2.4 Hybrid SQL Server and IaaS Patching

DP-300: Administering Microsoft Azure SQL Solutions Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current DP-300 Exam Facts 1.2 Skills Outline and Domain Weights 1.3 Study Strategy and Official Resources

2 Planning and Deploying Azure SQL Solutions

2.1 Choosing and Deploying Azure SQL Database Offerings 2.2 Automated Deployment, Azure Arc, and SQL Database in Microsoft Fabric 2.3 Table Partitioning and Sharding Strategy 2.4 Hybrid SQL Server and IaaS Patching

3 Configuring Resources for Scale and Performance

3.1 Configuring Azure SQL Database for Scale and Performance 3.2 Configuring Azure SQL Managed Instance for Scale and Performance 3.3 Configuring SQL Server on Azure VMs for Scale and Performance 3.4 Configuring Table Partitioning and Data Compression

4 Planning and Implementing a Migration Strategy

4.1 Evaluating Migration Requirements and Strategies 4.2 Implementing Online, Offline, and Azure Migrations 4.3 Migrating Between Azure SQL Services and Troubleshooting

5 Configuring Database Authentication and Authorization

5.1 Microsoft Entra ID Authentication for Azure SQL 5.2 Authentication for SQL on Azure VMs and Managed Instance; Troubleshooting 5.3 Security Principals and Entra-Backed Users 5.4 Permissions, Least Privilege, and T-SQL Management

6 Implementing Security for Data at Rest and in Transit

6.1 Transparent Data Encryption and Object-Level Encryption 6.2 Always Encrypted and VBS Enclaves 6.3 Firewall Rules, Private Links, and Service Endpoints

7 Implementing Compliance Controls for Sensitive Data

7.1 Data Classification and Server/Database Auditing 7.2 Change Data Tracking and Dynamic Data Masking 7.3 Row-Level Security and Ledger in Azure SQL

8 Monitoring Resource Activity and Performance

8.1 Operational Baselines and Performance Metric Sources 8.2 Interpreting Metrics and Configuring Activity Monitoring 8.3 Monitoring with Database Watcher (Preview) 8.4 Monitoring with Extended Events

9 Monitoring and Optimizing Query Performance

9.1 Configuring and Monitoring with Query Store 9.2 Session Blocking and Dynamic Management Views 9.3 Index Changes and Execution Plan Review 9.4 Query Construct Modifications and Intelligent Insights

10 Configuring Database Solutions for Optimal Performance

10.1 Index, Statistics, and Integrity Maintenance 10.2 Automatic Tuning and Database-Scoped Configuration 10.3 Server Settings and Resource Governor 10.4 Compute/Storage Scaling and Intelligent Query Processing

11 Creating and Managing SQL Server Agent Jobs

11.1 Schedules for Regular Maintenance Jobs 11.2 Job Alerts, Notifications, and Agent Troubleshooting 11.3 Automating Deployment with ARM and Bicep Templates

12 Automating Deployments and Database Tasks in Azure

12.1 Azure PowerShell, Azure CLI, and Deployment Monitoring 12.2 Elastic Jobs for Cross-Database Automation 12.3 Azure Automation Runbooks, Alerts, and Troubleshooting Automated Tasks

13 Planning an HA/DR Strategy and Backup and Restore

13.1 Recommending HA/DR Strategy from RPO and RTO 13.2 Hybrid and Azure-Specific HA/DR Solutions and Testing 13.3 Backup and Restore Strategy with Native Tools 13.4 Point-in-Time Restore and Recovery Operations

14 Configuring HA/DR: Long-Term Retention, Geo-Replication, and Failover Groups

14.1 Long-Term Retention, T-SQL Backup/Restore, and Cloud Storage 14.2 Active Geo-Replication 14.3 Failover Groups

15 Advanced HA/DR: Availability Groups, FCIs, Log Shipping, and Troubleshooting

15.1 Always On Availability Groups on SQL Managed Instance and Azure VMs 15.2 Always On Failover Cluster Instances and Log Shipping 15.3 Monitoring and Troubleshooting HA/DR Solutions

2.4 Hybrid SQL Server and IaaS Patching

Key Takeaways Explain This Topic AI

The SQL Server IaaS Agent extension registers a VM with the SQL VM resource provider and enables automated patching, automated backup, and license-type switching between PAYG and Azure Hybrid Benefit with no downtime.

Automated patching lets you define a maintenance window; the engine installs only SQL Server cumulative updates and security updates marked applicable by Microsoft Update, skipping patches outside the window.

