Deprecated images FAQ

You may receive an email telling you that your virtual machine (VM) is running on images that are scheduled for deprecation or already deprecated. The publisher can deprecate an image for several reasons, which might be due to security issues or the image reaching end of life.

An image can be deprecated on the version, plan, or offer level:

• Deprecation of an image version - the removal of an individual VM image version
• Deprecation of a plan or SKU - the removal of a plan or SKU and all images within the plan
• Deprecation of an offer - the removal of an entire VM offer, including all plans within the offer and all images within each plan.

Before the scheduled deprecation date, you can continue to deploy new VM or scale set instances up until the deprecation date. After the scheduled deprecation date, you can't deploy new instances using the affected images. If the plan is scheduled for deprecation, all image versions within the plan are no longer available. If the entire offer is scheduled for deprecation, all plans within the offer are no longer available following deprecation.

• Active VM instances aren't impacted.
• New VM instances can't be created from any of the impacted images.
• Existing Virtual Machine Scale Set deployments can't be scaled out if configured with any of the impacted images. When a plan or offer is being deprecated, all existing scale sets deployments pinned to any image within the plan or offer respectively can't be scaled out.

What do I need to do?

If you want your scale set to scale out after the deprecation date, you need to identify the scale set running on the deprecated image, and then migrate your workload to a supported image. If you want to remain on the image after deprecation, you can create your own custom image and migrate to it. If you already have auto updates configured for your VM or scale set, you're only impacted when an Offer or plan version is deprecated. Image version deprecation has no impact.

Using Azure Resource graph:

You can search for the Virtual machine or Virtual Machine scale sets that are pinned to an image by running the following queries in Azure Resource graph:

• To find the VMs running on any retired image, specify the retired image and run the query in Azure Resource Graph. Replace the values with your image details:

resources 
|where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.storageProfile.imageReference.publisher,ImageOffer=properties.storageProfile.imageReference.offer,imageSku=properties.storageProfile.imageReference.sku, imageVersion=properties.storageProfile.imageReference.exactVersion

• To find the scale set running on any retired image, specify the retired image and run the query in Azure Resource Graph. Replace the values with your image details:

resources 
|where type == "microsoft.compute/virtualmachinescalesets" 
//| where properties.virtualMachineProfile.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.virtualMachineProfile.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.virtualMachineProfile.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version. 
//| where properties.virtualMachineProfile.storageProfile.imageReference.version != "latest" //optional filter, uncomment this line to filter out scale sets that aren't using "latest version" in the model.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.virtualMachineProfile.storageProfile.imageReference.publisher,ImageOffer=properties.virtualMachineProfile.storageProfile.imageReference.offer,imageSku=properties.virtualMachineProfile.storageProfile.imageReference.sku, imageVersion=properties.virtualMachineProfile.storageProfile.imageReference.version

Using Azure CLI:

• List VM with deprecated image at Plan/SKU level.

az vm show --resource-group $rgName --name $vmName --query "storageProfile.imageReference.exactVersion
az vm list --query "[?storageProfile.imageReference.sku=='2016-Datacenter'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

• List VM with deprecated image at version level.

az vm list --query "[?storageProfile.imageReference.version=='14393.4402.2105052108'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

Using PowerShell:

• List VM with deprecated images at version level.

(Get-AzVM -ResourceGroupName $rgname -Name $vmname).StorageProfile.ImageReference.ExactVersion   

• To find scale set using a deprecated version.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Version -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

• List scale sets with deprecated images at plan/SKU level.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

• Run Get-AzVMImageDeprecationStatus.ps1 to list if any VMs or VM scale sets in a subscription were created from VM images that are scheduled for deprecation.

When an image is deprecated, there's no impact on existing VMs and no action is required. When an image is deprecated, only Virtual Machine Scale Set scale-out operations and new VM and Virtual Machine Scale Set create operations are impacted.

You might want to keep using an image that is scheduled for deprecation for specific reasons or you might want to migrate your workloads to another Offer/Plan/Version. If you want to keep using an image that is scheduled for deprecation, generalize the VM, deallocate the VM, then create a custom image for your VM or scale set. Then change the VM or scale set deployment to point to the custom image. For more information, see Capture an image of a VM in the portal.

You want to migrate to another offer/plan/version:

First, search for other offers, plans, or versions from the same publisher.

