I have Azure Scale Set with a custom Windows VM image (syspreped Windows 2016 DC image with some app preinstalled).
There is an option to enable Windows automatic updates on the operating system, level, but I'm missing information how it affects the scale out scenario.
For example I could have 3-months old VM image, not joined to any Active Directory domain. What is going to happen when new machines will be added to a scale set?
Windows Update will be enabled on the machine. The updates will be applied later and if required, reboot the new scaled out instances.
If desired, you may wish to deploy a startup script to apply all updates prior to your application starting up.