Managing Windows updates on Azure Virtual Desktop session hosts has always been one of those topics where everyone has an opinion but nobody could point to official Microsoft guidance. That changes with the new documentation published this week — Microsoft has formally laid out the supported methods for monthly security updates, feature updates, and OS version upgrades across Windows 11 Enterprise, multi-session, and Windows Server session hosts.

If you’ve been winging it with a mix of Azure Update Manager, golden images, and hope, this guidance gives you a framework to build a proper servicing strategy.

The Two Servicing Models

Microsoft has formalized two approaches to keeping AVD session hosts updated:

Patch In-Place

OS updates are applied directly to running session hosts using Windows Update, Windows Update for Business, Azure Update Manager, or Configuration Manager. This is the traditional approach familiar to anyone who’s managed Windows servers.

Best for:

  • Small environments with few session hosts
  • Personal desktops (1:1 user-to-VM)
  • Windows Server session hosts that are stateful or few in number

Drawbacks:

  • Configuration drift between hosts over time
  • Harder rollback if a patch breaks something
  • Inconsistent user experience across hosts in the same pool

Image-Based Servicing

Updates are applied to a golden image offline. The updated image is published to Azure Compute Gallery, and new session hosts are deployed or existing hosts are reimaged from that versioned image.

Best for:

  • Pooled and multi-session host pools
  • Regulated environments where consistency matters
  • Organizations with automation tooling (Packer, DevOps pipelines, Nerdio)

Advantages:

  • Every host built from a versioned image is identical
  • Simple rollback — revert to the previous image version in Compute Gallery
  • Easy to audit and document compliance

For most production AVD environments running Windows 11 Enterprise multi-session, image-based servicing should be the default. The consistency and rollback benefits outweigh the operational overhead of maintaining an image lifecycle.

OS-Specific Recommendations

Windows 11 Enterprise Multi-Session

This is the primary AVD OS, and Microsoft’s guidance is clear: use image-based servicing.

The recommended workflow:

  1. Maintain versioned multi-session images in Azure Compute Gallery
  2. Use automation (Packer, Azure DevOps, Nerdio) to patch images monthly
  3. Apply security updates and app updates to the image
  4. Sysprep and publish the new version
  5. Drain hosts, disable autoscale, and roll out new hosts in controlled batches
  6. Test at least one drained host with the new image before mass rollout
  7. Keep prior image versions until the new version is validated in production

For feature updates (e.g., Windows 11 23H2 to 24H2), treat them as image refreshes — not in-place upgrades on production hosts. Use Windows Update for Business policies like “Target Feature Version” to control when feature updates are applied to your images.

Windows 11 Enterprise (Single-Session / Personal Desktops)

For personal desktops, the guidance is more flexible:

  • Small fleets: Patch in-place with Azure Update Manager or WUfB rings
  • Large fleets: Consider image-based servicing plus host replacement for consistency
  • Periodically refresh a base image for new personal desktops

Windows Server Session Hosts

Windows Server session hosts follow traditional server patching patterns:

  • Use Azure Update Manager, WSUS, or ConfigMgr for monthly patch-in-place on small/stateful servers
  • For larger pools or compliance-sensitive environments, use image-based servicing with versioned Windows Server images
  • Apply the same drain-and-disable-autoscale discipline as Windows 11

Monthly Security Updates: The Azure Update Manager Approach

For environments using patch in-place — or for applying updates to images — Azure Update Manager is Microsoft’s recommended tool.

Configuration Steps

  1. Set patch mode to AutomaticByPlatform — this lets the platform control scheduling rather than relying on the guest OS’s built-in Windows Update
  2. Create maintenance configurations with:
    • Recurrence (e.g., monthly on Patch Tuesday + offset)
    • Maintenance window duration
    • Update classifications (Security, Critical, Quality)
    • Reboot behavior settings
  3. Use dynamic scoping — target by tags, resource groups, or host pools rather than manually associating each VM

Operational Best Practices

Two operational steps are critical and often overlooked:

Drain hosts before maintenance. Put session hosts in drain mode before patching so no new user sessions land on a host that’s about to reboot. Note that the Azure portal can take up to 60 seconds to reflect drain-mode changes — don’t assume instant state updates.

