System updates should be installed on your machines

What does the recommendation "System updates should be installed on your machines" check?

Flags Azure VMs and Azure Arc-enabled servers that Azure Update Manager reports as missing one or more system, security or critical OS updates at the last periodic assessment. It evaluates the machine's installed patch level against the catalogue for its OS; it does not patch application binaries running inside containers, third-party software outside the OS package manager, or machines that have no assessment data because periodic assessment was never enabled.

Why does "System updates should be installed on your machines" matter?

An unpatched OS is the most reliably exploited foothold in any estate: published CVEs come with working exploit code, and automated scanners reach internet-facing hosts within hours of a fix shipping. One missing kernel or remote-service patch can hand an attacker code execution, then lateral movement across the subscription. The business cost is not just the breach but the audit finding, because most frameworks treat timely patching as a baseline control.

How do I fix "System updates should be installed on your machines"?

1. Enable periodic assessment so the recommendation has fresh data: set the machine's update assessmentMode to 'AutomaticByPlatform', which makes Azure Update Manager re-evaluate missing updates every 24 hours.
2. Remediate the backlog by selecting the affected machines in the recommendation and using the 'Fix' action for a one-time install of missing updates through Azure Update Manager, or run an on-demand update deployment from the Update Manager portal.
3. Stop the drift recurring: configure scheduled patching (a maintenance configuration) so updates install on a recurring window, and enforce periodic assessment at scale with the 'Configure periodic checking for missing system updates' Azure Policy plus a remediation task across existing VMs.

# Bring machines into Azure Update Manager: switch on periodic assessment
# and platform-orchestrated patching, then deploy the audit agent.
for vm in $(az vm list -g rg-workloads --query "[].name" -o tsv); do
  az vm update -g rg-workloads -n "$vm" \
    --set osProfile.windowsConfiguration.patchSettings.assessmentMode=AutomaticByPlatform \
    --set osProfile.windowsConfiguration.patchSettings.patchMode=AutomaticByPlatform
  # Guest Configuration extension requires a system-assigned identity.
  az vm identity assign -g rg-workloads -n "$vm"
  az vm extension set -g rg-workloads --vm-name "$vm" \
    --name AzurePolicyforWindows \
    --publisher Microsoft.GuestConfiguration
  echo "$vm: periodic assessment on, auto-patch on, config extension deployed"
done

# Ratchet it shut: assign the built-in policy that enables periodic
# assessment on every machine in the subscription.
az policy assignment create \
  --name enable-periodic-assessment \
  --policy 59efceea-0c96-497e-a4a1-4eb2290dac15 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --location uksouth --mi-system-assigned