If you run Azure Local in a site with a thin pipe to Azure, an edge location, a regulated environment, or a fully disconnected sovereign deployment, you’ve felt the pain. Every solution update wants to pull gigabytes down the wire, and “intermittently connected” is a polite way of saying “this will time out at 80%”. For a while the only sane workaround was to stage things by hand and pray.
That changed quietly, and this post is the practical walkthrough I wish I’d had.
Since when can you do this?
The ability to download only the solution update as a static payload and import it offline has been a supported feature since Azure Local 2411.3. Make sure you run Azure Local 2411.3 or later to use this feature. This feature is available in Azure Local 2411.3 and later.
The bit you spotted in the portal, the Download dropdown on Azure Arc → Azure Local → Get started → Download software, with its two children “Download Local HCI OS” and “Azure local update”, is the GUI on top of that. “Download Local HCI OS” gives you the full operating system image for a fresh deployment. “Azure local update” gives you just the update package, which is exactly what you want when the OS is already on the box and you only need to move it forward a version.
It’s no accident this matured alongside Microsoft’s disconnected-operations push. Microsoft Sovereign Cloud’s expansion of capabilities includes Azure Local disconnected operations. Offline update import is one of the unglamorous building blocks that makes “runs even when completely disconnected” actually true.
What you’re actually downloading
Don’t picture a tidy little patch. The thing you pull is the CombinedSolutionBundle. The CombinedSolutionBundle is a zip file that contains the update package for the Azure Stack HCI OS, core agents and services, and the solution extension. It is named CombinedSolutionBundle.<build number>.zip, where <build number> is the build number for the release.
So in one archive you get the OS security update, the core agents, and the solution extension. That’s the 3.7 GB you saw next to build 12.2605.1003.210 in the package blade.
The important caveat, the one that bites people in genuinely air-gapped sites: the update process automatically downloads updated container images required for the Azure Arc resource bridge component and Azure Kubernetes Service on Azure Local. These images aren’t included in the static payload. So if you run Arc Resource Bridge or AKS on Azure Local, the bundle is not the whole story, because those images still get pulled during the update itself. Plan your connectivity window accordingly.
One more practical note from the docs, because timing trips people up: you might need to wait up to 24 hours after the release for the latest version of the CombinedSolutionBundle and its SHA256 hash to be available. If the freshest build isn’t downloadable the day it lands, that’s why. It’s not you.
Route 1: the portal
This is the friendly path and the one most people will use:
- Open Azure Arc → Azure Local → Get started.
- In 2. Download software, click Download ▾ and choose Azure local update.
- On the Azure Local package blade, set Current Azure Local solution version to the train you’re targeting (your screenshot shows
2604). - Tick the build you want, for example
12.2605.1003.210, 3.7 GB, and hit Download package.
That gives you the bundle on your jump box. From here you still finish the job with PowerShell on the cluster, so let’s do the full hands-on route. It’s the one worth knowing cold.
Route 2: PowerShell, end to end
This is the canonical offline flow, and it’s the one to script if you manage more than one instance. Download once, copy to many.
Step 1: Download the bundle and verify it. Grab the download URI and the SHA256 from the release table, then:
# Download the CombinedSolutionBundle
Invoke-WebRequest `
-Uri "<download URI>" `
-OutFile "C:\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\import\CombinedSolutionBundle.<build number>.zip"
# Check the SHA256 hash of the downloaded CombinedSolutionBundle
Get-FileHash -Path "<path to CombinedSolutionBundle.zip>"Use the SHA256 hash to check the integrity of your download. On a flaky link this is not optional, because a truncated bundle will fail you halfway through an update, which is the worst possible time.
Step 2: Stage and import. Create the discovery folder in the infrastructure volume, drop the zip in, extract to a Solution subfolder, and import:
# Create a folder for the update service to discover
New-Item C:\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\import -ItemType Directory
# Extract the contents of the CombinedSolutionBundle to the Solution subfolder
Expand-Archive `
-Path C:\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\import\CombinedSolutionBundle.<build number>.zip `
-DestinationPath C:\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\import\Solution
# Import the package into the update service
Add-SolutionUpdate -SourceFolder C:\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\import\SolutionStep 3: Discover and start. The update service indexes asynchronously, so be patient and re-run the discovery cmdlet. To discover the updates, run the Get-SolutionUpdate command. The update service discovers updates asynchronously, so you might need to run the Get-SolutionUpdate command more than once.
Get-SolutionUpdateThen watch for one specific state: if the update returns a state of AdditionalContentRequired, follow the instructions in Update Azure Local via PowerShell to import the required Solution Builder Extension (SBE) updates. If it doesn’t, continue to the next step. If you’re on vendor-integrated hardware (Dell, HPE, Lenovo, and friends), expect to feed in the matching SBE package too, because the OS bundle alone won’t satisfy the health checks.
Once it shows ready, kick off the update the same way you would online.
The gotchas worth tattooing on your monitor
- Container images still pull live. Arc Resource Bridge and AKS images are not in the bundle. True air-gap needs a separate plan for those. These images aren’t included in the static payload.
- Always check the hash.
Get-FileHashbefore you import, every time. AdditionalContentRequiredis not a failure. It just means “I also need your SBE.” Import it and carry on.- Mind the 24-hour availability lag on brand-new builds. You might need to wait up to 24 hours after the release.
- Right bundle for the right OS family. For 25398.xxxx builds, use the CombinedSolutionBundle to update the OS and solution components for Azure Local. For 26100.xxxx builds, use the CombinedSolutionBundle to install a specific Azure Local version.
The headline is simple: download once, import many, update offline, and it’s been there since 2411.3. The portal’s “Azure local update” download just makes the front door obvious. For anyone running Azure Local at the edge or inside a sovereign boundary, this is the difference between an update window that fits your maintenance slot and one that doesn’t.
