diff --git a/azurelinuxagent/ga/cgroupconfigurator.py b/azurelinuxagent/ga/cgroupconfigurator.py
index 2a75344b4..efb00d481 100644
--- a/azurelinuxagent/ga/cgroupconfigurator.py
+++ b/azurelinuxagent/ga/cgroupconfigurator.py
@@ -181,21 +181,30 @@ def initialize(self):
                     log_cgroup_warning("Unable to determine which cgroup version to use: {0}".format(ustr(e)), send_event=True)
                     return
 
-                # Setup the slices before v2 check. Cgroup v2 usage is disabled for agent and extensions, but can be
-                # enabled for log collector in waagent.conf. The log collector slice should be created in case v2
-                # usage is enabled for log collector.
-                self.__setup_azure_slice()
-
-                if self.using_cgroup_v2():
-                    log_cgroup_info("Agent and extensions resource monitoring is not currently supported on cgroup v2")
-                    return
-
+                # We check the agent unit 'Slice' property before setting up azure.slice. This check is done first
+                # because the agent's Slice unit property will be 'azure.slice' if the slice drop-in file exists, even
+                # though systemd has not moved the agent to azure.slice yet. Systemd will only move the agent to
+                # azure.slice after a service restart.
                 agent_unit_name = systemd.get_agent_unit_name()
                 agent_slice = systemd.get_unit_property(agent_unit_name, "Slice")
                 if agent_slice not in (AZURE_SLICE, "system.slice"):
                     log_cgroup_warning("The agent is within an unexpected slice: {0}".format(agent_slice))
                     return
 
+                # Notes about slice setup:
+                #   1. On first agent update (for machines where daemon version did not already create azure.slice), the
+                #   agent creates azure.slice and the agent unit Slice drop-in file, but systemd does not move the agent
+                #   unit to azure.slice until service restart. It is ok to enable cgroup usage in this case if agent is
+                #   running in system.slice.
+                #   2. We setup the slices before v2 check. Cgroup v2 usage is disabled for agent and extensions, but
+                #   can be enabled for log collector in waagent.conf. The log collector slice should be created in case
+                #   v2 usage is enabled for log collector.
+                self.__setup_azure_slice()
+
+                if self.using_cgroup_v2():
+                    log_cgroup_info("Agent and extensions resource monitoring is not currently supported on cgroup v2")
+                    return
+
                 # Log mount points/root paths for cgroup controllers
                 self._cgroups_api.log_root_paths()