Are people actually using Azure Update Manager for Arc-enabled servers (non-azure)?

Posted by Mailstorm@reddit | sysadmin | View on Reddit | 20 comments

We have a goal to move what we can to a "cloud first" approach. That is, if there is a cloud/SaaS of a solution we should try it first (assuming price is reasonable). Our next project is patch management of servers. We are going to use WUfB for user endpoints. However this doesn't cover servers. We started looking and saw that Microsoft has Azure Update Manager. But after researching it's stupid expensive for what it is. $5 per server per month just to essentially manager updates? We have almost 200 VMs. For $1k a month we'd expect a lot more than just..patch management. We're looking at other products so I don't need suggestions. But I'm just wanting to know... Does anyone actually use AUM for arc-enabled servers that don't live in Azure? Why?

Reply to Post

20 Comments

[-]

Lopsided-Dig-4661@reddit

I did not realise they had started charging for this. I moved all our VMs onto it when it was free lol. We haven't been billed any additional yet as far as I can tell.

[-]

Mailstorm@reddit (OP)

See my other comment on price. It may be up to $5 per server if you are using scheduling. If you manually update, it's super low cost. But the point is to automate/schedule so...

[-]

MeshuganaSmurf@reddit

>Does anyone actually use AUM for arc-enabled servers that don't live in Azure? Why? We're using it but only for ESU on our 2012 VM's

[-]

saysjuan@reddit

Same here. Only for Win 2012 ESU + Tanium. U fortunately Tanium has more feature sets than until ARC can replace it we’ll continue to use that as our first like of system management.

[-]

MFKDGAF@reddit

Currently I’m using Automox to do my server patching but I’m not going to renew and switch to Azure Update Manager.

[-]

gbsscc@reddit

yes, its included in defender plan 2

[-]

Mailstorm@reddit (OP)

As in, you get Defender P2 and you are granted the ability to use Azure Update Manager for non-azure arc-enabled servers? That's...interesting. Didn't know that

[-]

touchytypist@reddit

This should help answering the pricing nuances: [Azure Update Manager FAQ | Microsoft Learn](https://learn.microsoft.com/en-us/azure/update-manager/update-manager-faq#pricing)

[-]

Mailstorm@reddit (OP)

Neat. I went looking on the Defender for Servers P2 page ([https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan#plan-features](https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan#plan-features)) and see that it only grants free remediation. But I'm not entirely sure what remediation means in this context. What's also confusing is that the conditions for being charged: * *Connected* status for Arc at any time during the day. * An update operation (patched on demand or through a scheduled job, assessed on demand or through periodic assessment) is triggered on it, or it's associated with a schedule. Which to me sounds like if you don't use the update schedule, it's essentially free.

[-]

touchytypist@reddit

It you don't associate a schedule to it, then it would only be billed 0.16/day/per server on the days your manually trigger an assessment or updates.

[-]

jamesaepp@reddit

Good pinch of salt - I am not an ARC user/administrator but my understanding is that ARC is for more than *just* updates. ARC is to connect your servers into your Azure subscription *so that* you can manage them *like* Azure resources and tie them into other Azure resources. Some things I found from skimming the documentation that is interesting (specifically Windows focused, that's what I care about): * Tunneled SSH access from the Azure portal to machines. * Administer servers via WAC in Azure - in preview, and I'm not the biggest fan of WAC, but I could think of use cases (server core) and not have to deal with an on-premises deployment of WAC. * Connectivity to vaults for certificate "lifecycle management" and automation. * Azure Automation, machine identities, custom scripting on machines (imagine the machine onboarding/offboarding possibilities). * Security services like Sentinel and Azure Policy. Obviously all these various services have their own costs, but I think the question that you raise and is most relevant is - is the $5/agent/month "cost of admission" worth it to be able to access this potential and perhaps consolidate multiple existing toolkits into a single ecosystem (Azure).

[-]

Mailstorm@reddit (OP)

Yup. Azure Arc does open the door to those. However, some of what you said is broken up into different products. Azure Update Manager is update management only. For example to apply policy settings inside of an arc-enabled server you'd get Azure Policy. However, that piece cost $6 per server per month if its outside of Azure.  I image its a similar story to everything else. It's almost like MS priced this all so it would be more cost effective to just...lift and shift. Which we wont do. To use, all of these services just aren't worth it. They aren't adding much to already existing tools that cost less or are free.

[-]

13Krytical@reddit

So we almost went that direction, but haven’t yet. The reason for moving that direction? People above me like the sound of “cloud first” and our network teams are not reliable so we’ve had numerous issues keeping our servers up to date using SCCM due to ACL issues. So instead of dealing with the network teams inefficiency, they want to move to cloud patching.

[-]

Mailstorm@reddit (OP)

I'm not sure of the reason for the cloud first approach to be honest. I'm more of a "use what works best" kind of person. We currently use SCCM for patching so this is mostly due diligence. I just thought it was a little ridiculous to charge $5 for what looks like just patching.

[-]

PhotographyPhil@reddit

We are stuck with SCCM right now for the granular controls over maintenance windows.

[-]

clvlndpete@reddit

We’re using it. Only have about 60 servers left on open though

[-]

zm1868179@reddit

We use Arc for the few servers we have remaining. When we did cloud first it was our way to re-architect. Lift and shift is stupid expensive and what most companies end up doing when going "cloud first" and then get ungodly bills. You have to look at what you are doing and re-architect into cloud first. If your software has a saas offering try to move to that vs on prem vm that you lift and shift into the cloud. If you have VMs that do nothing but host web applications move them to something like azure app services which are serverless pass offerings that end up cheaper than lift and shift. DBs look into Azure SQL and other paas DB offerings which again are serverless and can be cheaper than vm lift and shift. If you can do that and move to cloud native offerings then you really can save money vs vm lift and shift, cut down on the number of servers you have to manage less patching less licenses needed etc. you get the advantage of the cloud with its scale up scale out capabilities and scale down. Like now the only thing we have left server wise is 2 solidworks servers, all web apps and databases were moved to native services, file servers gone replaced with teams and SharePoint. We did lift and shift for the first year but only to be able to use msfts backbone network to help speed up moving stuff to native services. We cut back 500 servers down to 2 and save a ton.

[-]

Toasty_Grande@reddit

Use it in my environment, and the single pane of glass is wonderful. $1000/month could free up a lot more value than that with the team being able to focus on more strategic things than patching.

[-]

13Krytical@reddit

Depends on the environment.. $12k/yr is a license on quite a few enterprise level tools.. Agreed if you don’t have SPOG view or any patch solution, it’s great value. If you already have something doing the job well, is there anything else of value?

[-]

Mailstorm@reddit (OP)

For context, we currently use SCCM. This part (patch management) is mostly a "Is there something better?" We are doing our due diligence. If we can't find anything we'll stick with SCCM. I just thought $1k for JUST patching is a little expensive.