Machines should be configured to periodically check for missing system updates

What does the recommendation "Machines should be configured to periodically check for missing system updates" check?

Flags native Azure virtual machines whose patch assessment mode is not set to 'AutomaticByPlatform', so Azure Update Manager does not automatically evaluate them for missing operating system updates every 24 hours. Powered by Azure Update Manager and surfaced through Defender for Servers, it inspects the VM's patchSettings.assessmentMode under the Windows or Linux OS profile. It only confirms that the machine is being assessed on a schedule: it does not check that updates are actually installed, does not enforce automatic patching, and does not cover Arc-enabled servers, which have their own separate recommendation.

Why does "Machines should be configured to periodically check for missing system updates" matter?

Without periodic assessment you have no current view of which CVEs are unpatched on a fleet, so a machine can sit weeks behind on critical fixes while nobody notices. Update Manager only reports a clear picture once assessment runs on a schedule, and most patch reporting, compliance dashboards and scheduled patching workflows depend on that data being fresh. A VM that is never assessed is effectively a blind spot: it will not appear in your missing-updates reports even when it is the most exposed host you own, which undermines both your vulnerability programme and any audit that asks you to evidence patch status.

How do I fix "Machines should be configured to periodically check for missing system updates"?

1. Confirm the VM agent is present, because assessment requires it: check that 'provisionVMAgent' is true on the machine before changing the assessment mode.
2. Set the assessment mode to AutomaticByPlatform so the platform assesses the machine every 24 hours. For a single VM run: az vm update --resource-group <rg> --name <vm> --set osProfile.linuxConfiguration.patchSettings.assessmentMode=AutomaticByPlatform (use windowsConfiguration for Windows). In Bicep, set osProfile.<os>Configuration.patchSettings.assessmentMode to 'AutomaticByPlatform'.
3. Enforce it at scale with the built-in DeployIfNotExists policy 'Configure periodic checking for missing system updates on Azure virtual machines'. Look up its ID by display name rather than hardcoding a GUID, then assign it with a remediation task: pid=$(az policy definition list --query "[?displayName=='Configure periodic checking for missing system updates on Azure virtual machines'].name" -o tsv); az policy assignment create --name aum-periodic-assess --policy "$pid" --scope <scope>.

# Bring machines into Azure Update Manager: switch on periodic assessment
# and platform-orchestrated patching, then deploy the audit agent.
for vm in $(az vm list -g rg-workloads --query "[].name" -o tsv); do
  az vm update -g rg-workloads -n "$vm" \
    --set osProfile.windowsConfiguration.patchSettings.assessmentMode=AutomaticByPlatform \
    --set osProfile.windowsConfiguration.patchSettings.patchMode=AutomaticByPlatform
  # Guest Configuration extension requires a system-assigned identity.
  az vm identity assign -g rg-workloads -n "$vm"
  az vm extension set -g rg-workloads --vm-name "$vm" \
    --name AzurePolicyforWindows \
    --publisher Microsoft.GuestConfiguration
  echo "$vm: periodic assessment on, auto-patch on, config extension deployed"
done

# Ratchet it shut: assign the built-in policy that enables periodic
# assessment on every machine in the subscription.
az policy assignment create \
  --name enable-periodic-assessment \
  --policy 59efceea-0c96-497e-a4a1-4eb2290dac15 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --location uksouth --mi-system-assigned