Migrate Managed image to Azure compute gallery image version

Applies to: ✔️ Linux Virtual Machine ✔️ Windows Virtual Machine ✔️ Virtual Machine Flex Scale Sets

Managed images is legacy method to generalize and capture Virtual Machine image. For the most current technology, customers are encouraged to use Azure compute gallery. All new features, like ARM64, Trusted launch, and Confidential Virtual Machine are only supported through Azure compute gallery. If you have an existing managed image, you can use it as a source and create an Azure compute gallery image.

Before you begin

• Create an Azure Compute Gallery.
• Assign Reader permission on source managed image.
• Assign Contributor permission on target Azure compute gallery image definition.

Migrate Managed image to Azure Compute Gallery image

Portal

This section steps through using the Azure portal to migrate Managed image to existing Azure Compute Gallery.

1. Sign-in to Azure portal.
2. Navigate to Managed image to be migrated and select Clone to a VM image.

3. Provide following details on the Create VM image version page and select Next : Replication >:

   • Version number
   • Target Azure compute gallery
   • Target Virtual Machine image definition

4. Select following Replication configuration or select default values and select Next : Encryption >:

   • Default storage sku
   • Default replication count
   • Target replication regions

5. Select SSE encryption type or select default Encryption at-rest with a platform managed key and select Next : Tags >.

6. Optional Assign resource tags.

7. Validate the configuration on Review + Create page and select Create to complete the migration.

CLI

You need the tenantID of the source image, the subscriptionID for the Azure compute gallery (target), and the resourceID of the source image.

# Set some variables
tenantID="<tenant ID for the source image>"
subID="<subscription ID where the image will be creted>"
sourceImageID="<resource ID of the source managed image>"

# Login to the subscription where the new image will be created
az login

# Log in to the tenant where the source image is available
az login --tenant $tenantID

# Log back in to the subscription where the image will be created and ensure subscription context is set
az login
az account set --subscription $subID

# Create the image
az sig image-version create `
    --gallery-image-definition myImageDef `
    --gallery-image-version 1.0.0 `
    --gallery-name myGallery `
    --resource-group myResourceGroup `
    --image-version $sourceImageID

PowerShell

You need the tenantID of the source image, the subscriptionID for the Azure compute gallery (target), and the resourceID of the source image.

# Set variables 
$targetSubID = "<subscription ID for the target>"
$sourceTenantID = "<tenant ID where for the source image>"
$sourceImageID = "<resource ID of the source image>"

# Login to the tenant where the source image is published
Connect-AzAccount -Tenant $sourceTenantID -UseDeviceAuthentication

# Login to the subscription where the new image will be created and set the context
Connect-AzAccount -UseDeviceAuthentication -Subscription $targetSubID
Set-AzContext -Subscription $targetSubID

# Create the image version from another image version in a different tenant
New-AzGalleryImageVersion `
    -ResourceGroupName myResourceGroup `
    -GalleryName myGallery `
    -GalleryImageDefinitionName myImageDef `
    -Location "West US 2" `
    -Name 1.0.0 `
    -SourceImageId $sourceImageID

Next steps

Replace managed image reference with Azure compute gallery image version in the Virtual machine and flex scale sets deployment templates.