davidsntg/azure-update-management-with-tags

Collection of Runbooks to schedule Azure VMs or Azure Arc Servers patching just with tags.

Hi there 👋

I am currently working as a Cloud Solution Architect @Microsoft.

Connect with me:

Azure Repos

• Networking:

  • MicroHack - Azure - Palo Alto Networks VM-Series Firewall Deployment
  • NSGaC - Network Security Groups as Code
  • DNS Private Resolver - MicroHack
  • Azure Application Gateway - MicroHack
  • Azure Databricks - Route workers traffic through NVA
  • LAB - Expose on-premise applications to Azure with Application Gateway
  • LAB - Azure Route Server - Anycast multi-region load balancing
  • LAB - Azure Connection Monitor with Bicep
  • Azure Firewall & Application Gateways - Scenarios

• Patching Management

  • Azure Update Management with tags

• Azure Arc

  • Schedule Azure Arc Servers weekly restart with tags

• Containers

  • Deploy umami with Azure Container Apps
  • LAB - AKS Monitoring with Splunk

• Subscription quotas

  • Monitor Subscription quotas with Logic App

• Azure Migrate

  • LAB - Azure Migrate POC with Hyper-V nested virtualization

• Others

  • Azure useful custom roles

Other recommended Github repos on Cloud Networking

• dmauser
• adstuart
• erjosito
• mddazure
• palosalvatori
• cynthiatreger
• fguerri
• hsze
• vmisson

azure-update-management-with-tags's Issues

Unable to schedule AzureARC servers

With this code, I'm unable to schedule Azure ARC enabled servers for patching. Though the scripts execute without any issues, the schedules created for Azure ARC servers do not have default 'patchomscomputers' linked runbook and hence no patching is taking place.

Azure Automation Limits

My understanding is that Azure Automation can only execute 200 jobs at a time. If most of our VMs are scheduled for the same date/time, what would happen if we exceed that limit (i.e. would they be queued or fail). I am concerned that having X number of VMs all with schedules at the same date/time would hit this limit but not certain.

Az.ResourceGraph Module Fails

In Terraform build, Az.ResourceGraph Module URI (URL) is incorrect.

Listed as:
uri = "https://www.powershellgallery.com/api/v2/package/az.resourcegraph/0.13.0"

Should be:
uri = "https://www.powershellgallery.com/packages/Az.ResourceGraph/0.13.0"

Multiple schedules for the same VM

UM-ScheduleUpdatesWithVmsTags.ps1 is creating a new schedule each run instead of updating the existing schedule or deleting old copies of the existing schedule.

UM-CleanUp-Schedules.ps1 only cleans up old schedules when the tag is missing. As such, my assumption is UM-ScheduleUpdatesWithVmsTags.ps1 should be updating the existing schedules and not creating a new one.

Schedules not linked to Patch-MicrosoftOMSComputers

Out of the list of hundres of VMs, only one patched, which was the one that I manually updated the schedule for. I notice this one is linked to Patch-MicrosoftOMSComputers. However, the ones created by UM-ScheduleUpdatesWithVmsTags.ps1 are not linked to the Patch-MicrosoftOMSComputers Runbook.