azurepowershellpatchazure-virtual-machineazure-update-management-center

How to use New-AzConfigurationAssignment Powershell cmdlet for Dynamic Scope for different subscriptions -Azure update manager


I'm failing to set up Dynamic Scopes for my Maintenance Configuration related to VMs (InGuestPatching) with Powershell. I have created a maintenance configuration. Now I want to do the configuration assignment on number of virtual machines at scale using powershell over subscription level dynamic scope. But powershell cmdlet is failing to do so.

Import-Module Az.Accounts
Import-Module Az.Resources
Import-Module Az.Compute
Import-Module Az.Automation
Import-Module Az.Storage
Import-Module Az.KeyVault
Import-Module Az.Maintenance
Import-Module Az.Compute  

Set-AzContext -Subscription ""

$maintenanceconfig =  New-AzMaintenanceConfiguration -ResourceGroup $RGName -Name $configName -MaintenanceScope $scope -Location $location -StartDateTime $startDateTime -TimeZone $timeZone -Duration $duration -RecurEvery $recurEvery -WindowParameterClassificationToInclude $WindowsParameterClassificationToInclude -InstallPatchRebootSetting $RebootOption -ExtensionProperty @{"InGuestPatchMode"="User"}     

New-AzConfigurationAssignment -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2 -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}'

The above code is failing to create dynamic scope assignment and below is the error I am getting.

Error:

enter image description here

I don't know what exactly am I missing but this cmdlet is not working for me and MS documentation is lacking the information. Please suggest a solution for this


Solution

  • How to use New-AzConfigurationAssignment Powershell cmdlet for Dynamic Scope for different subscriptions -Azure update manager.

    Here is the updated PowerShell script for creating a maintenance configuration for a VM.

        $RGName           = "RG-Name"
        $configName        = "workervmscentralus"
        $scope            = "InGuestPatch"
        $location         = "eastus2euap"
        $startDateTime    = "2024-03-09 12:30"
        $timeZone         = "UTC"
        $duration         = "3:00"
        $recurEvery       = "Day"
        $WindowsParameterClassificationToInclud = "apt","httpd"
        $RebootOption = "IfRequired"
        $Flocation  =  "eastus2euap,centraluseuap"
        $maintenanceconfig = New-AzMaintenanceConfiguration -ResourceGroupName v-nehrujir-Mindtree `
        -Name workervmseastus `
        -MaintenanceScope "InGuestPatch" `
        -Location eastus2 `
        -Timezone "UTC" `
        -StartDateTime "2025-10-09 12:30" `
        -Duration "3:00" `
        -RecurEvery "Day" `
        -LinuxParameterPackageNameMaskToInclude "apt","httpd" `
        -ExtensionProperty @{inGuestPatchMode="User"} `
        -InstallPatchRebootSetting "IfRequired" `
        
        
      $assignment = New-AzConfigurationAssignment -ResourceGroup $RGName -ResourceName "testvm" -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2  -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}' -Location centralus
        
     $assignment = New-AzConfigurationAssignment -ResourceGroup $RGName -ResourceName testvm -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2 -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}' -Location centralus
    

    To add dynamic scope into multiple subscription based filters, you can use the following code.

        $subscriptionnames = Get-AzSubscription | Select-Object -ExpandProperty Name
        foreach ($subscriptionname in $subscriptionnames) {
            Set-AzContext -Subscription $subscriptionname
            az maintenance assignment create-or-update-subscription --maintenance-configuration-id $maintenanceconfig.Id --subscription $subscriptionname --name $maintenanceconfig.Name --filter-locations centralus westus2 --filter-os-types windows linux --filter-tags '{"azsecpack":["nonprod"], "Department":["IT"]}' --filter-tags-operator All
        }
    

    Output:

    enter image description here

    After executing the script, the dynamic scope has been created in Maintenance configuration.

    enter image description here Reference: az maintenance assignment create-or-update-subscription