Deprecated images FAQ

You might have received an email telling you that your Virtual machine is running on images that are scheduled for deprecation or already deprecated. There are several reasons an image can be deprecated by the publisher, which might be due to security issues or the image reaching end of life.

An image can be deprecated on the version, plan or offer level:

• Deprecation of an image version - the removal of an individual VM image version
• Deprecation of a plan or SKU - the removal of a plan or SKU and all images within the plan
• Deprecation of an offer - the removal of an entire VM offer, including all plans within the offer and all images within each plan.

Before the scheduled deprecation date, you can continue to deploy new VM or scale set instances up until the deprecation date.

After the scheduled deprecation date, you won't be able to deploy new instances using the affected images. If the plan is scheduled for deprecation, all image versions within the plan will no longer be available. If the entire offer is scheduled for deprecation, all plans within the offer will no longer be available following deprecation.

• Active VM instances won't be impacted.
• New VM instances can't be created from any of the impacted images.
• Existing virtual machine scale sets deployments can't be scaled out if configured with any of the impacted images. When a plan or offer is being deprecated, all existing scale sets deployments pinned to any image within the plan or offer respectively can't be scaled out.

What do I need to do?

If you want your scale set to scale out after the deprecation date, you'll need to identify the scale set running on the deprecated image, and then migrate your workload to a supported image. If you want to remain on the image after deprecation, you can create your own custom image and migrate to it (Steps outlined below). If you already have auto updates configured for your VM or scale set, you'll only be impacted when an Offer or plan version is deprecated (No impact on image version deprecation).

Using Azure Resource graph:

You can search for the Virtual machine or Virtual Machine scale sets that are pinned to an image by running the following queries in Azure Resource graph:

• To find the VMs running on any retired image, specify the retired image as follows and run the query in Azure Resource Graph replacing the values below with your image details as follows:

resources 
|where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.storageProfile.imageReference.publisher,ImageOffer=properties.storageProfile.imageReference.offer,imageSku=properties.storageProfile.imageReference.sku, imageVersion=properties.storageProfile.imageReference.exactVersion

• To find the scale set running on any retired image, specify the retired image as follows and run the query in Azure Resource Graph replacing the values below with your image details as follows:

resources 
|where type == "microsoft.compute/virtualmachinescalesets" 
//| where properties.virtualMachineProfile.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.virtualMachineProfile.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.virtualMachineProfile.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version. 
//| where properties.virtualMachineProfile.storageProfile.imageReference.version != "latest" //optional filter, uncomment this line to filter out scale sets that aren't using "latest version" in the model.
|project name, subscriptionId, resourceGroup, ImagePublisher=properties.virtualMachineProfile.storageProfile.imageReference.publisher,ImageOffer=properties.virtualMachineProfile.storageProfile.imageReference.offer,imageSku=properties.virtualMachineProfile.storageProfile.imageReference.sku, imageVersion=properties.virtualMachineProfile.storageProfile.imageReference.version

Using Azure CLI:

• List VM with deprecated image at Plan/SKU level.

az vm show --resource-group $rgName --name $vmName --query "storageProfile.imageReference.exactVersion
az vm list --query "[?storageProfile.imageReference.sku=='2016-Datacenter'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

• List VM with deprecated image at version level.

az vm list --query "[?storageProfile.imageReference.version=='14393.4402.2105052108'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

Using PowerShell:

• List VM with deprecated images at version level.

(Get-AzVM -ResourceGroupName $rgname -Name $vmname).StorageProfile.ImageReference.ExactVersion   

• To find scale set using a deprecated version.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Version -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

• List scale sets with deprecated images at plan/SKU level.

$vmsslist = Get-AzVmss
$vmsslist | where {$_.virtualMachineProfile.storageProfile.imageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

• Run Get-AzVMImageDeprecationStatus.ps1 to list if any VMs or VM scale sets in a subscription were created from VM images that are scheduled for deprecation.

When an image is deprecated, there's no impact on existing VMs and no action is required. When an image is deprecated, only VMSS scale out operations and new VM and VMSS create operations are impacted.

