<p>Apologies for not directly answering your question, but by the sounds of your question, you are trying to build an <strong>update management</strong> system to mitigate the threats of vulnerable operating system components and tools having unpatched vulnerabilities which expose you to risk.</p>

<p>This functionality is actually already available for both Windows and Linux via Azure Automation in the form of the unimaginatively named <a href="https://docs.microsoft.com/en-us/azure/automation/automation-update-management" rel="nofollow noreferrer">Update Management solution</a>.  </p>

<p>Essentially you will need to do the following:</p>

<ol>
<li>Configure Azure Monitor and Log Analytics to provide information about vulnerable packages on your machines,</li>
<li>Ensure that any network security groups and firewalls are configured to allow access to/from the various components of the system,</li>
<li>Enable Change Tracking and Inventory,</li>
<li>Enable Update Management,</li>
<li><a href="https://docs.microsoft.com/en-us/azure/automation/automation-update-management" rel="nofollow noreferrer">Onboard your machines</a>.</li>
</ol>

<p>I would also highly recommend employing <a href="https://azure.microsoft.com/en-gb/services/security-center/" rel="nofollow noreferrer">Azure Security Center</a> as this provides a clearer overview of vulnerabilities across your estate, not just as applied to specific virtual machines.</p>

CC BY-SA 4.0
2019-10-26T21:26:11.163Z
Thanks Richard  , I already tried update management solution but i want some kind of unattended updates. I came across a module at https://help.ubuntu.com/lts/serverguide/automatic-updates.html . I haven't tried it yet but do you think it will do the same thing and update security patches unattended.
rdhaundiyal
CC BY-SA 4.0
2019-10-30T09:37:30.890Z
The only thing you can do is give it a try, I would still use Azure Security Center to provide a layer of reporting over and above what is offered by that `automatic-updates` service.  I would also consider spreading the update frequency amongst multiple machines so that they don't all restart on the same schedule.
Richard Slater
CC BY-SA 4.0
2019-10-25T11:58:35.020Z
2019-10-25T11:58:35.020Z
Richard Slater
<p>I am looking for some PowerShell command which can check if any update/patch need to be applied to existing Azure Linux VM and then apply the patch if required. 
 I will then use this PowerShell command to automate the process.</p>

<p>There was <a href="https://azure.microsoft.com/en-au/blog/automate-linux-vm-os-updates-using-ospatching-extension/" rel="nofollow noreferrer">an extension</a> but that appears to be outdated now.</p>

<azure-devops><linux><automation>
PowerShell command to automate Azure Linux VM
rdhaundiyal
# PowerShell command to automate Azure Linux VM

(Asked by: username_0 on 2019-10-24)

I am looking for some PowerShell command which can check if any update/patch need to be applied to existing Azure Linux VM and then apply the patch if required.
I will then use this PowerShell command to automate the process.

There was [an extension](https://azure.microsoft.com/en-au/blog/automate-linux-vm-os-updates-using-ospatching-extension/) but that appears to be outdated now.

**Tags:** azure-devops, linux, automation


---

## 1 answers

### Answer by username_1 on 2019-10-25. Score: 3

Apologies for not directly answering your question, but by the sounds of your question, you are trying to build an **update management** system to mitigate the threats of vulnerable operating system components and tools having unpatched vulnerabilities which expose you to risk.

This functionality is actually already available for both Windows and Linux via Azure Automation in the form of the unimaginatively named [Update Management solution](https://docs.microsoft.com/en-us/azure/automation/automation-update-management).

Essentially you will need to do the following:

1. Configure Azure Monitor and Log Analytics to provide information about vulnerable packages on your machines,
2. Ensure that any network security groups and firewalls are configured to allow access to/from the various components of the system,
3. Enable Change Tracking and Inventory,
4. Enable Update Management,
5. [Onboard your machines](https://docs.microsoft.com/en-us/azure/automation/automation-update-management).

I would also highly recommend employing [Azure Security Center](https://azure.microsoft.com/en-gb/services/security-center/) as this provides a clearer overview of vulnerabilities across your estate, not just as applied to specific virtual machines.

> **Comments:**
> **username_0**: Thanks Richard  , I already tried update management solution but i want some kind of unattended updates. I came across a module at https://help.ubuntu.com/lts/serverguide/automatic-updates.html . I haven't tried it yet but do you think it will do the same thing and update security patches unattended.  
> **username_1**: The only thing you can do is give it a try, I would still use Azure Security Center to provide a layer of reporting over and above what is offered by that `automatic-updates` service.  I would also consider spreading the update frequency amongst multiple machines so that they don't all restart on the same schedule.  

---

