dynamic scope.
  4. In the given maintenance configuration page, select Dynamic scopes to view all the Dynamic scopes that are associated with the maintenance configuration.
  5. The schedules associated to dynamic scopes are displayed in the following two areas:
    • Update manager > Machines > Associated schedules column
    • In your virtual machine home page > Updates > Scheduling tab.
    • To view the VMs that are associated to the schedule, go to the existing schedule and view under Dynamic scopes tab.

Edit a Dynamic scope

  1. Sign in to the Azure portal and navigate to Azure Update Manager.
  2. Select Machines > Maintenance configurations.
  3. In the Maintenance configurations page, select the name of the maintenance configuration for which you want to edit an existing Dynamic scope.
  4. In the given maintenance configuration page > select Dynamic scopes and select the scope you want to edit. Under Actions column, select the edit icon.
  5. In the Edit Dynamic scope, select the edit icon in the Filter By to edit the filters as needed and select Ok.

    Note

    Subscription is mandatory for the creation of dynamic scope and you can't edit it after the dynamic scope is created.

  6. Select Save.

Delete a Dynamic scope

  1. Sign in to the Azure portal and navigate to Azure Update Manager.
  2. Select Machines > Browse maintenance configurations > Maintenance configurations.
  3. In the Maintenance configurations page, select the name of the maintenance configuration for which you want to edit an existing Dynamic scope.
  4. In the given maintenance configuration page > select Dynamic scopes and select the scope you want to delete. Select Remove dynamic scope and then select Ok.

View patch history of a Dynamic scope

  1. Sign in to the Azure portal and navigate to Azure Update Manager.
  2. Select History to view the patch history of a dynamic scope.

Obtaining consent to apply updates is an important step in the workflow of dynamic scoping and listed are the various ways to provide consent.

Note

There are no prerequisites for Arc-enabled VMs.

  1. In Azure portal, go to +Create a resource > Virtual machine > Create.

  2. In Create a virtual machine, select Management tab and under the Guest OS Updates, in Patch orchestration options, select Azure-orchestrated. It sets the following properties:

    • Patch mode is set to AutomaticByPlatform
    • Set the BypassPlatformSafetyChecksOnUserSchedule = True

  3. Complete the details under Monitoring, Advanced and Tags tabs.

  4. Select Review + Create and under the Management you can view the values as Periodic assessment - Off and Patch orchestration options - Azure-orchestrated.

  5. Select Create.

Next steps