You might want to keep using an image that is scheduled for deprecation for specific reasons or you might want to migrate your workloads to another Offer/Plan/Version.

If you want to keep using an image that is scheduled for deprecation, generalize the VM, deallocate the VM, then create a custom image for your VM or scale set. Then change the VM or scale set deployment to point to the custom image. For more information, see Capture an image of a VM in the portal.

Note: If you are using a deprecated paid Marketplace image that has the Purchase Plan Information defined (the 'plan' object on the Image), when this image gets deprecated you cannot create new Virtual Machines workloads or perform Azure Site Recovery (ASR) or Backup operations with this image due to the missing Plan Information.

You want to migrate to another offer/plan/version:

First, search for other offers, plans, or versions from the same publisher.

To migrate to another offer:

Using the Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" 

Using PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Skus $skuName

To migrate to another Plan:

Search for other plans under the same offer and then migrate to that plan.

Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" 

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus $skuName

To migrate to another version:

Search for another version. We suggest migrating to the latest version.

Azure CLI:

az vm image list --location "chinanorth2" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2019-Datacenter-with-Containers" --all

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2019-Datacenter-with-Containers"

You need to verify that your workloads are supported and will run properly on the new image before migrating your workloads to the new image.

Scale sets, in general, support image reference replacement but VMs don't.

Migrating scale set workloads to newer image with minimal downtime

Scale set, suggestions for updating the version should include:

• To avoid downtime, ensure the upgrade policy is set to manual or rolling.

  • If set to manual, existing instances won’t be reimaged until it’s manually upgraded.
  • If set to rolling, existing instances will be automatically upgraded and reimaged by batch.

• Update image reference using the steps in Modify an Azure virtual machine scale set.

• Ensure that all existing instances are upgraded and on the latest model. You can also scale out and migrate workload to the new instances then delete the old instances, instead of upgrading the existing instances.

• Once the existing instances are all upgraded to the new image, change the upgrade policy back to what it was if needed.

  If you are using VMSS, we recommend enabling Automatic OS image upgrades so that the latest image published by image publishers is automatically applied to your scale set or VMSS without manual user intervention. Learn how to enable Automatic OS Image Upgrade

If you are using a Paid Marketplace Image, when the image is deprecated attempting to restore the VM from backups can fail for images with Plan information once the image is removed or deprecated from the marketplace. We recommend creating new VMs and migrating your workload to that image if you are using a Paid Marketplace Image with Plan Information. If the VM Image is Free (does not require plan info), you will be able to continue using the single VM and should be able to restore from backups. Note that this only impacts single VMs and not VMSS workloads.

There is no impact to existing VM or VMSS workloads when a free Marketplace Image is deprecated. However, you cannot create new VMs or VMSS workloads from a deprecated free Marketplace Image.

Generally, yes. However, it's recommended to confirm against the list of valid versions in a Plan using Virtual Machine Images - List.

You can check if an image is deprecated or scheduled for deprecation using the REST API.

If the image is deprecated, you'll get a VM Image is Deprecated response. If the image is scheduled for deprecation, the response would show the date of the scheduled deprecation.

The response indicates that this is deprecated:

{
  "error": {
    "code": "ImageVersionDeprecated",
    "message": "VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated."
  }
}

To check if an image is deprecated via Azure CLI or PowerShell:

Azure CLI:

az vm image show --location chinanorth2 --urn <MicrosoftWindowsServer:WindowsServer:2016-Datacenter:14393.4169.2101090332> --query [imageDeprecationStatus]

PowerShell:

Get-AzVMImage -Location "chinanorth2" -PublisherName <MicrosoftWindowsServer> -Offer "WindowsServer" -Skus <2016-Datacenter> -Version <14393.4169.2101090332> | Select-Object -ExpandProperty "ImageDeprecationStatus"

The response indicates that this image is deprecated:

Get-AzVMImage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorCode: ImageVersionDeprecated
ErrorMessage: VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated.
ErrorTarget:
StatusCode: 404
ReasonPhrase: Not Found