Microsoft Azure Update Management
Browse all Azure APIs42
AI ReadinessFoundational (D-)42/100
Agent-ready OpenAPI document · curated by JenticCloud InfrastructureComputeoauth24 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Creates and manages Azure Automation software update configurations to schedule patching campaigns across Windows and Linux VMs.
Use for: Create a recurring monthly Windows patch deployment for production VMs, List all software update configurations on the prod-automation account, Delete the legacy 'weekly-critical' update configuration, Schedule a Linux security patch run for tomorrow at 02:00 UTC
Not supported: Does not install agents on machines, run ad hoc commands, or report on update compliance - use the Log Analytics and Microsoft.OperationsManagement APIs for those; this API only manages softwareUpdateConfiguration objects.
Jentic publishes the only available OpenAPI specification for Update Management, keeping it validated and agent-ready. The Azure Update Management API is part of Azure Automation and lets agents define, schedule, and remove softwareUpdateConfigurations - the objects that drive patching campaigns across Windows and Linux VMs (Azure, Arc-enabled, or hybrid). A configuration captures the OS, classification filters, included or excluded KB or package lists, target machines or saved searches, scheduling, and reboot behaviour. Authentication uses Azure Active Directory OAuth 2.0 against management.azure.com.
Install Jentic One Beta
Connect the Update Management to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Update Management, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fupdate-management" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fupdate-management" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Update Management API.
Create a softwareUpdateConfiguration that targets Windows or Linux machines and applies a chosen patch classification (Critical, Security, Definition)
Schedule patching with a one-time or recurring frequency including time zone, start time, expiry, and advanced schedule options
Limit a deployment by including specific KB IDs or Linux package names and excluding others to keep changes auditable
Target machines by explicit ID list or by an Azure Automation saved search to keep deployments scoped to dynamic groups
Delete a softwareUpdateConfiguration by name to retire a patching campaign without affecting prior run history
List every softwareUpdateConfiguration on an Automation account to inventory active patching schedules
Use Cases
Patterns agents use Update Management API for, with concrete tasks.
★ Monthly Patch Tuesday rollout
Operations teams need a repeatable monthly patching campaign that targets production Windows VMs with Critical and Security classifications, runs at the maintenance window, and reboots if required. The agent creates a softwareUpdateConfiguration with windows.includedUpdateClassifications=Critical,Security, frequency=Month, and an explicit machine list or saved search. Once created, Azure Automation runs the deployment on the configured schedule and emits run history that can be fetched separately.
Create a softwareUpdateConfiguration named 'prod-windows-monthly' on automation account 'ops-aa' in resource group 'ops-rg' with operatingSystem=Windows, includedUpdateClassifications='Critical,Security', frequency=Month, scheduleStart=2026-07-15T02:00:00Z, and target=savedSearch 'prod-windows'.
Emergency one-time Linux patch
When a CVE drops, an agent needs to push a one-time Linux patch across a defined VM list within hours. The configuration is created with operatingSystem=Linux, frequency=OneTime, an explicit azureVirtualMachines list, and linux.includedPackageNameMasks for the affected package. Azure Automation runs the patch run once and the agent tears the configuration down with DELETE after the run completes.
Create softwareUpdateConfiguration 'cve-2026-7777' on automation account 'ops-aa' (resource group 'ops-rg') with operatingSystem=Linux, frequency=OneTime, scheduleStart=2026-06-11T22:00:00Z, includedPackageNameMasks=['openssl*'], and azureVirtualMachines containing the 5 affected VM resource IDs.
Inventory and decommission of stale patch jobs
Long-running Automation accounts accumulate dozens of update configurations that no longer match current VM groups. The agent calls the GET-list endpoint to enumerate every softwareUpdateConfiguration on the account, filters those whose creationTime predates a cutoff, and issues DELETE on each. Run history is preserved on the account because deletion only removes the configuration, not its execution records.
List every softwareUpdateConfiguration on automation account 'ops-aa' (resource group 'ops-rg'), filter to those with creationTime before 2025-01-01, and DELETE each by name.
