Update Windows OS in Azure App Service on Azure Stack Hub

The Azure App Service on Azure Stack Hub resource provider consists of various roles, and each role runs on a Windows Server instance. When you update App Service on Azure Stack Hub, the update process applies the latest Windows Server Update Package and Servicing Stack.

Control the frequency of patches from Windows Update

Azure Stack Hub administrators can choose from three modes to search for and apply updates to the underlying Windows OS.

  • Automatic: Enable the Windows Update service. Windows Update determines how and when to update.
  • Managed: Disable the Windows Update service. Azure App Service runs a Windows Update cycle during OnStart of the individual role. This cycle runs whenever the platform or administrator restarts an instance or during an App Service on Azure Stack Hub update.
  • Disabled: Disable the Windows Update service. Update Windows with the KB that's included in Azure App Service on Azure Stack Hub releases.

How do I change the mode of operation?

To change the mode of operation, follow these steps:

  1. In the Azure Stack Hub administrator portal, go to Network Security Groups and view the ControllersNSG Network Security Group.
  2. By default, remote desktop is disabled for all App Service infrastructure roles. Change the Inbound_Rdp_3389 rule action to Allow access.
  3. Go to the resource group that contains the App Service Resource Provider deployment. By default, the name is AppService.<region>. Connect to CN0-VM.
  4. Launch the Web Cloud Management Console.
  5. Go to Settings and select the RunWindowsUpdate setting.
  6. Select Edit Setting in the menu bar, change to your preferred mode, and then select OK to apply.
  7. Disconnect the remote desktop session.
  8. In the Azure Stack Hub administrator portal, go back to the ControllersNSG Network Security Group.
  9. Change the Inbound_Rdp_3389 rule to deny access.

Configure Azure App Service on Azure Stack Hub to use Windows Server Update Services as the source for Windows updates

Note

These steps don't cover the supporting file server and SQL Server infrastructure because this infrastructure is customer managed and supported.

By default, Windows Server uses the public Microsoft Update service to get update packages. Some customers already use, or want to use, Windows Server Update Services to provide update packages to deployed infrastructure within their network.

Prerequisites

To use WSUS as the source for Windows Updates to the App Service RP roles, you must meet the following requirements:

  • Your Azure Stack Hub must run Azure App Service on Azure Stack Hub version 2022 H1 or newer. If your Azure Stack Hub runs an older version, upgrade it before you set this configuration.
  • Windows Server Update Services must already be set up and configured.
  • All clients (App Service role instances - controllers, management servers, front ends, publishers, and workers) must connect by using HTTPS to the WSUS servicing point (the default is 8531).

Configuration steps

Important

This configuration doesn't change the behavior of Windows Update on the App Service roles. It only changes the source of the Windows Server update packages.

Follow these steps to configure Microsoft Update on the App Service roles to use WSUS as the source for Microsoft Update packages.

  1. In the Azure Stack Hub admin portal, go to Network Security Groups and view the ControllersNSG Network Security Group.

  2. By default, remote desktop is disabled for all App Service infrastructure roles. Change the Inbound_Rdp_3389 rule action to Allow access.

  3. Go to the resource group that contains the App Service Resource Provider deployment. By default, the name is AppService.<region>. Connect to CN0-VM.

  4. Launch the Web Cloud Management Console.

  5. Go to Settings and select the AlternativeWSUSServer setting.

  6. Select Edit Setting in the menu bar, enter the WSUS endpoint in the form https://<WSUSEndpoint>:<WSUS Service Port>, and select OK to apply.

  7. Disconnect the RDP session.

  8. In the Azure Stack Hub administrator portal, go back to the ControllersNSG Network Security Group.

  9. Change the Inbound_Rdp_3389 rule to deny access.

  10. Go to the WorkersNSG Network Security Group.

  11. Add a new Outbound security rule to allow access to the WSUS servicing endpoint.

    • Source: Any
    • Source port range: *
    • Destination: IP Addresses
    • Destination IP address range: Range of IPs for your WSUS Servicing Endpoint
    • Destination port range: 8531
    • Protocol: Any
    • Action: Allow
    • Priority: 760
    • Name: Outbound_Allow_Outbound_to_WSUS

Next steps

  • Last updated on