使用Bicep部署Azure Update Manager时维护配置分配失败

云上老周

2026-7-1

Azure Update Manager维护配置分配部署失败问题排查与解决

我们使用Bicep部署Azure Update Manager时，maintenanceConfiguration部分可正常部署，但maintenanceConfigurationAssignment始终创建失败。

报错信息

最初报错

New-AzResourceGroupDeployment: C:\Scripts\maintenance Configuration\powershell\deploy-resource.ps1:10:1
Line |
10 | New-AzResourceGroupDeployment `
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 11:19:09 - The deployment 'DeployLocalTemplate' failed with error(s). Showing 1 out of 1 error(s). Status Message: Patch configuration is only applicable for InGuestPatch scope (Code:) CorrelationId: 5754e928-5fc3-4f2a-95ff-e40f9f7bac4c

最新测试报错

PS C:\Scripts\maintenance Configuration> . 'C:\Scripts\maintenance Configuration\powershell\deploy-resource.ps1'
VERBOSE: Using Bicep v0.24.24
WARNING: C:\Scripts\maintenance Configuration\bicep\main.bicep(20,7) : Warning no-unused-params: Parameter "subscription" is declared but never used.
VERBOSE: Performing the operation "Creating Deployment" on target "infr-automation-weu-rg".
VERBOSE: 11:19:58 - Template is valid.
VERBOSE: 11:19:59 - Create template deployment 'DeployLocalTemplate'
VERBOSE: 11:19:59 - Checking deployment status in 5 seconds
VERBOSE: 11:20:04 - Resource Microsoft.Maintenance/maintenanceConfigurations 'upd-group3-dtap-06am-pt-02-2024' provisioning status is succeeded
New-AzResourceGroupDeployment: C:\Scripts\maintenance Configuration\powershell\deploy-resource.ps1:10:1
Line |
10 | New-AzResourceGroupDeployment `
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 11:20:04 - The deployment 'DeployLocalTemplate' failed with error(s). Showing 1 out of 1 error(s). Status Message: Provided combination of resource type Microsoft.WindowsAzure.Deployment.MRP.Validators.DefaultResourceRequest and maintenance
| Configuration scope InGuestPatch isn't supported. Resource: /subscriptions/f45372af-b935-4a3d-9ec3-2e4884fb186f/resourcegroups/infr-automation-weu-rg (Code:UnsupportedResourceOperation) CorrelationId: 4d7eb050-1c10-45be-a462-eecd7e7b3774
DeploymentName : DeployLocalTemplate
ResourceGroupName : infr-automation-weu-rg
ProvisioningState : Failed
Timestamp : 23/01/2024 10:20:03
Mode : Incremental
TemplateLink :
Parameters :
Name Type Value
=============================== ========================= ==========
maintenanceConfigurationsName String "upd-group3-dtap-06am-pt-02-2024"
location String "westeurope"
rebootSetting String "Always"
resourceId String "994a56f5-8fd9-41cf-be99-204a5b54875d"
targetTag Object {"InSpark_ManagedUpdateGroup":"infr-upd-group2"}
subscription String "f45372af-b935-4a3d-9ec3-2e4884fb186f"
Outputs :
DeploymentDebugLogLevel :

现有Bicep代码

param maintenanceConfigurationsName string = 'upd-group3-dtap-06am-pt-02-2024'

@description('Default location')
param location string = 'westeurope'

@description('Defined rebootSetting')
@allowed([
  'IfRequired'
  'Always'
  'Never'
])
param rebootSetting string = 'Always'

param resourceId string = newGuid()

param targetTag object = {
  InSpark_ManagedUpdateGroup: 'infr-upd-group2' 
}

param subscription string = 'f45372af-b935-4a3d-9ec3-2e4884fb186f'

