About Dynamic Scoping

Applies to: ✔️ Windows VMs ✔️ Linux VMs ✔️ On-premises environment ✔️ Azure VMs ✔️ Azure Arc-enabled servers.

Dynamic Scoping is an advanced capability of schedule patching that allows users to:

• Group machines based on criteria such as subscription, resource group, location, resource type, OS Type, and Tags. This becomes the definition of the scope.
• Associate the scope to a schedule/maintenance configuration to apply updates at scale as per a pre-defined scope.

The criteria will be evaluated at the scheduled run time, which will be the final list of machines that will be patched by the schedule. The machines evaluated during create or edit phase may differ from the group at schedule run time.

Key benefits

At Scale and simplified patching - You don't have to manually change associations between machines and schedules. For example, if you want to remove a machine from a schedule and your scope was defined based on tag(s) criteria, removing the tag on the machine will automatically drop the association. These associations can be dropped and added for multiple machines at scale.

Note

Subscription is mandatory for the creation of dynamic scope and you can't edit it after the dynamic scope is created.

Reusability of the same schedule - You can associate a schedule to multiple machines dynamically, statically, or both.

Prerequisites

Azure VMs

• Patch Orchestration must be set to Customer Managed Schedules. This sets patch mode to AutomaticByPlatform and the BypassPlatformSafetyChecksOnUserSchedule = True.
• Associate a Schedule with the VM.

Arc-enabled VMs

There are no prerequisites for patch orchestration. However, you must associate a schedule with the VM for Schedule patching. For more information, see Configure schedule patching on Azure VMs to ensure business continuity.

Permissions

For Dynamic Scoping and configuration assignment, ensure that you have the following permissions:

• Write permissions at subscription level to create or modify a schedule.
• Read permissions at subscription level to assign or read a schedule.

Service limits

The following are the Dynamic scope recommended limits for each dynamic scope.

Resource	Limit
Resource associations	1000
Number of tag filters	50
Number of Resource Group filters	50

Note

The above limits are for Dynamic scope in the Guest scope only.

For more information, see service limits for scheduled patching.

Next steps

• Learn more about how to Configure schedule patching on Azure VMs for business continuity.
• Follow the instructions on how to manage various operations of Dynamic scope
• Learn on how to automatically installs the updates according to the created schedule both for a single VM and at scale.
• Learn about pre and post events to automatically perform tasks before and after a scheduled maintenance configuration.