canonical: https://jentic.com/apis/azure.com/update-management

# Microsoft Azure Update Management

Jentic publishes the only available OpenAPI specification for Update Management, keeping it validated and agent-ready. The Azure Update Management API is part of Azure Automation and lets agents define, schedule, and remove softwareUpdateConfigurations - the objects that drive patching campaigns across Windows and Linux VMs (Azure, Arc-enabled, or hybrid). A configuration captures the OS, classification filters, included or excluded KB or package lists, target machines or saved searches, scheduling, and reboot behaviour. Authentication uses Azure Active Directory OAuth 2.0 against management.azure.com.

## For AI agents

Creates and manages Azure Automation software update configurations to schedule patching campaigns across Windows and Linux VMs.

## Scope

Does not install agents on machines, run ad hoc commands, or report on update compliance - use the Log Analytics and Microsoft.OperationsManagement APIs for those; this API only manages softwareUpdateConfiguration objects.

## Capabilities

- Create a softwareUpdateConfiguration that targets Windows or Linux machines and applies a chosen patch classification (Critical, Security, Definition)
- Schedule patching with a one-time or recurring frequency including time zone, start time, expiry, and advanced schedule options
- Limit a deployment by including specific KB IDs or Linux package names and excluding others to keep changes auditable
- Target machines by explicit ID list or by an Azure Automation saved search to keep deployments scoped to dynamic groups
- Delete a softwareUpdateConfiguration by name to retire a patching campaign without affecting prior run history
- List every softwareUpdateConfiguration on an Automation account to inventory active patching schedules

## Use cases

### Monthly Patch Tuesday rollout

Operations teams need a repeatable monthly patching campaign that targets production Windows VMs with Critical and Security classifications, runs at the maintenance window, and reboots if required. The agent creates a softwareUpdateConfiguration with windows.includedUpdateClassifications=Critical,Security, frequency=Month, and an explicit machine list or saved search. Once created, Azure Automation runs the deployment on the configured schedule and emits run history that can be fetched separately.

Example prompt: Create a softwareUpdateConfiguration named 'prod-windows-monthly' on automation account 'ops-aa' in resource group 'ops-rg' with operatingSystem=Windows, includedUpdateClassifications='Critical,Security', frequency=Month, scheduleStart=2026-07-15T02:00:00Z, and target=savedSearch 'prod-windows'.

### Emergency one-time Linux patch

When a CVE drops, an agent needs to push a one-time Linux patch across a defined VM list within hours. The configuration is created with operatingSystem=Linux, frequency=OneTime, an explicit azureVirtualMachines list, and linux.includedPackageNameMasks for the affected package. Azure Automation runs the patch run once and the agent tears the configuration down with DELETE after the run completes.

Example prompt: Create softwareUpdateConfiguration 'cve-2026-7777' on automation account 'ops-aa' (resource group 'ops-rg') with operatingSystem=Linux, frequency=OneTime, scheduleStart=2026-06-11T22:00:00Z, includedPackageNameMasks=['openssl*'], and azureVirtualMachines containing the 5 affected VM resource IDs.

### Inventory and decommission of stale patch jobs

Long-running Automation accounts accumulate dozens of update configurations that no longer match current VM groups. The agent calls the GET-list endpoint to enumerate every softwareUpdateConfiguration on the account, filters those whose creationTime predates a cutoff, and issues DELETE on each. Run history is preserved on the account because deletion only removes the configuration, not its execution records.

Example prompt: List every softwareUpdateConfiguration on automation account 'ops-aa' (resource group 'ops-rg'), filter to those with creationTime before 2025-01-01, and DELETE each by name.

### Agent-managed patch orchestration through Jentic

An AIOps agent receiving a CVE alert can orchestrate the full patching response: search Jentic for the create-configuration operation, fill the schema with the affected packages and VM list, and execute against the automation account. Because Jentic returns the input schema directly, the agent does not need to read the Azure Automation REST docs to know what fields softwareUpdateConfigurationProperties expects.

Example prompt: Search Jentic for 'create azure software update configuration', execute with the JSON above, then poll the configuration GET until provisioningState=Succeeded.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations | List all software update configurations on an Automation account |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName} | Get a single software update configuration by name |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName} | Create or replace a software update configuration |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName} | Delete a software update configuration |

## Key resources

- **softwareUpdateConfigurations** — List, create, get, and delete patching campaign objects on an Azure Automation account

## Why Jentic

- **Setup:** Wiring Update Management by hand means setting up Azure AD OAuth 2.0 against management.azure.com, pinning the 2017-05-15-preview api-version, learning the nested softwareUpdateConfiguration and scheduleInfo shapes, and polling provisioningState with ARM 429 back-off yourself before a patch campaign runs. Through Jentic you install once, import Update Management from the API Directory, store the Azure AD OAuth token once, and your agent calls it.
- **Permission scoping:** Subscription, resource group, Automation account, and configuration name are URL path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}), so a rule can pin your agent to configurations on one Automation account. You choose the operations it may call, so destructive ones like deleting a configuration or overwriting one with PUT are not included unless you add them.
- **Credential handling:** Your Azure AD OAuth token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'schedule an Azure software update configuration' or 'list patching schedules on an Automation account', and Jentic returns the softwareUpdateConfigurations operation with its input schema, including the updateConfiguration and scheduleInfo blocks, so the agent fills them without reading the ARM reference.

## Related APIs

- **Automation Management** — Manages the Automation accounts and runbooks that host update configurations
- **ComputeManagementClient** — Lists and manages the Azure VMs that update configurations target
- **UpdateAdminClient** — Equivalent updates control plane for on-premises Azure Stack Hub

## FAQ

### Why is there no official OpenAPI spec for Update Management?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Update Management via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer .

### What authentication does the Update Management API use?

Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Through Jentic the Azure AD client secret is stored encrypted in the vault and a scoped bearer token is issued to the agent at call time.

### Can I schedule a recurring monthly patch run with the Update Management API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{name} with scheduleInfo.frequency=Month and scheduleInfo.startTime set creates a recurring deployment. Time zones are honoured via scheduleInfo.timeZone.

### What are the rate limits for the Update Management API?

Calls go through Azure Resource Manager and Azure Automation, subject to the standard ARM throttling envelope (roughly 12,000 reads per hour per subscription) plus per-Automation-account write quotas. The spec does not declare exact limits; back off on Retry-After when a 429 is returned.

### How do I create a software update configuration through Jentic?

Run pip install jentic, then client.search('create azure software update configuration'), client.load on the returned PUT operation, and client.execute with the configuration payload (operatingSystem, scheduleInfo, updateConfiguration). Jentic injects the Azure AD bearer token from the vault and returns the created resource.

### Does deleting a software update configuration delete its run history?

No. DELETE on .../softwareUpdateConfigurations/{name} removes the configuration object only. Past softwareUpdateConfigurationRuns and softwareUpdateConfigurationMachineRuns remain on the Automation account and can still be queried for audit purposes.

### Can I limit what my agent is allowed to do with the Update Management API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the subscription, resource group, Automation account, and configuration name are all URL path parameters, so a rule can pin the agent to softwareUpdateConfigurations on a single Automation account. You choose which operations it may call, so destructive ones like deleting a configuration or overwriting one with a PUT are left out unless you add them. That means an agent can be scoped to only list and read patch configurations while create and delete stay off-limits. Your Azure AD OAuth token is stored encrypted by your own instance and injected at call time, never exposed to the agent.