Can I use Azure Update Manager and SCCM together to patch the same servers?

You should not patch the same server with both SCCM and Azure Update Manager at the same time. Unlike Intune co-management, there is no supported “co-management” model between SCCM and Azure Update Manager — both systems control Windows Update Agent (WUA) policies independently, and conflicts can occur.Supported approaches Technically yes, but not recommended without separation. You must ensure:

Option 1 – Hybrid environment with clear separation

Use SCCM for all on-premises and domain-joined servers.

Use Azure Update Manager (via Azure Arc) for cloud-native, workgroup, or isolated servers not reachable by SCCM. This is the most common and supported design.

Option 2 – Transition scenario

If you are moving workloads from SCCM to Azure:

Remove the WSUS GPO settings on the target machines.

Disable the SCCM software update agent (CCM Software Updates Agent).

Register those servers to Azure Arc and onboard them to Update Manager. Now they will use Microsoft Update directly.

Option 3 – Reporting-only

You can still use Azure Update Manager in “reporting” mode (view compliance data) while SCCM performs patching — but disable automatic update deployment in Update Manager.

Supported approaches

Option 1 – Hybrid environment with clear separation

Use SCCM for all on-premises and domain-joined servers.

Use Azure Update Manager (via Azure Arc) for cloud-native, workgroup, or isolated servers not reachable by SCCM.
This is the most common and supported design.

Option 2 – Transition scenario

If you are moving workloads from SCCM to Azure:

Remove the WSUS GPO settings on the target machines.

Disable the SCCM software update agent (CCM Software Updates Agent).

Register those servers to Azure Arc and onboard them to Update Manager.
Now they will use Microsoft Update directly.

Option 3 – Reporting-only

You can still use Azure Update Manager in “reporting” mode (view compliance data) while SCCM performs patching — but disable automatic update deployment in Update Manager.

Split Responsibility by Environment

• Use SCCM for on-premises and hybrid servers
• Use Azure Update Manager for pure Azure VMs or Arc-enabled servers not managed by SCCM

2. Avoid Double Patching

• Disable Windows Update for Business and Update Manager on SCCM-managed servers
• In Azure Update Manager, exclude servers that are SCCM clients

3. Use Tags or Groups

• Tag Azure VMs with PatchBy=SCCM or PatchBy=UpdateManager
• Use these tags to scope update deployments

4. Monitor Compliance Separately

• Use SCCM reports for on-prem patch compliance
• Use Azure Update Manager dashboard for cloud patch status

This is documented here as well that this is not a recommended solution: https://learn.microsoft.com/en-us/azure/update-manager/guidance-migration-azure#guidance-to-use-azure-update-manager-on-mcm-managed-machines

• Azure Update Manager and MCM co-existence means that once Azure Update Manager is enabled, MCM should only be used for capabilities other than software updates management.
• Azure Update Manager and MCM shouldn't be used simultaneously to manage software updates or patches to same set of servers.