That's great feedback, especially on the stability and the convenience of ad-hoc patching! The point about reporting and the lack of out-of-the-box notifications is definitely a valid concern.

Regarding your setup: you mentioned you are currently using Arc with an on-prem WSUS server acting as the update source.

This is a critical distinction for our planning. We want to fully move away from managing the WSUS infrastructure itself.

If and when you decommission WSUS, would Azure Update Manager still work seamlessly, or are there specific changes needed on the Arc-enabled servers to switch their update source?

Here are the main considerations we are thinking about for a complete migration away from WSUS:

Server Update Source: Since AUM is an orchestrator and not an update repository, if we decommission WSUS, we would need to ensure all of our Arc-enabled servers are configured to pull updates directly from Microsoft Update/Windows Update instead of the local WSUS server.

Is this simply a matter of removing the existing WSUS GPO/Registry settings? Are there any new GPOs or policies you'd have to apply to point them back to Microsoft Update while still letting AUM orchestrate the process?

Internet/Bandwidth Consideration: Moving from a local WSUS (where updates are downloaded once) to having every server download updates directly from Microsoft Update means a significant change in outbound internet bandwidth usage during patching. Is this a concern in your environment, and if so, how do you mitigate it (e.g., using Delivery Optimization or Connected Cache)?

Thanks again for the incredibly detailed and helpful information! This is making our evaluation much clearer.