Microsoft Learn – Windows update management methodologies for Azure Virtual Desktop session hosts
Patching AVD: what to use and when
Microsoft published new guidance in early September 2026 that explains how to pick the right servicing strategy for Azure Virtual Desktop (short AVD) session hosts. The document covers supported delivery methods for monthly security & quality updates, feature updates, and OS version upgrades across Windows client Enterprise (single‑session), Windows client multi‑session, and Windows Server. It also maps each delivery method to the servicing model you’ll use: patch in‑place or image‑based servicing.
Below I summarize the guidance and call out practical recommendations you can use to pick a servicing approach for your environment.
Key concepts and decision factors
Session host OS drives the whole servicing decision. Windows client single‑session, Windows client multi‑session and Windows Server behave differently under updates: they have different feature sets, uptime expectations, and platform integrations (for example, Hotpatch availability, Windows Autopatch support, and how well image swaps preserve user experience). Because of that you can’t pick a one‑size‑fits‑all method. What’s ideal for a pooled multi‑session host pool (where consistency and predictable rollbacks matter) is often the opposite of what you’d choose for a single‑session client or a traditional Windows Server deployment.
Equally important is the type of update you’re deploying. Monthly security and quality updates are routine, low‑risk changes that are commonly handled with patch in‑place tooling. Feature updates and OS version upgrades are bigger functional changes that benefit from an image‑based approach where you can validate apps and rollback cleanly. Treat each update category differently. Use lightweight, incremental methods for latest cumulative updates and reserve image builds and controlled rollouts for feature and OS version moves.
That leads into the servicing model choice. Patch in‑place updates the running VM and is usually faster to apply, but it increases configuration drift and makes rollbacks harder. Image‑based servicing replaces hosts with validated images, which is more work up front but gives you consistent hosts, simpler rollback, and less risk of surprises in pooled multi‑session environments. In practice, classify your host pools by OS and role, map each to the appropriate update type, then select patch in‑place or image‑based servicing based on your tolerance for downtime, need for consistency, and operational tooling.
Recommendation summary
Below I’ll walk you through and summarize all the recommendations, which Microsoft has published in their latest Learn article about this topic.
Monthly security & quality updates
- Windows client Enterprise (single‑session)
- Recommended: Windows Update or Windows Autopatch (Windows Update for Business (short WUfB)/WUfB+Intune).
- Supported: Configuration Manager.
- Not supported / not recommended: Azure Update Manager and automatic guest patching are not supported for client single‑session.
- Hotpatch: Supported on Windows 11 Enterprise 24H2+ with virtualization-based security (short VBS) enabled when managed through Windows Autopatch/Intune.
- Windows client multi‑session
- Recommended: Session host update (image-based servicing) or Azure Compute Gallery image deployments for pooled hosts.
- Supported: Configuration Manager.
- Not recommended: Windows Update / Windows Autopatch for pooled multi‑session.
- Hotpatch: Supported for multi‑session.
- Windows Server
- Recommended: Azure Update Manager or Automatic Guest Patching (short AGP).
- Supported: Configuration Manager and Windows Update.
- Not recommended: Session host update and Azure Compute Gallery for normal monthly patching (those are less suitable for server monthly servicing).
- Hotpatch: Supported only on Windows Server Azure Edition.
Feature updates (client feature releases, enablement package (short eKBs))
- Windows client Enterprise
- Recommended: Windows Update or Windows Autopatch.
- Supported: Configuration Manager.
- Image-based is an option but not emphasized. Hotpatch does not apply for feature updates.
- Windows client multi‑session
- Recommended: Image‑based servicing (Azure Compute Gallery). Session host update workflows are recommended for pooled hosts.
- Supported: Configuration Manager.
- Windows Update / Autopatch are not recommended for feature updates on multi‑session.
- Windows Server
- Feature updates do not apply (Windows Server doesn’t follow the client feature update cadence in the same way).
OS version upgrades (major version moves)
- In‑place upgrades (Setup.exe or ISO) are marked Not supported across the board.
- Recommended: Deploy new VMs from a tested image (Azure Compute Gallery / new image + session host update flow), validate, then drain and replace old hosts.
- Image-based deployment is the supported and recommended pattern for migrations between OS versions.
Hotpatch
- Hotpatch reduces reboots by applying eligible monthly updates without a reboot.
- Supported scenarios:
- Windows 11 Enterprise 24H2+ with VBS enabled and updates managed via Windows Autopatch/Intune (client single‑session).
- Windows client multi‑session is supported.
- Windows Server is only supported when it’s an Azure Edition and through Azure Update Manager.
Which servicing model to choose
Use in‑place patching when you need a fast, low‑friction way to keep systems current. Patch in‑place is ideal for routine monthly security and quality updates where the change surface is small and predictable, and when your hosts are Windows Server or single‑session Windows clients managed with tools like Azure Update Manager, Automatic Guest Patching, Windows Update or Configuration Manager. It’s the simplest path to apply latest cumulative updates quickly, but accept the tradeoffs as mentioned above.
Use image‑based servicing when consistency, predictability and clean rollback are needed. Image‑based flows (update the base image, validate apps, publish a new Azure Compute Gallery version, deploy new hosts, then drain and retire old hosts) are the recommended pattern for pooled multi‑session host pools and for feature updates or OS version rollouts.
A hybrid approach is often the most practical: mix models by workload and risk profile. For example, run patch in‑place for critical server monthly patches where fast application matters, while using image‑based servicing for pooled multi‑session desktop fleets and any feature/OS upgrades. The hybrid model lets you balance operational speed with long‑term consistency.
Practical recommendations and gotchas
- Pooled multi‑session = prefer image‑based servicing. It avoids partial drift, simplifies testing, and makes rollback safer.
- Windows Server = prefer Azure Update Manager or Automatic Guest Patching for monthly security updates. Use Hotpatch when you have an Azure Edition of your Windows Server.
- Windows Autopatch (WUfB) works well for single‑session client hosts and enables Hotpatch scenarios, but it’s not recommended for multi‑session pooled hosts.
- In‑place OS upgrades are not recommended / not supported for AVD session hosts.
- Azure Compute Gallery and session host update flows are the recommended image‑based mechanisms. They integrate cleanly with validation and controlled deployments.
- Moving to image‑based servicing means planning for user data handling. User profile data (FSLogix) and persisted state must be preserved externally since image swaps don’t keep local disk state.
Conclusion
Microsoft’s guidance clarifies that there is no one‑size‑fits‑all servicing method for AVD session hosts. Choose by OS type and host pool architecture:
- Patch in‑place methods (Windows Update, Autopatch, ConfigMgr, Azure Update Manager) are ideal for many monthly update scenarios.
- Image‑based servicing (Azure Compute Gallery & session host update flows) is the preferred pattern for pooled multi‑session environments and for controlled feature/OS version rollouts.
- Use Hotpatch where eligible to reduce reboots, but validate prerequisites carefully.
Follow the guidance in the “Sources” section, classify your host pools, and pick a consistent servicing model that matches your operational goals (consistency, uptime, testability).