Deprecated images FAQ

You receive an email notification when your virtual machine (VM) or virtual machine scale set runs on an image that's scheduled for deprecation. Publishers deprecate images for various reasons, including security concerns or when images reach end of life.

Deprecation levels

Deprecation occurs at three levels:

• Image version deprecation: A specific VM image version.
• Plan/SKU deprecation: An entire plan or SKU and all image versions within it.
• Offer deprecation: The entire VM offer, including all plans and image versions.

Notice period (90 days before enforcement)

During the notice period:

• You receive email notifications and Azure Advisor recommendations about the upcoming deprecation.
• Existing VMs and virtual machine scale set instances continue to run normally.
• You can deploy new instances by using Azure CLI, PowerShell, or APIs.
• Deprecation warnings appear in the Azure portal, Azure CLI, and APIs.
• You can migrate or update your deployments until the enforcement date.

After enforcement date (soft delete)

After the enforcement date:

• New VM or virtual machine scale set deployments that use deprecated images are blocked.
• Existing VMs and virtual machine scale set instances continue to run without disruption.
• Virtual machine scale set scale-out is blocked because it requires creating new instances from the deprecated image.
• Most VM operations (start, stop, restart, deallocate, redeploy) continue working. See Which operations are affected by image deprecation? for details.

Required actions

To avoid disruption:

• Migrate your virtual machine scale set to a supported image before the enforcement date if you need your virtual machine scale set to scale out after deprecation.
• If you configured automatic OS upgrades, only offer or plan deprecation affects you, not individual version deprecation.

VM operations

After you create a VM, Azure creates an OS disk, and the VM boots exclusively from that disk—not from the original image reference. A deprecated or removed image doesn't affect an already-running VM.

Virtual machine scale set operations

Existing virtual machine scale set instances continue running normally even after the base image is deprecated.

Action required: None for existing workloads. Migrate to a supported image before the enforcement date if you need to scale out your virtual machine scale set after deprecation.

Option 1: Use automated script (recommended)

Run Get-AzVMImageDeprecationStatus.ps1 to list all VMs in a subscription that were created from deprecated or soon-to-be-deprecated images.

Option 2: Use Azure Resource Graph

Run the following query in Azure Resource Graph to list all VMs and their image details:

resources 
| where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'MicrosoftWindowsServer' //Optional: Filter by publisher
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //Optional: Filter by SKU (Plan)
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //Optional: Filter by version
| project name, subscriptionId, resourceGroup, ImagePublisher=properties.storageProfile.imageReference.publisher, ImageOffer=properties.storageProfile.imageReference.offer, imageSku=properties.storageProfile.imageReference.sku, imageVersion=properties.storageProfile.imageReference.exactVersion

Option 3: Use Azure CLI

To list all VMs using a specific SKU (replace 2016-Datacenter with your deprecated SKU):

az vm list --query "[?storageProfile.imageReference.sku=='2016-Datacenter'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

To list all VMs using a specific image version (replace with your deprecated version):

az vm list --query "[?storageProfile.imageReference.version=='14393.4402.2105052108'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

Option 4: Use PowerShell

To list all VMs using a specific SKU (replace 2016-Datacenter with your deprecated SKU):

Get-AzVM | Where-Object {$_.StorageProfile.ImageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.StorageProfile.ImageReference.Offer}}, @{label='imagePublisher'; expression={$_.StorageProfile.ImageReference.Publisher}}, @{label='imageSKU'; expression={$_.StorageProfile.ImageReference.Sku}}, @{label='imageVersion'; expression={$_.StorageProfile.ImageReference.ExactVersion}}

To list all VMs using a specific image version (replace with your deprecated version):

Get-AzVM | Where-Object {$_.StorageProfile.ImageReference.ExactVersion -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.StorageProfile.ImageReference.Offer}}, @{label='imagePublisher'; expression={$_.StorageProfile.ImageReference.Publisher}}, @{label='imageSKU'; expression={$_.StorageProfile.ImageReference.Sku}}, @{label='imageVersion'; expression={$_.StorageProfile.ImageReference.ExactVersion}}

Option 1: Use automated script (recommended)

Run Get-AzVMImageDeprecationStatus.ps1 to list all virtual machine scale sets in a subscription that were created from deprecated or soon-to-be-deprecated images.

