Once a month, the Azure Arc team releases an episode covering a new hybrid and multicloud management scenario. To request a topic or view additional episodes, visit aka.ms/the-azure-arc-check-in.
Scenario: Your infrastructure team needs to apply monthly security updates across hybrid Windows servers, but every restart creates another maintenance window and potential workload interruption. Hotpatch can reduce that restart-driven effort while helping you keep eligible servers protected. Try now in Azure aka.ms/aaci-episode2
Why Hotpatch matters
Security updates are essential, but coordinating restarts across a distributed server estate takes time and can disrupt workloads. Hotpatch updates Windows security code in memory, allowing eligible security updates to take effect without requiring a restart.
For Azure Arc-enabled Windows Server 2025 machines, enabling and using Hotpatch is available at no additional charge.
Hotpatch reduces restart frequency, but it does not eliminate every restart. Baseline updates and updates outside the Hotpatch program can still require one.
Confirm that your server is eligible
Before enabling Hotpatch, confirm that the machine meets the operating system, Azure Arc, and security prerequisites.
The server must:
- Run Windows Server 2025 Standard or Datacenter, build 26100.1742 or later.
- Run a generally available release. Preview and Windows Server Insider builds are not supported.
- Meet the Azure Connected Machine agent prerequisites and be connected to Azure Arc.
- Support virtualization-based security and Virtual Secure Mode.
- Use Unified Extensible Firmware Interface (UEFI) with Secure Boot enabled.
- Be a Generation 2 virtual machine when hosted on Hyper-V.
Windows Server 2025 Datacenter: Azure Edition follows a different path because Hotpatch is enabled by default and does not require Azure Arc connectivity.
For the latest requirements, see Enable Hotpatch for Azure Arc-enabled servers.
Verify Virtual Secure Mode
Run the following PowerShell command on the server to check its Virtual Secure Mode status:
Get-CimInstance -Namespace ‘root/Microsoft/Windows/DeviceGuard’ -ClassName ‘win32_deviceGuard’ | Select-Object -ExpandProperty ‘VirtualizationBasedSecurityStatus’
A result of 2 means Virtual Secure Mode is configured and running.
If the result is not 2, resolve the prerequisite before enrolling the machine in Hotpatch. Enabling Virtual Secure Mode requires a server restart, so make that change during a planned maintenance window.
Enable Hotpatch through Azure Arc
After confirming the prerequisites, enroll the server from the Azure portal:
- Open Azure Arc, then select Machines.
- Select the eligible server.
- Select Hotpatch.
- Review the confirmation, then select Confirm.
- Allow about ten minutes for the changes to apply.
- Verify that enrollment completes and the status is no longer pending.
The portal enrollment is intentionally short. Most of the work is making sure the server meets the prerequisites before you begin.
Choose how to manage updates
Hotpatch enrollment and update installation are separate. After enrollment, continue to manage available updates according to your organization’s patch policy and change-control process.
Supported options for Arc-connected machines include:
- Windows Update
- Azure Update Manager
- Group Policy
- SConfig
- Supported non-Microsoft patch-management solutions
Choose the method that fits your existing operations model. Enrolling a server in Hotpatch does not, by itself, install every available update automatically.
Plan for the restart cadence
Hotpatch changes the monthly update rhythm, but restart planning still matters.
Every three months, Microsoft releases a planned baseline with the latest cumulative update. Installing a baseline requires a restart. Hotpatch releases normally follow during the next two months, allowing eligible security updates to be applied without a restart.
An unplanned baseline can replace a scheduled Hotpatch release when necessary and will also require a restart. Updates outside the Hotpatch program can require restarts as well, including:
- Nonsecurity Windows updates
- .NET updates
- Drivers
- Firmware
- Other non-Windows updates
The practical operating model is fewer restart-driven maintenance windows, not a server that never needs to restart.
FAQs
1. Does Hotpatch mean I never need to restart the server?
No. Planned baselines arrive every three months and require a restart. Unplanned baselines and updates outside the Hotpatch program can also require restarts. Hotpatch reduces restart frequency for eligible security updates; it does not eliminate restart planning. See Hotpatch for Windows Server.
2. Is Hotpatch an extra-cost service for Azure Arc-enabled Windows Server 2025?
Enabling and using Hotpatch on eligible Azure Arc-enabled Windows Server 2025 machines is available at no additional charge. Optional Azure management services may have separate pricing.
3. Does enrolling in Hotpatch install every update automatically?
No. Enrollment makes the machine eligible to receive Hotpatch updates. Continue using Windows Update or a supported patch-management tool, such as Azure Update Manager, Group Policy, SConfig, or a non-Microsoft solution, to manage available updates according to your patch policy.
4. Can I use Hotpatch with Windows Server Core?
Yes. Both Server Core and Server with Desktop Experience are supported when the machine meets all other Hotpatch prerequisites.
5. What does a Virtual Secure Mode status of 2 mean?
For the documented Device Guard PowerShell query, a result of 2 means Virtual Secure Mode is configured and running. If you receive another result, resolve the prerequisite before attempting enrollment.
Review the current Hotpatch enablement guidance and Hotpatch concepts and update cadence, then visit The Azure Arc Check-in for more episodes.