Agent-managed patch orchestration through Jentic
An AIOps agent receiving a CVE alert can orchestrate the full patching response: search Jentic for the create-configuration operation, fill the schema with the affected packages and VM list, and execute against the automation account. Because Jentic returns the input schema directly, the agent does not need to read the Azure Automation REST docs to know what fields softwareUpdateConfigurationProperties expects.
Search Jentic for 'create azure software update configuration', execute with the JSON above, then poll the configuration GET until provisioningState=Succeeded.
Key Endpoints
4 endpoints — jentic publishes the only available openapi specification for update management, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations
List all software update configurations on an Automation account
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Get a single software update configuration by name
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Create or replace a software update configuration
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Delete a software update configuration
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations
List all software update configurations on an Automation account
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Get a single software update configuration by name
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Create or replace a software update configuration
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}
Delete a software update configuration
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
U
Update Management
- Foundational (D-)42/100
72
Foundational Compliance63
Developer Experience & Jentic Compatibility20
AI-Readiness & Agent Experience94
Agent Usability35
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
72
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A-Signals: 4
86%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
63
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
50%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
20
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
78%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
35
Security
Trust, risk posture, and security compliance.
Grade: FSignals: 1
35%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Update Management by hand means setting up Azure AD OAuth 2.0 against management.azure.com, pinning the 2017-05-15-preview api-version, learning the nested softwareUpdateConfiguration and scheduleInfo shapes, and polling provisioningState with ARM 429 back-off yourself before a patch campaign runs. Through Jentic you install once, import Update Management from the API Directory, store the Azure AD OAuth token once, and your agent calls it.
Permission scoping
Subscription, resource group, Automation account, and configuration name are URL path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{softwareUpdateConfigurationName}), so a rule can pin your agent to configurations on one Automation account. You choose the operations it may call, so destructive ones like deleting a configuration or overwriting one with PUT are not included unless you add them.
Credential isolation
Your Azure AD OAuth token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'schedule an Azure software update configuration' or 'list patching schedules on an Automation account', and Jentic returns the softwareUpdateConfigurations operation with its input schema, including the updateConfiguration and scheduleInfo blocks, so the agent fills them without reading the ARM reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Update Management API through Jentic.
Why is there no official OpenAPI spec for Update Management?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Update Management via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer .
What authentication does the Update Management API use?
Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Through Jentic the Azure AD client secret is stored encrypted in the vault and a scoped bearer token is issued to the agent at call time.
Can I schedule a recurring monthly patch run with the Update Management API?
Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/softwareUpdateConfigurations/{name} with scheduleInfo.frequency=Month and scheduleInfo.startTime set creates a recurring deployment. Time zones are honoured via scheduleInfo.timeZone.
What are the rate limits for the Update Management API?
Calls go through Azure Resource Manager and Azure Automation, subject to the standard ARM throttling envelope (roughly 12,000 reads per hour per subscription) plus per-Automation-account write quotas. The spec does not declare exact limits; back off on Retry-After when a 429 is returned.
How do I create a software update configuration through Jentic?
Run pip install jentic, then client.search('create azure software update configuration'), client.load on the returned PUT operation, and client.execute with the configuration payload (operatingSystem, scheduleInfo, updateConfiguration). Jentic injects the Azure AD bearer token from the vault and returns the created resource.
Does deleting a software update configuration delete its run history?
No. DELETE on .../softwareUpdateConfigurations/{name} removes the configuration object only. Past softwareUpdateConfigurationRuns and softwareUpdateConfigurationMachineRuns remain on the Automation account and can still be queried for audit purposes.
Can I limit what my agent is allowed to do with the Update Management API?
Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the subscription, resource group, Automation account, and configuration name are all URL path parameters, so a rule can pin the agent to softwareUpdateConfigurations on a single Automation account. You choose which operations it may call, so destructive ones like deleting a configuration or overwriting one with a PUT are left out unless you add them. That means an agent can be scoped to only list and read patch configurations while create and delete stay off-limits. Your Azure AD OAuth token is stored encrypted by your own instance and injected at call time, never exposed to the agent.
GET STARTED