Automating Azure Arc Agent Upgrades

Over the past few weeks, I’ve been preparing an article about FinOps and cloud cost optimization. Today, however, I’d like to take a short break from that series to share something I recently discovered while working with Azure Arc.

In June, Microsoft released Azure Arc Agent 1.65. In one of my previous articles, I explained how to upgrade Azure Arc agents across servers using Group Policy (GPO). While that approach works well, it still requires administrators to manage the upgrade process manually.

This time, I’d like to show you how to automate the entire process by enabling automatic Azure Arc Agent upgrades.

Option 1 – Enable Automatic Upgrades with PowerShell

If you’re connecting a new machine to Azure Arc, you can enable automatic upgrades during onboarding by using the --enable-automatic-upgrade parameter with the azcmagent connect command.

For machines that are already connected to Azure Arc, you can enable the feature by updating the resource properties through the command below:

			
Set-AzContext -Subscription "YOUR SUBSCRIPTION"
$params = @{
    ResourceGroupName    = "YOUR RESOURCE GROUP"
    ResourceProviderName = "Microsoft.HybridCompute"
    ResourceType         = "Machines"
    ApiVersion           = "2024-05-20-preview"
    Name                 = "YOUR MACHINE NAME"
    Method               = "PATCH"
    Payload              = '{"properties":{"agentUpgrade":{"enableAutomaticUpgrade":true}}}'
}
Invoke-AzRestMethod @params

		

Option 2 – Use Azure Policy

For larger environments, I personally prefer using Azure Policy because it allows you to enable the feature consistently across all Azure Arc-enabled servers.

Microsoft provides a built-in policy called Configure Azure Arc-enabled Servers to enable automatic upgrades:

The policy itself is very simple. Its only responsibility is to change the following property on the Azure Arc resource:

			
"agentUpgrade": {
    "enableAutomaticUpgrade": true
}

If the property is currently set to false, the policy remediation changes it to true. Once the resource becomes compliant, the server is configured to use automatic agent upgrades.

It’s important to remember that Azure Policy is only responsible for enabling the automatic upgrade feature by changing the enableAutomaticUpgrade property from false to true.

How Does the Automatic Upgrade Work?

After automatic upgrades are enabled, Azure Arc creates a Scheduled Task on the server. The task runs every night and executes a PowerShell script that:

Checks whether a newer Azure Arc Agent version is available.
Downloads the latest agent.
Installs the update automatically.

Once everything is configured correctly, keeping Azure Arc Agents up to date becomes a completely hands-off process.

There’s One Catch…

During testing, I discovered an issue that mainly affects older environments.

If you’re running Windows Server 2016 with Azure Arc Agent 1.61, the scheduled task may fail, meaning the agent is never upgraded.

At first glance, it appears that automatic upgrades simply don’t work. However, the actual root cause is related to TLS.

During troubleshooting, I identified that PowerShell/.NET on the server wasn’t using modern TLS settings, preventing successful communication with the Azure Arc download endpoint.

The evidence collected showed that:

The Schannel registry paths for TLS 1.2 (and TLS 1.3 where applicable) were not explicitly configured.
Connections to the Azure Arc download endpoint behaved differently when TLS 1.2 was forced manually.
PowerShell/.NET wasn’t negotiating modern TLS versions by default, causing the download process to fail.

The Solution

Fortunately, there’s a fix!

The Azure Arc Agent first needs to be upgraded manually to version 1.63 (or later). Here’s the link to version 1.63: https://gbl.his.arc.azure.com/azcmagent/1.63/AzureConnectedMachineAgent.msi

Microsoft improved the Scheduled Task upgrade script starting with version 1.62. The updated script explicitly forces TLS 1.2, regardless of the operating system’s default TLS configuration.

After manually upgrading our servers to version 1.63:

and triggering the Scheduled Task again:

the agent successfully upgraded itself to version 1.65.

If the scheduled task isn’t updating the agent, check the installed Azure Arc Agent version first. Older versions, such as 1.61, may require a one-time manual upgrade to 1.63 or later before automatic upgrades start working as expected.

Final Thoughts

Automatic Azure Arc Agent upgrades are one of those features that’s easy to overlook but can significantly reduce the operational effort required to maintain Azure Arc-enabled servers.

Enabling the feature across an entire environment is straightforward with the built-in Azure Policy, while the actual upgrade process is handled locally by the Scheduled Task running on each server.

Just keep in mind that if you’re managing older Windows Server 2016 machines with Azure Arc Agent 1.61, you may need to perform one manual upgrade before the automatic upgrade mechanism can take over.

Hopefully, this saves you some troubleshooting time if you run into the same issue.

In the next article, we’ll return to the FinOps series and continue exploring practical ways to optimize Azure costs.

Discovering Azure