Azure Update Manager pricing for on-prem (Arc) servers
Azure Update Manager charges per server per month for machines outside Azure and needs Azure Arc on each. The math at 100, 500, and 1,000 servers, and when a flat-priced on-prem console is cheaper.
With WSUS deprecated, Microsoft's recommended path for patching servers is Azure Update Manager. For machines that run in Azure it is included. For machines outside Azure (on-prem, other clouds) Microsoft lists a price of $5 per server per month, and each machine must be connected through Azure Arc (Azure Update Manager FAQ; check the page for current pricing in your region and agreement).
$5 sounds small. At fleet scale it is not.
The math#
| Servers outside Azure | Per month | Per year |
|---|---|---|
| 100 | $500 | $6,000 |
| 250 | $1,250 | $15,000 |
| 500 | $2,500 | $30,000 |
| 1,000 | $5,000 | $60,000 |
That is for update management only. It does not include configuration management, a security baseline, drift repair or approvals, and it assumes every machine can reach Azure.
What the price does not show#
- Connectivity. Every server needs Azure Arc and a path to Azure. Isolated networks, classified enclaves and plants with no internet access are out.
- Scope. It patches. Hardening, compliance scoring, drift, and change control are other tools, other bills.
- Growth. Per-server pricing grows linearly with the fleet, forever.
The flat-priced alternative#
Gardience is priced per fleet size, per year, not per server: Starter is $6,000 a year for up to 250 machines, Team is $15,000 a year for up to 1,000. On top of patching Windows and Linux, it includes a scored STIG/CIS-aligned baseline with one-click fixes, drift repair, event-driven automation, two-person approval, change windows, a tamper-evident audit log and a signed evidence pack. It runs on your own server, including fully air-gapped.
| Servers | Azure Update Manager (patching only, $5/server/month) | Gardience (patching, baseline, audit) |
|---|---|---|
| 250 | $15,000 a year | $6,000 a year (Starter) |
| 1,000 | $60,000 a year | $15,000 a year (Team) |
The numbers are list prices, and your Microsoft agreement may differ. What matters is the shape: per-server pricing for one job versus a flat price for the whole management stack.
When Azure Update Manager is the right call#
- Most of your servers already run in Azure.
- You want Microsoft's own tool and a Microsoft bill.
- Every machine can be Arc-connected.
If that is you, use it. If your servers are on-prem, mixed with Linux, or isolated, compare the full cost first.
Questions#
Is Azure Update Manager free?#
For machines running in Azure, Microsoft includes it. For Arc-enabled machines outside Azure, Microsoft lists a per-server monthly price; check the FAQ for current terms.
Can Azure Update Manager patch servers with no internet access?#
Machines must be connected to Azure through Azure Arc, so fully isolated networks are not a fit.
What does Gardience cost at 500 servers?#
500 machines fall in the Team tier: $15,000 a year for up to 1,000 machines, with a free 90-day trial for 25.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare