Aspects of the disclosure relate to cloud service automation of common image management. An image update orchestrator may receive a request to upgrade a virtual machine image. The image update orchestrator may spin up an instance of a virtual machine and provision the instance of the virtual machine with a virtual machine image and cause to install a plurality of software updates to the instance of the virtual machine. The image update orchestrator may take a snapshot of the instance of the virtual machine and generate a sealed master image. Finally, the image update orchestrator may cause to deploy, to one or more policy managed devices, the sealed master image.