Deprecated images FAQ

You might have received an email telling you that your Virtual machine is running on images that are scheduled for deprecation or already deprecated. There are several reasons an image can be deprecated by the publisher, which might be due to security issues or the image reaching end of life.

An image can be deprecated on the version, plan or offer level:

• Deprecation of an image version - the removal of an individual VM image version
• Deprecation of a plan or SKU - the removal of a plan or SKU and all images within the plan
• Deprecation of an offer - the removal of an entire VM offer, including all plans within the offer and all images within each plan.

Before the scheduled deprecation date, you can continue to deploy new VM or scale set instances up until the deprecation date.

After the scheduled deprecation date, you won't be able to deploy new instances using the affected images. If the plan is scheduled for deprecation, all image versions within the plan will no longer be available. If the entire offer is scheduled for deprecation, all plans within the offer will no longer be available following deprecation.

• Active VM instances won't be impacted.
• New VM instances can't be created from any of the impacted images.
• Existing virtual machine scale sets deployments can't be scaled out if configured with any of the impacted images. When a plan or offer is being deprecated, all existing scale sets deployments pinned to any image within the plan or offer respectively can't be scaled out.

What do I need to do?

If you want your scale set to scale out after the deprecation date, you'll need to identify the scale set running on the deprecated image, and then migrate your workload to a supported image. If you want to remain on the image after deprecation, you can create your own custom image and migrate to it (Steps outlined below). If you already have auto updates configured for your VM or scale set, you'll only be impacted when an Offer or plan version is deprecated (No impact on image version deprecation).

You can search for the Virtual machine or Virtual Machine scale sets that are pinned to an image by running the following queries in Azure Resource graph:

• To find the VMs running on any retired image, specify the retired image as follows and run the query in Azure Resource Graph replacing the values below with your image details as follows:

resources 
|where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.storageProfile.imageReference.publisher,ImageOffer=properties.storageProfile.imageReference.offer,imageSku=properties.storageProfile.imageReference.sku, imageVersion=properties.storageProfile.imageReference.exactVersion

To find the scale set running on any retired image, specify the retired image as follows and run the query in Azure Resource Graph replacing the values below with your image details as follows:

resources 
|where type == "microsoft.compute/virtualmachinescalesets" 
//| where properties.virtualMachineProfile.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.virtualMachineProfile.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.virtualMachineProfile.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version. 
//| where properties.virtualMachineProfile.storageProfile.imageReference.version != "latest" //optional filter, uncomment this line to filter out scale sets that aren't using "latest version" in the model.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.virtualMachineProfile.storageProfile.imageReference.publisher,ImageOffer=properties.virtualMachineProfile.storageProfile.imageReference.offer,imageSku=properties.virtualMachineProfile.storageProfile.imageReference.sku, imageVersion=properties.virtualMachineProfile.storageProfile.imageReference.version

Using Azure CLI:

List VM with deprecated image at Plan/SKU level.

az vm show --resource-group $rgName --name $vmName --query "storageProfile.imageReference.exactVersion
az vm list --query "[?storageProfile.imageReference.sku=='2016-Datacenter'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

List VM with deprecated image at version level.

az vm list --query "[?storageProfile.imageReference.version=='14393.4402.2105052108'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

Using PowerShell:

List VM with deprecated images at version level.

(Get-AzVM -ResourceGroupName $rgname -Name $vmname).StorageProfile.ImageReference.ExactVersion   

To find scale set using a deprecated version.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Version -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

List scale sets with deprecated images at plan/SKU level.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

When an image is deprecated, there's no impact on existing VMs and no action is required. You can choose to migrate your workloads to a new image if you have a specific concern.

You might want to keep using an image that is scheduled for deprecation for specific reasons or you might want to migrate your workloads to another Offer/Plan/Version.

If you want to keep using an image that is scheduled for deprecation, generalize the VM, deallocate the VM, then create a custom image for your VM or scale set. Then change the VM or scale set deployment to point to the custom image. For more information, see Capture an image of a VM in the portal.

We recommend that you create custom images from free Marketplace images, that don't have Plan Info, that are scheduled for deprecation. For Paid Marketplace images, we suggest you create custom images from the latest version of the image. Workloads running on custom images created from a deprecated paid image will no longer work after the paid image is deprecated.

