Unattended in-place Windows Server upgrades for Azure VMs, one by name or a tagged fleet from a runbook: preflight, OS disk snapshot, detached Windows Setup, state tracking across Azure Automation jobs and in-guest validation.

Credential lifecycle for Azure VMs that cannot use Windows LAPS or Entra login. Rotates local admin passwords and SSH keys, driven by Key Vault expiry dates.

Decides which Azure VMs should be off, proves what that saved, and delegates the power operation to Azure.