AzureInPlaceUpgrade

Prerequisites

Compute actions rather than a built-in role, so the deployment ships a custom role with exactly this list.

Software

PowerShell 7.2 or later
Az.Accounts, Az.Compute and Az.Resources
A Windows Server 2016, 2019 or 2022 guest with the Azure VM agent healthy
Azure CLI with Bicep, for the fleet deployment only

Who needs which role

Option 1

Run commands yourself

Your own account holds these, on the VMs you upgrade.

Microsoft.Compute/virtualMachines/ — read, write, instanceView/read, runCommand/action
Microsoft.Compute/disks/ — read, write, delete
Microsoft.Compute/snapshots/ — read, write
Microsoft.Compute/locations/publishers/ — artifacttypes/offers/skus/versions/read

Option 2

Deploy the orchestrator

A managed identity holds these. The deployment creates the custom role and assigns it.

Everything in option 1
Microsoft.Resources/tags/write
Microsoft.Network/networkInterfaces/join/action
Monitoring Metrics Publisher — the data collection rule

Virtual Machine Contributor covers every action above except Microsoft.Compute/snapshots/*, which is the rollback point — that gap is why the deployment ships a custom role rather than using the built-in one. To run the deployment: Owner or User Access Administrator on the subscription, to create the role definition and assign it. Test-InPlaceUpgradeReadiness needs only the read actions plus runCommand/action; the exact list per command is in the command reference.

Before you tag production

Microsoft's own caution applies unchanged — an in-place upgrade disconnects the VM's data plane from its control plane, and auto guest patching, automatic OS image upgrades, hotpatching and Azure Update Manager may not work afterwards. If the VM is built from code and replaceable, redeploy it on a 2025 image instead. This is for the servers that are expensive to rebuild.

Do not use in place for	Why	Do this instead
Domain controllers	Microsoft advises against it; AD improvements in 2025 need a clean install	Promote new DCs, demote old ones
Failover cluster nodes	Not a supported in-place path	Cluster-Aware Updating or a rolling upgrade
Datacenter: Azure Edition	Hotpatch servicing model, different media	Redeploy on the 2025 Azure Edition image
Ephemeral or unmanaged OS disks	No snapshot, or not supported at all	Migrate to managed disks, or redeploy
Non-en-US installs	The upgrade media is en-US only	Change the system language, or redeploy
Retail or OEM activated guests	The media requires volume licensing	Convert to a KMS client key first
Anything without a tested restore	A snapshot you never restored is a hope	Restore once in a lab, then proceed

Read "When not to use this" in full

← Overview·Deploy·Commands