VM security & operations
AWS Systems Manager Patch Manager vs Azure Update Manager
AWS Systems Manager Patch Manager maps to Azure Update Manager.
Both scan and patch Windows and Linux machines on schedules, in the cloud and on-premises (through hybrid activations or Azure Arc).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Systems Manager Patch Manager | Azure Update Manager |
| Lifecycle | Generally available | Generally available |
| What it is | Scans and installs OS and application patches on managed nodes, using patch baselines, maintenance windows, and Quick Setup patch policies across accounts and Regions. | Assess and install OS updates on Azure VMs and Arc-enabled servers, with maintenance configurations, periodic assessment, and hotpatching. |
| Pricing model | Patch Manager is free for EC2. On-premises nodes on the advanced tier are billed per node-hour. | Free for Azure VMs. Arc-enabled servers are billed per server per day when managed, unless included with Azure Local, Arc-enabled ESUs, or Defender for Servers Plan 2. |
| Docs | AWS Systems Manager Patch Manager docs | Azure Update Manager docs |
| Pricing page | AWS Systems Manager Patch Manager pricing | Azure Update Manager pricing |
| Exams | SOA-C03 | AZ-104 |
Key differences
- Control. Patch Manager uses patch baselines (approval rules), patch groups, maintenance windows, and Quick Setup patch policies across accounts and Regions. Update Manager uses maintenance configurations, dynamic scopes, periodic assessment, and Azure Policy.
- Azure extras. Hotpatching (critical updates without reboot on supported Windows Server editions) and automatic VM guest patching.
- Hybrid. On AWS, on-premises nodes register as hybrid managed nodes. On Azure, they must be Arc-enabled servers.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Patch Manager is free for EC2. On-premises nodes on the advanced tier are billed per node-hour. AWS Systems Manager Patch Manager pricing →
- Azure
- Free for Azure VMs. Arc-enabled servers are billed per server per day when managed, unless included with Azure Local, Arc-enabled ESUs, or Defender for Servers Plan 2. Azure Update Manager pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Systems Manager Patch Manager?
AWS Systems Manager Patch Manager maps to Azure Update Manager. Both scan and patch Windows and Linux machines on schedules, in the cloud and on-premises (through hybrid activations or Azure Arc).
How does pricing compare between AWS Systems Manager Patch Manager and Azure Update Manager?
AWS: Patch Manager is free for EC2. On-premises nodes on the advanced tier are billed per node-hour. Azure: Free for Azure VMs. Arc-enabled servers are billed per server per day when managed, unless included with Azure Local, Arc-enabled ESUs, or Defender for Servers Plan 2. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified CloudOps Engineer – Associate (SOA-C03); Microsoft Certified – Azure Administrator Associate (AZ-104).