Azure-cli: [VM] Ability to query/manipulate `Update Management`?

[iyerusad]

Azure VMs have a preview feature called "Update Management". This feature offers built-in update management (i.e. Windows Update, apt, etc).

Enabling the feature prompts for a log analytics workspace and an Automation account. Presumably, the automation account is where update management scheduling actually happens.

Is Update Management component query-able via az cli? (I wasn't able to find it if so, under az vm)
Are Azure Automation accounts manageable via az cli?

My goal:

• Identify Update Management status for a VM.
  (i.e. az vm updatemgmt show -n "MyVM")
• Secondary Goal: Enable Update Management for a VM
  (i.e. az vm updatemgmt status -n "MyVM" -value enable)
• Stretch goal: Have a policy that audits VMs and shoots off an email indicating which machines don't have update management enabled. (side note: Surprised this isn't a default available policy definition that ships in Azure - is there a board where can post secondary inquiry on this?)

[iyerusad]

Ability to toggle Update Management on a VM via Azure CLI would likely resolve a bug related to a VM thinking Update Management is enabled, but other parts of Azure Portal not recognizing it being enabled (i.e. the automation account). If there is an issue board where can file more detailed bug around Update Management or Azure Portal in general, please holler.

[nicolaibaralmueller]

We are also missing azure cli features that include update management and the ability to list content. Like VM compliance, update deployment status, etc.

[adewaleo]

Labeling this as a service issue as there isn't a current python SDK for this feature (see Azure Automation).

cc: @yugangw-msft

[sbonds]

For those interested in a programmatic alternative while the CLI is improved, there is an ARM template based method that can work: https://stackoverflow.com/questions/52635285/how-to-deploy-update-management-to-azure-resources-the-programmatic-way

[adewaleo]

I will close this as it is not a CLI issue, there isn't python sdk support for it (as far as I'm aware off) and there is a work around with arm templates.

[sbonds]

Perhaps rather than closing this we could make it pending the SDK improvement necessary to support this capability?

[sbonds]

Is this the SDK support that is supposedly missing?

https://docs.microsoft.com/en-us/python/api/azure-mgmt-edgegateway/azure.mgmt.edgegateway.models.updatesummary?view=azure-python

UpdateSummary(*, device_version_number: str = None, friendly_device_version_name: str = None, device_last_scanned_date_time=None, last_completed_scan_job_date_time=None, **kwargs) -> None

[adewaleo]

Thanks for sending this our way @sbonds . I can't find any update management operations, but yes I can reopen this issue.

However, I will be moving on to a different team soon, so I won't be able to implement this feature. But hopefully someone else on the CLI team can look into this.

cc: @yugangw-msft @zikalino @achandmsft

[sbonds]

Thanks so much! It may seem like a minor thing, but automating these sorts of reports will be quite useful.