Disable autoscale during patch waves. If autoscaling is active during maintenance, it may try to create or delete hosts in the middle of your update workflow, conflicting with your patching schedule. Disable autoscale before starting maintenance and re-enable it after completion.

Feature Updates and OS Upgrades: Treat Them as Images

The guidance is unambiguous about feature updates and OS version upgrades: don’t apply them in-place on production session hosts.

Instead:

  1. Build a new golden image on the target OS version
  2. Install all applications, agents, FSLogix, and monitoring tools
  3. Test the image thoroughly — sign-in, profiles, Microsoft 365 Apps, Teams optimization, browsers, printing, media, and line-of-business apps
  4. Publish the new image version to Azure Compute Gallery
  5. Gradually migrate host pools to the new image in controlled batches
  6. Keep the prior image version available for rollback until the new version is validated

Use Windows Update for Business policies to control target feature versions during image build. The “Target Feature Version” Group Policy setting lets you specify exactly which feature update should be installed, preventing accidental upgrades.

Building an Image Lifecycle

A disciplined image lifecycle is the backbone of image-based servicing:

  1. Start with a baseline image from Azure Marketplace or your own captured image
  2. Install applications, agents, policies, FSLogix, monitoring, and security tools
  3. Apply the latest security updates and verify supported versions
  4. Validate — test sign-in, profiles, M365 Apps, Teams, browsers, printing, media, and LOB apps
  5. Sysprep and publish the new image version to Azure Compute Gallery
  6. Document the image version with a changelog of what was updated
  7. Roll out in batches — drain hosts, deploy new image, test, then expand

Automation tools make this repeatable:

  • Packer + Azure DevOps Pipelines for image build automation
  • Nerdio Manager for image management, autoscaling, and session host provisioning
  • Azure VM Image Builder for Microsoft’s native image build service

What to Document

The guidance emphasizes that IT admins should have documented workflows for:

  • Adding and replacing session hosts
  • Promoting a new image version to production
  • Rolling back to a previous image version
  • Updating applications and agents in the image
  • Draining hosts before maintenance
  • Restoring profiles or hosts after failures
  • Excluding machine-specific artifacts (domain-join state, machine certificates) from captured images

Also ensure that host networks allow HTTPS egress to Microsoft Update endpoints — the guest OS needs to reach the update sources.

Compliance Considerations

For regulated environments (HIPAA, FedRAMP, etc.), the guidance reinforces that guest OS updates are the customer’s responsibility. Azure does not push OS patches to your session hosts automatically. This means:

  • Maintain tight control over guest OS baselines
  • Use image-based servicing for auditable consistency
  • Document your patch compliance with Update Manager’s reporting
  • Schedule regular image refreshes to avoid falling behind on security updates

Practical Starting Points by Scenario

Pooled host pools on Windows 11 Enterprise multi-session: Default to image-based servicing. Monthly: rebuild image with cumulative updates and app updates → publish new image version → drain and update hosts in batches.

Personal desktops on Windows 11 Enterprise: Use patch in-place with Update Manager or WUfB rings. Refresh base image periodically for new machines only.

Windows Server session hosts: Follow existing server patching standards (Update Manager, WSUS, ConfigMgr). Consider image-based servicing for large or compliance-sensitive pools.

Why This Guidance Matters Now

AVD has matured significantly in 2026. With hybrid deployments reaching GA, dynamic autoscaling, ephemeral OS disks, and automated host pools all now available, the update management gap was one of the last missing pieces. Having Microsoft formally document the recommended approaches — rather than leaving it to community knowledge and partner blog posts — gives IT teams a defensible, vendor-backed strategy for their patching workflows.

If your AVD environment is still applying updates ad hoc, this guidance gives you the framework to build a proper servicing strategy. And if you’re already doing image-based servicing, you now have official documentation to validate your approach.

For ongoing coverage of Azure Virtual Desktop updates, follow the AVD What’s New series and connect with us on X at https://x.com/kkaminsk.