System updates should be installed on your machines (powered by Update Center)

What does the recommendation "System updates should be installed on your machines (powered by Update Center)" check?

Flags Azure VMs and Azure Arc-enabled servers that Azure Update Manager reports as missing one or more outstanding system, security or critical updates. Defender for Servers Plan 2 reads the latest periodic assessment from the machine and marks it unhealthy when patches are pending. It checks the installed-versus-available patch state only; it does not verify that a maintenance schedule exists, does not patch third-party applications outside the OS package manager, and the older Log Analytics agent (MMA) assessment path it once used is now deprecated in favour of the Update Manager VM extension.

Why does "System updates should be installed on your machines (powered by Update Center)" matter?

Unpatched operating systems are the most reliably exploited foothold in cloud estates: published CVEs come with working exploit code, and mass-scanning finds vulnerable hosts within hours. A single VM missing a security update can give an attacker remote code execution, then lateral movement into the wider subscription. Because the finding is High severity, it usually signals a machine that has drifted out of any patch cycle entirely, which is exactly the gap ransomware and crypto-mining campaigns rely on. Closing it keeps your fleet inside its compliance window and removes the cheapest route in.

How do I fix "System updates should be installed on your machines (powered by Update Center)"?

1. Enable periodic assessment so the machine reports its real patch state every 24 hours: set the VM patch property with 'az vm update -g <rg> -n <vm> --set osProfile.windowsConfiguration.patchSettings.assessmentMode=AutomaticByPlatform' (use linuxConfiguration for Linux), or apply the 'Machines should be configured to periodically check for missing system updates' quick fix in Defender for Cloud.
2. Install the pending updates once with 'az vm install-patches -g <rg> -n <vm> --maximum-duration PT4H --reboot-setting IfRequired --classifications-to-include-win Critical Security' (use --classifications-to-include-linux for Linux), or use the Fix option on the recommendation to push a one-time installation through Update Manager.
3. Stop the drift recurring by enforcing periodic assessment at scale: look up the built-in policy with 'pid=$(az policy definition list --query "[?displayName=='System updates should be installed on your machines (powered by Update Center)'].name" -o tsv)' then 'az policy assignment create --name require-system-updates --policy "$pid" --scope <scope>', and attach a recurring maintenance configuration with Patch orchestration set to Customer Managed Schedules.

# Bring machines into Azure Update Manager: switch on periodic assessment
# and platform-orchestrated patching, then deploy the audit agent.
for vm in $(az vm list -g rg-workloads --query "[].name" -o tsv); do
  az vm update -g rg-workloads -n "$vm" \
    --set osProfile.windowsConfiguration.patchSettings.assessmentMode=AutomaticByPlatform \
    --set osProfile.windowsConfiguration.patchSettings.patchMode=AutomaticByPlatform
  # Guest Configuration extension requires a system-assigned identity.
  az vm identity assign -g rg-workloads -n "$vm"
  az vm extension set -g rg-workloads --vm-name "$vm" \
    --name AzurePolicyforWindows \
    --publisher Microsoft.GuestConfiguration
  echo "$vm: periodic assessment on, auto-patch on, config extension deployed"
done

# Ratchet it shut: assign the built-in policy that enables periodic
# assessment on every machine in the subscription.
az policy assignment create \
  --name enable-periodic-assessment \
  --policy 59efceea-0c96-497e-a4a1-4eb2290dac15 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --location uksouth --mi-system-assigned