How to use New-AzConfigurationAssignment Powershell cmdlet for Dynamic Scope for different subscriptions -Azure update manager

Question

I'm failing to set up Dynamic Scopes for my Maintenance Configuration related to VMs (InGuestPatching) with Powershell. I have created a maintenance configuration. Now I want to do the configuration assignment on number of virtual machines at scale using powershell over subscription level dynamic scope. But powershell cmdlet is failing to do so.

Import-Module Az.Accounts
Import-Module Az.Resources
Import-Module Az.Compute
Import-Module Az.Automation
Import-Module Az.Storage
Import-Module Az.KeyVault
Import-Module Az.Maintenance
Import-Module Az.Compute  

Set-AzContext -Subscription ""

$maintenanceconfig =  New-AzMaintenanceConfiguration -ResourceGroup $RGName -Name $configName -MaintenanceScope $scope -Location $location -StartDateTime $startDateTime -TimeZone $timeZone -Duration $duration -RecurEvery $recurEvery -WindowParameterClassificationToInclude $WindowsParameterClassificationToInclude -InstallPatchRebootSetting $RebootOption -ExtensionProperty @{"InGuestPatchMode"="User"}     

New-AzConfigurationAssignment -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2 -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}'

The above code is failing to create dynamic scope assignment and below is the error I am getting.

Error:

I don't know what exactly am I missing but this cmdlet is not working for me and MS documentation is lacking the information. Please suggest a solution for this

Answer 1

How to use New-AzConfigurationAssignment Powershell cmdlet for Dynamic Scope for different subscriptions -Azure update manager.

Here is the updated PowerShell script for creating a maintenance configuration for a VM.

    $RGName           = "RG-Name"
    $configName        = "workervmscentralus"
    $scope            = "InGuestPatch"
    $location         = "eastus2euap"
    $startDateTime    = "2024-03-09 12:30"
    $timeZone         = "UTC"
    $duration         = "3:00"
    $recurEvery       = "Day"
    $WindowsParameterClassificationToInclud = "apt","httpd"
    $RebootOption = "IfRequired"
    $Flocation  =  "eastus2euap,centraluseuap"
    $maintenanceconfig = New-AzMaintenanceConfiguration -ResourceGroupName v-nehrujir-Mindtree `
    -Name workervmseastus `
    -MaintenanceScope "InGuestPatch" `
    -Location eastus2 `
    -Timezone "UTC" `
    -StartDateTime "2025-10-09 12:30" `
    -Duration "3:00" `
    -RecurEvery "Day" `
    -LinuxParameterPackageNameMaskToInclude "apt","httpd" `
    -ExtensionProperty @{inGuestPatchMode="User"} `
    -InstallPatchRebootSetting "IfRequired" `
    
    
  $assignment = New-AzConfigurationAssignment -ResourceGroup $RGName -ResourceName "testvm" -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2  -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}' -Location centralus
    
 $assignment = New-AzConfigurationAssignment -ResourceGroup $RGName -ResourceName testvm -ConfigurationAssignmentName $maintenanceconfig.Name -MaintenanceConfigurationId $maintenanceconfig.Id -ProviderName Microsoft.Compute -ResourceType virtualMachines -FilterLocation eastus2 -FilterOsType Windows -FilterOperator "Any" -FilterTag '{"network_environment" : ["sb"]}' -Location centralus

To add dynamic scope into multiple subscription based filters, you can use the following code.

    $subscriptionnames = Get-AzSubscription | Select-Object -ExpandProperty Name
    foreach ($subscriptionname in $subscriptionnames) {
        Set-AzContext -Subscription $subscriptionname
        az maintenance assignment create-or-update-subscription --maintenance-configuration-id $maintenanceconfig.Id --subscription $subscriptionname --name $maintenanceconfig.Name --filter-locations centralus westus2 --filter-os-types windows linux --filter-tags '{"azsecpack":["nonprod"], "Department":["IT"]}' --filter-tags-operator All
    }

Output:

After executing the script, the dynamic scope has been created in Maintenance configuration.

Reference: az maintenance assignment create-or-update-subscription