Discovering Azure

Last month, Microsoft released a new version of the Azure Connected Machine Agent. If you are using servers connected through Azure Arc, you might have already noticed a notification in the Azure portal indicating that a newer agent version is available.

Keeping the Azure Connected Machine agent up to date is important because newer versions bring improvements, security updates, and additional functionality. There are several ways to update the agent to the latest version, and in this article I’ll walk through the main approaches and share some practical experience from my environment.

Option 1 — Automatic agent upgrade

Starting with version 1.57 of the Azure Connected Machine agent, Microsoft introduced the ability to automatically upgrade the agent to the latest version. This feature is currently in Public Preview and is available only in the Azure public cloud.

With this capability enabled, the agent can periodically check for newer versions and update itself without requiring manual intervention.

In my case, however, the automatic upgrade did not work as expected. I attempted to trigger the upgrade both from the Azure portal and through PowerShell using the command provided by Microsoft.

Set-AzContext -Subscription "YOUR SUBSCRIPTION"
$params = @{
  ResourceGroupName = "YOUR RESOURCE GROUP"
  ResourceProviderName = "Microsoft.HybridCompute"
  ResourceType = "Machines"
  ApiVersion = "2024-05-20-preview"
  Name = "YOUR MACHINE NAME"
  Method = "PATCH"
  Payload = '{"properties":{"agentUpgrade":{ "enableAutomaticUpgrade":true}}}'
}
Invoke-AzRestMethod @params

Despite these attempts, the upgrade was not applied automatically in my environment.

Option 2 — Updating through Microsoft Update / Update infrastructure

Another recommended approach for keeping the Windows agent up to date is to distribute the update through Microsoft Update. This method allows organizations to manage the Azure Connected Machine Agent updates in the same way as regular Windows updates.

With this approach, the updates can be delivered using existing update management tools such as:

• Microsoft Configuration Manager
• Windows Server Update Services (WSUS)
• other enterprise update solutions

By including the agent update in your regular patching cycle, you can ensure that servers remain up to date without additional manual work.

However, there is an important requirement: Windows Server does not check Microsoft Update for other Microsoft product updates by default. To receive updates for the Azure Connected Machine Agent, the Windows Update client must be configured to also download updates for other Microsoft products.

If your servers are joined to a domain, this setting can be configured using Group Policy:

Navigate to:

Computer Configuration  
→ Administrative Templates  
→ Windows Components  
→ Windows Update

Then edit the policy:

Configure Automatic Updates

Set the policy to Enabled and ensure that the option Install updates for other Microsoft products is enabled.

Why this approach did not work in my environment

In my environment, this solution also did not work because the servers are configured not to download update packages automatically.

Previously, when automatic downloads were enabled, updates were sometimes installed before the scheduled maintenance window, which caused operational issues. I described this problem in more detail in a separate article:

Because of this configuration, the agent update was not deployed through the standard update mechanism.

Option 3 — Manual installation of the agent

The third option is to manually install the latest version of the Azure Connected Machine Agent. The installation package can be downloaded directly from Microsoft.

For my environment, this turned out to be the most effective solution.

By creating a new Group Policy Object (GPO), the updated agent was distributed across all servers connected through Azure Arc. The installation file was put on SYSVOL

This approach allowed me to control exactly when the update was deployed while still ensuring that all servers received the latest agent version.

To sum up

There are several ways to update the Azure Connected Machine Agent:

• Automatic upgrade (currently in Public Preview)
• Updates distributed through Microsoft Update or enterprise update tools
• Manual installation

Each environment is different, so the most suitable approach depends on how your patching and update processes are configured. In my case, deploying the agent through Group Policy was the most reliable and controllable option.

If you manage servers connected with Azure Arc, it’s worth checking which agent version you are running and planning how updates should be handled in your environment.