AzureUpdateManagement.ps1

function Get-SoftwareUpdateConfigurations {
    [CmdletBinding(DefaultParameterSetName = 'list')]
    param (
        [Parameter(Mandatory)]
        [ValidateNotNullOrEmpty()]
        [string] $ResourceGroupName,

        [Parameter(Mandatory)]
        [ValidateNotNullOrEmpty()]
        [string] $AutomationAccountName,

        [Parameter(ParameterSetName = 'named')]
        [ValidateNotNullOrEmpty()]
        [string] $Name

    )
    $currentContext = Get-AzureRmContext
    $token = $currentContext.TokenCache.ReadItems() |
        Where-Object -FilterScript {
        $_.tenantid -eq $currentContext.Tenant.Id -and 
        $_.Resource -eq 'https://management.core.windows.net/'
    }

    $uri = "https://management.azure.com/subscriptions/$($currentContext.Subscription.Id)/resourceGroups/$ResourceGroupName/" + 
    "providers/Microsoft.Automation/automationAccounts/$AutomationAccountName/softwareUpdateConfigurations?api-version=2017-05-15-preview"

    $result = Invoke-RestMethod -UseBasicParsing -Uri $uri -Headers @{
        Authorization = "Bearer $($token.AccessToken)"
        'Content-Type' = 'application/json'
    }
    foreach ($r in $result.value) {
        if ($PSBoundParameters.ContainsKey('Name') -and $r.Name -notlike $Name) {
            continue
        }
        $r.PSObject.TypeNames.Insert(0, 'Update.Configuration')
        $r
    }
}

function Remove-SoftwareUpdateConfigurations {
    [CmdletBinding(SupportsShouldProcess, ConfirmImpact='High')]
    param (
        [Parameter(Mandatory, ValueFromPipeline)]
        [System.Management.Automation.PSTypeName('Update.Configuration')] $SoftwareUpdateConfiguration
    )
    process {
        $currentContext = Get-AzureRmContext
        $token = $currentContext.TokenCache.ReadItems() |
            Where-Object -FilterScript {
            $_.tenantid -eq $currentContext.Tenant.Id -and 
            $_.Resource -eq 'https://management.core.windows.net/'
        }

        $uri = "https://management.azure.com$($SoftwareUpdateConfiguration.id)?api-version=2017-05-15-preview"

        if ($PSCmdlet.ShouldProcess($uri)) {
            Invoke-RestMethod -UseBasicParsing -Uri $uri -Method Delete -Headers @{
                Authorization = "Bearer $($token.AccessToken)"
                'Content-Type' = 'application/json'
            }
        }
    }
}

# Delete it all
Get-SoftwareUpdateConfigurations -ResourceGroupName 'rgname' -AutomationAccountName 'aaName' |
  Remove-SoftwareUpdateConfigurations -Confirm:$false
    
# Delete explicit
Get-SoftwareUpdateConfigurations -ResourceGroupName 'rgname' -AutomationAccountName 'aaName' -Name 'Windows Critical and Security' |
  Remove-SoftwareUpdateConfigurations -Confirm:$false

Some Q&D code to deal with Azure Update Management. I use this because I cannot resubmit an ARM template for this resource type as it's not idempotent (conflict, already exists) which is why I need to recreate it from scratch everytime