Cumulative updates (CUs) bundle all fixes since the baseline service pack and are recommended for production; General Distribution Releases (GDRs) contain only critical security fixes and are the default for branches that stay on the security-only update channel.

Azure Arc-enabled SQL Server extends patch management to on-premises and multi-cloud instances, exposing them in Azure as resources where you can assess patch status and apply updates centrally without migrating the databases.

For Always On availability groups, patch each replica in rolling fashion — patch and restart a secondary first, fail over, then patch the former primary — so the workload stays available throughout the patching cycle.

Last updated: August 2026

The Hybrid SQL Server Landscape

Quick Answer: In a hybrid estate, SQL Server runs in three places: on-premises, on Azure Arc-enabled hosts projected into Azure, and on SQL Server on Azure VMs managed by the SQL Server IaaS Agent extension . Patching each has its own automation, but the goal is the same: apply cumulative updates and security fixes inside a defined maintenance window without taking the workload down.

The DP-300 exam treats patching as a deployment-lifecycle responsibility that shifts with the hosting model. On Azure SQL Database and SQL Managed Instance, Microsoft applies updates transparently inside platform maintenance windows (with configurable maintenance windows in the General Purpose and Business Critical tiers). On SQL Server on Azure VMs and on Arc-enabled on-premises instances, you own patching — and the exam tests the automation that makes that tractable.

SQL Server IaaS Agent Extension

The SQL Server IaaS Agent extension is a free extension that registers the VM with the SQL VM resource provider . Registration can run in two modes. Lightweight mode only reports edition and license metadata and never touches the SQL Server service; it is the default for marketplace images and requires no restart. Full mode installs the agent that unlocks all management features and requires a one-time restart of the SQL Server service during installation. Many portal capabilities and licensing benefits are gated on full-mode registration.

Once the extension runs in full mode, it enables the three features the exam tests for this domain:

Automated patching — you define a maintenance window (day of week, start time, and duration). During the window the extension installs SQL Server updates that Microsoft Update marks applicable, including cumulative updates and critical security updates; patches outside the window are skipped. You can also disable automated patching to take full manual control, which is the right answer when a change advisory board must approve every update.

Automated backup — scheduled full, differential, and log backups to Azure storage with configurable retention, eliminating the need for a custom backup script on standalone VMs.

License management — the extension exposes a license type property that you can switch between Pay-As-You-Go (PAYG) and Azure Hybrid Benefit (AHUB) at any time as a metadata change, with no downtime and no redeployment.

License Type: PAYG vs Azure Hybrid Benefit

Two licensing models apply to SQL Server on Azure VMs. Pay-As-You-Go (PAYG) bundles the SQL Server license into the per-second VM price — zero procurement, highest steady-state cost, and the default for marketplace images that include licensing. Azure Hybrid Benefit (AHUB) lets you apply existing SQL Server licenses with active Software Assurance (or a qualifying subscription) and pay only the base compute rate, which can cut the SQL Server portion of the bill substantially for long-running production VMs. A third option, License-only (no AHUB, no PAYG billing for SQL Server), applies when the VM is used for dev/test under certain subscriptions that include free SQL Server licensing.

The operational fact the exam tests: through the SQL IaaS Agent extension you can change the license type at any time with no downtime and no redeployment — it is a metadata change on the registration. You do not need to rebuild the VM from a bring-your-own-license image. The exam frequently pairs this with a cost-optimization scenario where a company acquired Software Assurance mid-life and wants to apply it to an existing PAYG VM.

Cumulative Updates vs General Distribution Releases

SQL Server patching terminology matters on the exam. A Cumulative Update (CU) bundles all fixes released since the last baseline (service pack or base release) — fixes are cumulative, so installing the latest CU gets you everything. Microsoft recommends staying current with CUs for production systems and publishes a predictable CU cadence. A General Distribution Release (GDR) contains only critical security fixes and is the channel chosen when a workload must stay on the most conservative update path; GDRs do not include the functional and non-security fixes that CUs carry. A Service Pack was the old baseline-plus-rollup vehicle; modern SQL Server has largely moved to the CU model, and SQL Server 2022 onward does not ship service packs at all.

The decision rule the exam wants: choose the CU channel when you need the latest fixes and can validate them in a test environment; choose the GDR channel when policy mandates security-only updates. Either way, patch inside a maintenance window and validate that failover-aware steps are followed when the instance participates in an availability group.