You want to migrate to another offer/plan/version:

First, search for other offers, plans, or versions from the same publisher.

To migrate to another offer:

Using the Azure CLI:

az vm image list --location "west europe" --publisher "MicrosoftWindowsServer" 

Using PowerShell:

Get-AzVMImage -Location "west europe" -PublisherName “MicrosoftWindowsServer” 

To migrate to another Plan:

Search for other plans under the same offer and then migrate to that plan.

Azure CLI:

az vm image list --location "west europe" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" 

PowerShell:

Get-AzVMImage -Location "west europe" -PublisherName “MicrosoftWindowsServer” -Offer “WindowsServer”

To migrate to another version:

Search for another version. We suggest migrating to the latest version.

Azure CLI:

az vm image list --location "west europe" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2019-Datacenter-with-Containers" --all"

PowerShell:

Get-AzVMImage -Location "west europe" -PublisherName "MicrosoftWindowsServer” -Offer “WindowsServer” -Skus "2019-Datacenter-with-Containers"

You need to verify that your workloads are supported and will run properly on the new image before migrating your workloads to the new image.

Scale sets, in general, support image reference replacement but VMs don't.

Migrating scale set workloads to newer image with minimal downtime

Scale set, suggestions for updating the version should include:

• To avoid downtime, ensure the upgrade policy is set to manual or rolling.
  • If set to manual, existing instances won’t be reimaged until it’s manually upgraded.
  • If set to rolling, existing instances will be automatically upgraded and reimaged by batch.
• Update image reference using the steps in Modify an Azure virtual machine scale set.
• Ensure that all existing instances are upgraded and on the latest model. You can also scale out and migrate workload to the new instances then delete the old instances, instead of upgrading the existing instances.
• Once the existing instances are all upgraded to the new image, change the upgrade policy back to what it was if needed.

Generally, yes. However, it's recommended to confirm against the list of valid versions in a Plan using Virtual Machine Images - List.

You can check if an image is deprecated or scheduled for deprecation using the REST API.

If the image is deprecated, you'll get a VM Image is Deprecated response. If the image is scheduled for deprecation, the response would show the date of the scheduled deprecation.

The response indicates that this is deprecated:

{
  "error": {
    "code": "ImageVersionDeprecated",
    "message": "VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated."
  }
}

To check if an image is deprecated via Azure CLI or PowerShell:

Azure CLI:

az vm image show --location eastus --urn <MicrosoftWindowsServer:WindowsServer:2016-Datacenter:14393.4169.2101090332> --query [imageDeprecationStatus]

PowerShell:

Get-AzVMImage -Location "eastus" -PublisherName <MicrosoftWindowsServer> -Offer "WindowsServer" -Skus <2016-Datacenter> -Version <14393.4169.2101090332> | Select-Object -ExpandProperty "ImageDeprecationStatus"

The response indicates that this image is deprecated:

Get-AzVMImage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorCode: ImageVersionDeprecated
ErrorMessage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorTarget:
StatusCode: 404
ReasonPhrase: Not Found

Certain Azure Marketplace Images or Virtual machine images that were originally deployed through our legacy publishing platform would be retired by 8 September 2024. The retiring images would no longer be available for selection in the Azure Marketplace portal or via the CLI or PowerShell. These are a specific set of deprecations and affected customers would find the list of impacted images in email notifications sent by Azure. The deprecation status of these specific retired images can't be found via Portal, CLI or API. If any of your images is impacted, you'll find the list of images in email notifications sent to you.

Required Action

We recommend the following options:

• Upgrade your Virtual Machine or Virtual Machine Scale Set workloads that are using any of the images that will be retired to the latest version or a newer version of the image before 8 September 2024:
• You can do this by specifying “latest” in the version section of the Image URN in CLI or ARM template. In the Publisher:Offer:Sku:Version, you can replace the version number in the URN with “latest” to use the latest version of the image. See more information on how to specify the latest image here.
• You can also update the image reference in your scale set by specifying the newer version to update to.
• You can create a custom image from the impacted retired image and migrate to your workload to the custom image. If you want to keep using an image that is scheduled for retirement, generalize the VM, deallocate the VM, then create a custom image for your VM or scale set. Then change the VM or scale set deployment to point to the custom image. For more information, see Capture an image of a VM in the portal.

To find VM or scale set workloads that are running on the retired images, follow these steps.