Use the Knowledge Base AI to help improve your Cloud Posture

Configure Preferred Maintenance Window for Scheduled Updates

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that your Azure Cache for Redis servers are configured with a preferred maintenance window for scheduled updates. Before running this conformity rule, the preferred maintenance window must be configured in the rule settings, in your Trend Cloud One™ – Conformity account.

Reliability

When you configure a maintenance window, you can specify the exact days and times each week when the virtual machines powering your Redis cache can be updated. Azure Cache for Redis will complete updates to the cache software within the timeframe you set. Because your Azure Cache for Redis instance may become unavailable during scheduled updates, you may want to configure the maintenance window to a time in which your cache server is under its lowest load. This time frame represents the preferred maintenance window and must be compliant with the time range configured in the conformity rule settings.


Audit

To determine if there is a preferred maintenance window configured for your Azure Cache for Redis servers, perform the following operations:

Using Azure Portal

01 Sign in to your Trend Cloud One™ – Conformity account, access Configure Preferred Maintenance Window for Scheduled Updates conformity rule settings, and identify the preferred maintenance window defined for your Azure Cache for Redis servers.

02 Sign in to the Microsoft Azure Portal.

03 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

04 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

05 From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Cache for Redis for Value, then choose Apply to list the Azure Cache for Redis servers available in the selected subscription.

06 Click on the name (link) of the Azure Cache for Redis server that you want to examine.

07 In the resource navigation panel, under Settings, select Schedule updates.

08 In the Schedule updates section, ensure that the Enable setting checkbox is selected, and check the start hour (UTC) for each active (enabled) day of the week to determine the maintenance window configured for the selected Redis cache server. Compare the cache server maintenance window with the one defined in the conformity rule settings. If the server maintenance window is different than the one identified in step no. 1, the preferred maintenance window set for the selected Azure Cache for Redis server is not compliant.

09 Repeat steps no. 6 - 8 for each Azure Cache for Redis server deployed in the selected Azure subscription.

10 Repeat steps no. 4 – 9 for each Azure subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Sign in to your Trend Cloud One™ – Conformity account, access Configure Preferred Maintenance Window for Scheduled Updates conformity rule settings, and identify the preferred maintenance window defined for your Azure Cache for Redis servers.

02 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

03 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

04 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	-subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

05 Run redis list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure Cache for Redis server available in the selected subscription:

az redis list
	--output table
	--query '[*].{name:name, resourceGroup:resourceGroup}'

06 The command output should return the requested cache server identifiers:

Name                        ResourceGroup
-------------------------   ------------------------------
cc-project5-redis-cache     cloud-shell-storage-westeurope
cc-main-app-redis-cache     cloud-shell-storage-westeurope

07 Run redis patch-schedule show command (Windows/macOS/Linux) with the name of the Azure Cache for Redis server that you want to examine as the identifier parameter and custom output filters to determine the maintenance window configured for scheduled updates, for the selected cache server:

az redis patch-schedule show
	--name cc-project5-redis-cache
	--resource-group cloud-shell-storage-westeurope
	--query 'scheduleEntries'

08 The command output should return the maintenance window start hour (UTC) for each active (enabled) day of the week:

[
	{
		"dayOfWeek": "Sunday",
		"maintenanceWindow": "5:00:00",
		"startHourUtc": 10
	},
	{
		"dayOfWeek": "Friday",
		"maintenanceWindow": "5:00:00",
		"startHourUtc": 10
	},
	{
		"dayOfWeek": "Saturday",
		"maintenanceWindow": "5:00:00",
		"startHourUtc": 10
	}
]

If the redis patch-schedule show command output returns the ResourceNotFound error, i.e., (ResourceNotFound) There are no patch schedules found for redis cache '\<cache-server-name\>', maintenance window for scheduled updates is not enabled for the selected Redis cache server. If the command output returns the patching schedule for one or more days, as shown in the example above, check the start hour (i.e., "startHourUtc" attribute value) for each active day of the week to determine the maintenance window configured for the selected cache server. Compare the cache server maintenance window with the one defined in the conformity rule settings. If the server maintenance window is different than the one identified in step no. 1, the preferred maintenance window set for the selected Azure Cache for Redis server is not compliant.

09 Repeat step no. 6 and 7 for each Azure Cache for Redis server available within the current Azure subscription.

10 Repeat steps no. 3 – 8 for each Azure subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

To configure the preferred maintenance window for scheduled updates, for your Azure Cache for Redis servers, perform the following operations:

Using Azure Portal

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

04 From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Cache for Redis for Value, then choose Apply to list the Azure Cache for Redis servers available in the selected subscription.

05 Click on the name (link) of the Azure Cache for Redis server that you want to configure.

06 In the resource navigation panel, under Settings, select Schedule updates.

07 In the Schedule updates section, perform the following actions:

  1. Ensure that the Enable setting checkbox is selected (checked).
  2. Use the control slider for each active (selected) day of the week to set the start hour (UTC) to a time in which your Azure Cache for Redis server is under its lowest load, as defined in the conformity rule settings, in your Trend Cloud One™ – Conformity account.
  3. Choose Save to apply the configuration changes.

08 Repeat steps no. 5 – 7 for each Azure Cache for Redis server that you want to configure, available within the selected subscription.

09 Repeat steps no. 3 – 8 for each Azure subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to access as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run redis patch-schedule update command (Windows/macOS/Linux) with the name of the Azure Cache for Redis server that you want to configure as the identifier parameter, to set the preferred maintenance window as defined in the conformity rule settings, in your Trend Cloud One™ – Conformity account:

az redis patch-schedule update
	--name cc-project5-redis-cache
	--resource-group cloud-shell-storage-westeurope
	--schedule-entries '[{"dayOfWeek":"Friday","startHourUtc":"02","maintenanceWindow":"PT5H"},{"dayOfWeek":"Saturday","startHourUtc":"02","maintenanceWindow":"PT5H"},{"dayOfWeek":"Sunday","startHourUtc":"02","maintenanceWindow":"PT5H"}]'.

05 The command output should return the patching schedule information for the modified Redis cache server:

{
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Cache/Redis/cc-project5-redis-cache/patchSchedules/default",
	"location": "West Europe",
	"name": "cc-project5-redis-cache/default",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"scheduleEntries": [
		{
			"dayOfWeek": "Friday",
			"maintenanceWindow": "5:00:00",
			"startHourUtc": 2
		},
		{
			"dayOfWeek": "Saturday",
			"maintenanceWindow": "5:00:00",
			"startHourUtc": 2
		},
		{
			"dayOfWeek": "Sunday",
			"maintenanceWindow": "5:00:00",
			"startHourUtc": 2
		}
	],
	"type": "Microsoft.Cache/Redis/PatchSchedules"
}

06 Repeat steps no. 4 and 5 for each Azure Cache for Redis server that you want to configure, available in the selected subscription.

07 Repeat steps no. 3 – 6 for each Azure subscription created in your Microsoft Azure cloud account.

References

Publication date May 12, 2025