Deployment
Overview
Deploying Azure Update Management can be efficiently handled using Azure DevOps Pipelines. Utilizing specific tags on the subscription allows you to customize the deployment to meet the customer's needs. This solution leverages dynamic scopes instead of Azure Policy, making it deployable via Azure Lighthouse.
Single Tenant with Multiple Subscriptions
When deploying Azure Update Management in a single tenant across multiple subscriptions, it is recommended to configure everything within the shared platform landing zone. The only requirement is to set up the dynamic scope at either the Management group level or subscription level. This can be configured manually or using existing DevOps Pipelines.
Azure Lighthouse (MSP) Setup
For an Azure Lighthouse 'Managed Service Provider' (MSP) setup, the following tags must be applied to the subscription:
| Key | Value | Description |
|---|---|---|
| Prefix | Max 8-10 characters | Prefix for all resources in the subscription, e.g., STLB-AVD |
| Environment | PRD/ACC/TST/DEV | Purpose of the subscription |
| Automation | True/False | General tag for enabling automation |
| AUM | True/False | True to include in the update manager automation. Requires Automation to be set to True |
These tags will be used by an powershell script in the Azure DevOps Pipeline. When the Pipeline starts it will gather all subscriptions it has access to through Azure Lighthouse, next it will retrieve the tags on these subscriptions. Using these tags you can manipulate the bicep deployment.
Why Use Azure DevOps Pipelines?
Azure DevOps Pipelines offer a streamlined and automated way to deploy Azure Update Management. This ensures that the deployment is consistent, repeatable, and can be managed version control. It also provides built-in features for monitoring, testing, and rollback, enhancing the reliability and security of the deployment process.
Why Use Dynamic Scopes?
Dynamic scopes in Azure Update Management allow you to target VMs based on tags without the need for static policies. This flexibility enables you to apply updates selectively, based on the specific needs of each VM or set of VMs, thereby optimizing resource utilization and minimizing disruption.
Why Use Azure Lighthouse (MSP) Setup?
Azure Lighthouse provides a way for Managed Service Providers to manage customer subscriptions without having to merge them into the MSP's Azure Active Directory. By applying specific tags, you can ensure that the subscription is properly configured for Azure Update Management, enabling automated updates across multiple customer subscriptions without manual intervention.
By following these guidelines and utilizing Azure DevOps Pipelines, Azure Lighthouse, and dynamic scopes, you can achieve a robust and efficient deployment of Azure Update Management, tailored to meet your specific requirements.