WSUS Is Deprecated, Not Dead: The Real Migration Path to Azure Update Manager

WSUS has been deprecated since September 2024, meaning no new features, no new investment, and no accepted feature requests, but it’s still fully supported and shipping in Windows Server 2025 through that OS’s full lifecycle, roughly to 2035. That combination confuses a lot of admins into either panicking about an imminent shutdown or ignoring the deprecation entirely. Neither reaction is right. Here’s what deprecated actually means in practice, and the real migration path Microsoft is steering everyone toward.

What “deprecated” actually means for WSUS specifically

Deprecated is not removed, and it’s not an announced shutdown date. WSUS continues to function, continues to be supported for the lifecycle of the Windows Server versions that ship it, and Microsoft has stated no current plans to remove it from in-market Windows Server versions including 2025. What deprecation does mean: no new features, no new capabilities, and Microsoft’s own patching and update-management investment is going entirely into its cloud-based tooling instead. If you keep running WSUS, it keeps working, it just stops getting better, and every new Microsoft update-management capability going forward lands somewhere else.

The actual replacement path, split by workload type

Microsoft’s guidance splits cleanly along client versus server lines, and treating them as one migration project is a common mistake:

• For Windows client devices (Windows 10, Windows 11): the replacement path is Microsoft Intune combined with Windows Update for Business policies, orchestrated through Windows Autopatch for organizations that want a largely automated, Microsoft-managed patch ring structure rather than building one manually.
• For servers: the replacement is Azure Update Manager, which extends to on-premises servers and even other clouds through Azure Arc, meaning you don’t need your servers to actually live in Azure to use it, Arc-enabling an on-premises server brings it into Azure Update Manager’s management scope.

This split matters because a lot of organizations’ WSUS deployments cover both clients and servers under one system, migrating away needs a plan that acknowledges these are genuinely different target tools with different licensing and onboarding requirements, not a single like-for-like replacement.

Getting started with the server-side migration

# High-level path for bringing an on-premises server under Azure Update
# Manager via Azure Arc (verify current exact steps against Microsoft's
# official documentation, this workflow evolves):

# 1. Install the Azure Connected Machine agent on the target server
#    to Arc-enable it
# 2. Confirm the server appears as an Arc-enabled resource in the
#    Azure portal
# 3. Enable Azure Update Manager for that resource
# 4. Define update schedules/maintenance configurations through
#    Azure Update Manager rather than WSUS Group Policy targeting

Run this as a pilot against a small, non-critical server group first, not a fleet-wide cutover, patch scheduling, approval workflows, and reporting all work differently in Azure Update Manager than in WSUS, and it’s worth working out the operational differences on low-risk systems before it’s your production domain controllers or line-of-business servers depending on the new process working correctly.

Should you actually migrate now, or is this safe to defer?

This isn’t urgent in the sense of an approaching shutdown, since none is currently announced. It is worth planning deliberately rather than indefinitely deferring, for a few concrete reasons: new Windows Server security and management capabilities are increasingly being built cloud-first, meaning WSUS-only shops may find themselves missing tooling improvements other admins get by default, and migrations planned proactively are generally smoother than migrations forced by a future deadline that does eventually get announced. Treat this as “worth a deliberate roadmap item this year or next,” not “drop everything,” and definitely not “ignore indefinitely.”

Frequently asked questions

Will WSUS stop working if we don’t migrate?
Not based on anything currently announced, WSUS remains supported for the lifecycle of the Windows Server versions shipping it, including through Windows Server 2025’s support window. Deprecated means no new investment, not an active shutdown, verify against Microsoft’s current official deprecation announcement directly for the latest status, since this kind of statement can be updated over time.

Do we need Azure subscriptions for every server to use Azure Update Manager via Arc?
Azure Arc-enabling an on-premises server does require an Azure subscription for management purposes, even though the server itself continues running on-premises, it’s registered as an Azure resource for management and billing purposes. Review current Azure Update Manager and Arc pricing directly against your specific server count and usage pattern before committing to a migration timeline.

Can we run WSUS and Azure Update Manager simultaneously during a phased migration?
Running both during a transition period is a reasonable approach for a phased migration, but avoid having both systems actively managing updates for the exact same servers simultaneously, that risks conflicting update schedules or approval states. Migrate server groups cleanly from one system to the other rather than leaving individual servers under dual management long-term.