---
title: >-
  Azure Virtual Machines should be configured to periodically check for missing
  system updates
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure Virtual Machines should be
  configured to periodically check for missing system updates
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure Virtual Machines should be configured to periodically check for missing system updates
 
## Description{% #description %}

Azure VMs should periodically check for missing system updates, so that Defender for Cloud and Azure Update Manager can report missing OS patches. This rule passes when the VM's Windows or Linux patch settings use the `AutomaticByPlatform` assessment mode, which runs an assessment every 24 hours. It skips scale set instances, which take their patch settings from the scale set model, and Azure Databricks cluster VMs, which customers cannot change.

This rule does not check whether missing updates are installed. Review the **System updates should be installed on your machines** recommendation in Defender for Cloud for that. VMs that run images Azure Update Manager does not support, such as network virtual appliances, fail this rule. If you assess those machines with another patch management tool, which the CIS audit allows, you can mute those findings.

## Remediation{% #remediation %}

Set the patch assessment mode to `AutomaticByPlatform` on each VM, then install any missing updates that Defender for Cloud reports. See [Manage update configuration settings in Azure Update Manager](https://learn.microsoft.com/en-us/azure/update-manager/manage-update-settings).

## References{% #references %}

- [Manage update configuration settings in Azure Update Manager](https://learn.microsoft.com/en-us/azure/update-manager/manage-update-settings)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)