To migrate to another offer:

Using the Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" 

Using PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Skus $skuName

To migrate to another Plan:

Search for other plans under the same offer and then migrate to that plan.

Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" 

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus $skuName

To migrate to another version:

Search for another version. We suggest migrating to the latest version.

Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2019-Datacenter-with-Containers" --all

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2019-Datacenter-with-Containers"

You need to verify that your workloads are supported and will run properly on the new image before migrating your workloads to the new image.

Scale sets, in general, support image reference replacement but VMs don't.

Migrating scale set workloads to newer image with minimal downtime

Scale set, suggestions for updating the version should include:

• To avoid downtime, ensure the upgrade policy is set to manual or rolling.
  • If set to manual, existing instances won’t be reimaged until it’s manually upgraded.
  • If set to rolling, existing instances will be automatically upgraded and reimaged by batch.
• Update image reference using the steps in Modify an Azure virtual machine scale set.
• Ensure that all existing instances are upgraded and on the latest model. You can also scale out and migrate workload to the new instances then delete the old instances, instead of upgrading the existing instances.
• Once the existing instances are all upgraded to the new image, change the upgrade policy back to what it was if needed. If you are using Virtual Machine Scale Sets, we recommend enabling Automatic OS image upgrades so that the latest image published by image publishers is automatically applied to your scale set without manual user intervention. Learn how to enable Automatic OS Image Upgrade.

If you're using a Paid Marketplace Image, when the image is deprecated attempting to restore the VM from backups can fail for images with Plan information once the image is removed or deprecated from the marketplace. We recommend creating new VMs and migrating your workload to that image if you're using a Paid Marketplace Image with Plan Information. If the VM Image is Free, in that it doesn't require plan info, you can continue using the single VM and should be able to restore from backups. This only impacts single VMs and not Virtual Machine Scale Set workloads.

There's no impact to existing VM or Virtual Machine Scale Set workloads when a free Marketplace Image is deprecated. However, you can't create new VMs or Virtual Machine Scale Set workloads from a deprecated free Marketplace Image.

Generally, yes. However, it's recommended to confirm against the list of valid versions in a Plan using Virtual Machine Images - List.

Ensure that you have either Owner, Account Admin, or User Access Administrator roles on your subscription.

You can check if an image is deprecated or scheduled for deprecation using the REST API.

If the image is deprecated, you get a VM Image is Deprecated response. If the image is scheduled for deprecation, the response shows the date of the scheduled deprecation.

The response indicates that this image is deprecated:

{
  "error": {
    "code": "ImageVersionDeprecated",
    "message": "VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated."
  }
}

To check if an image is deprecated via Azure CLI or PowerShell:

Azure CLI:

az vm image show --location chinanorth2 --urn <MicrosoftWindowsServer:WindowsServer:2016-Datacenter:14393.4169.2101090332> --query [imageDeprecationStatus]

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName <MicrosoftWindowsServer> -Offer "WindowsServer" -Skus <2016-Datacenter> -Version <14393.4169.2101090332> | Select-Object -ExpandProperty "ImageDeprecationStatus"

To check all versions of a specific SKU with their deprecation details:

Get-AzVMImage -Location "chinanorth2" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Select-Object Version, @{
    Name = "DeprecationDetails"
    Expression = { $_.ImageDeprecationStatus | Out-String }
  } | Format-Table -Wrap -AutoSize

The response indicates that this image is deprecated:

Get-AzVMImage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorCode: ImageVersionDeprecated
ErrorMessage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorTarget:
StatusCode: 404
ReasonPhrase: Not Found

Nothing happens to your SQL Server instance if a SQL Server image is deprecated. You can continue using your Azure VM and your SQL Server instance without interruption. However, you will no longer be able to deploy that image in the future.

Active images are images not scheduled for deprecation or already deprecated. List active images versions under a SKU by using the following commands:

Azure CLI:

az vm image list --<location> chinanorth2 --publisher <MicrosoftWindowsServer> --offer <WindowsServer> --sku <2022-Datacenter> --all --query "[?imageDeprecationStatus.imageState=='Active']"

PowerShell:

Get-AzVMImage -Location "chinanorth2" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Where-Object { $_.ImageDeprecationStatus.ImageState -eq "Active" } |
  Select-Object Version