resource maintenanceConfiguration 'microsoft.maintenance/maintenanceconfigurations@2023-09-01-preview' = {
  name: maintenanceConfigurationsName
  location: location
  tags: {
    inSpark_InfrastructureManagedBy: 'xxxxxx'
  }
  properties: {
    extensionProperties: {
      InGuestpatchMode: 'User'
    }
    maintenanceScope: 'InGuestPatch'
    maintenanceWindow: {
      startDateTime: '2024-01-23 06:00'
      expirationDateTime: '2024-01-25 06:00'
      duration: '03:55'
      timeZone: 'W. Europe Standard Time'
      recurEvery: 'Day'
    }
    visibility: 'Custom'
    installPatches: {
      rebootSetting: rebootSetting
      windowsParameters: {
        classificationsToInclude: [
          'Critical'
          'Security'
        ]
      }
      linuxParameters: {
        classificationsToInclude: [
          'Critical'
          'Security'
        ]
      }
    }
  }
}

resource maintenanceConfigurationAssignment 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
  name: 'assignment'
  location: location
  scope: maintenanceConfiguration
  properties: {
    filter: {
      tagSettings: {
        filterOperator: 'Any'
        tags: targetTag 
      }
    }
    maintenanceConfigurationId: maintenanceConfiguration.id
    resourceId: resourceId
  }
}

问题分析与修复方案

核心问题点

分配作用域错误：InGuestPatch类型的维护配置，其分配应作用于订阅、资源组或具体VM/VMSS，而非维护配置本身。当前模板中scope设为maintenanceConfiguration不符合要求。
无效的resourceId参数：用newGuid()生成随机值作为resourceId是错误的，该字段应指向目标范围的实际ID（如资源组或订阅ID）。
API版本不匹配：维护配置使用2023-09-01-preview，但分配使用2023-04-01，版本不一致可能引发兼容性问题。

修改后的Bicep模板示例

param maintenanceConfigurationsName string = 'upd-group3-dtap-06am-pt-02-2024'

@description('Default location')
param location string = 'westeurope'

@description('Defined rebootSetting')
@allowed([
  'IfRequired'
  'Always'
  'Never'
])
param rebootSetting string = 'Always'

param targetTag object = {
  InSpark_ManagedUpdateGroup: 'infr-upd-group2' 
}

// 目标范围：资源组ID，若需订阅级分配可改为subscription().id
param targetScopeResourceId string = resourceGroup().id

resource maintenanceConfiguration 'microsoft.maintenance/maintenanceconfigurations@2023-09-01-preview' = {
  name: maintenanceConfigurationsName
  location: location
  tags: {
    inSpark_InfrastructureManagedBy: 'xxxxxx'
  }
  properties: {
    extensionProperties: {
      InGuestpatchMode: 'User'
    }
    maintenanceScope: 'InGuestPatch'
    maintenanceWindow: {
      startDateTime: '2024-01-23 06:00'
      expirationDateTime: '2024-01-25 06:00'
      duration: '03:55'
      timeZone: 'W. Europe Standard Time'
      recurEvery: 'Day'
    }
    visibility: 'Custom'
    installPatches: {
      rebootSetting: rebootSetting
      windowsParameters: {
        classificationsToInclude: [
          'Critical'
          'Security'
        ]
      }
      linuxParameters: {
        classificationsToInclude: [
          'Critical'
          'Security'
        ]
      }
    }
  }
}

// 配置分配作用于目标资源组
resource maintenanceConfigurationAssignment 'Microsoft.Maintenance/configurationAssignments@2023-09-01-preview' = {
  name: '${maintenanceConfigurationsName}-assignment'
  location: location
  scope: resourceGroup()
  properties: {
    filter: {
      tagSettings: {
        filterOperator: 'Any'
        tags: targetTag 
      }
    }
    maintenanceConfigurationId: maintenanceConfiguration.id
    resourceId: targetScopeResourceId
  }
}

额外注意事项

移除未使用的subscription参数，消除linter警告。
确保分配的location与维护配置的location保持一致。
若需要订阅级分配，将scope改为subscription()，同时targetScopeResourceId设为subscription().id。

内容的提问来源于stack exchange，提问作者Andrees van Goozen

使用Bicep部署Azure Update Manager时维护配置分配失败

报错信息 #

最初报错 #

最新测试报错 #

现有Bicep代码 #

问题分析与修复方案 #

核心问题点 #

修改后的Bicep模板示例 #

额外注意事项 #