Option 2: Use Azure Resource Graph

Run the following query in Azure Resource Graph to list all virtual machine scale sets and their image details:

resources 
| where type == "microsoft.compute/virtualmachinescalesets" 
//| where properties.virtualMachineProfile.storageProfile.imageReference.publisher =~ 'MicrosoftWindowsServer' //Optional: Filter by publisher
//| where properties.virtualMachineProfile.storageProfile.imageReference.sku =~ '2016-Datacenter' //Optional: Filter by SKU (Plan)
//| where properties.virtualMachineProfile.storageProfile.imageReference.version == '14393.4467.2106061537' //Optional: Filter by version
//| where properties.virtualMachineProfile.storageProfile.imageReference.version != "latest" //Optional: Exclude scale sets using "latest"
| project name, subscriptionId, resourceGroup, ImagePublisher=properties.virtualMachineProfile.storageProfile.imageReference.publisher, ImageOffer=properties.virtualMachineProfile.storageProfile.imageReference.offer, imageSku=properties.virtualMachineProfile.storageProfile.imageReference.sku, imageVersion=properties.virtualMachineProfile.storageProfile.imageReference.version

Option 3: Use Azure CLI

To list all virtual machine scale sets using a specific SKU (replace 2016-Datacenter with your deprecated SKU):

az vmss list --query "[?virtualMachineProfile.storageProfile.imageReference.sku=='2016-Datacenter'].{VMSS:id, imageOffer:virtualMachineProfile.storageProfile.imageReference.offer, imagePublisher:virtualMachineProfile.storageProfile.imageReference.publisher, imageSku:virtualMachineProfile.storageProfile.imageReference.sku, imageVersion:virtualMachineProfile.storageProfile.imageReference.version}"

To list all virtual machine scale sets using a specific image version (replace with your deprecated version):

az vmss list --query "[?virtualMachineProfile.storageProfile.imageReference.version=='14393.4402.2105052108'].{VMSS:id, imageOffer:virtualMachineProfile.storageProfile.imageReference.offer, imagePublisher:virtualMachineProfile.storageProfile.imageReference.publisher, imageSku:virtualMachineProfile.storageProfile.imageReference.sku, imageVersion:virtualMachineProfile.storageProfile.imageReference.version}"

Option 4: Use PowerShell

To find virtual machine scale sets using a specific SKU (replace 2016-Datacenter with your deprecated SKU):

$vmsslist = Get-AzVmss
$vmsslist | Where-Object {$_.virtualMachineProfile.storageProfile.imageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

To find virtual machine scale sets using a specific image version (replace with your deprecated version):

$vmsslist = Get-AzVmss
$vmsslist | Where-Object {$_.virtualMachineProfile.storageProfile.imageReference.Version -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

Migration isn't always required. Review the following scenarios to determine whether you need to take action:

Migration required

• Virtual machine scale sets that need to scale out: Scale-out operations are blocked after the enforcement date because they require creating new instances from the deprecated image. Migrate before enforcement if you need scale-out capability.
• Workloads that require reimage operations: Reimage recreates the OS disk from the source image, which fails after the image is deprecated.
• Disaster recovery scenarios: Azure Site Recovery and backup restore operations that rely on the deprecated image don't work after enforcement.
• Paid Marketplace images: After deprecation, you can't create new workloads or perform restore operations because of missing purchase plan information. Migrate to a supported image.

Migration not required

• Running VMs that don't need reimage: After creation, VMs boot from their OS disk—not from the original image. Deprecation doesn't affect already-running VMs.
• Virtual machine scale sets that don't scale out: Existing instances continue to run normally.
• Routine operations: Start, stop, restart, deallocate, and redeploy all continue to work after enforcement.
• Virtual machine scale sets using automatic OS upgrades: If you configured automatic OS upgrades and only the image version is deprecated (not the entire offer or plan), you don't need to take action.

Recommended actions

• Review which VMs and virtual machine scale sets use the deprecated image. See How do I find VMs using deprecated images? and How do I find virtual machine scale sets using deprecated images?.
• Evaluate whether your workloads require any blocked operations after enforcement.
• If migration is required, plan and test before the enforcement date.

Azure VMs don't support in-place OS upgrades. Create a new VM with a supported image, migrate your data, and decommission the old VM.

Part 1: Create a new VM

1. Identify the replacement image: Check your deprecation email for the recommended replacement. For more information, see Find and use images using the Azure CLI or Find and use images using Azure PowerShell.

2. Configure the new VM: Match the region and networking settings of your existing VM for the simplest migration. You can change VM size or region if needed.

3. Deploy and test: Confirm the VM starts correctly and your application dependencies are present.

Part 2: Migrate data

Method A: Detach and attach data disks (recommended)

If your workload data is stored on data disks (not the OS disk):

1. Stop and deallocate the old VM.
2. Detach the data disks from the old VM. For more information, see Detach a data disk from a Linux VM or Detach a data disk from a Windows VM.
3. Attach the data disks to the new VM. For more information, see Attach a data disk to a Linux VM or Attach a data disk to a Windows VM.
4. Start the new VM and verify data accessibility.

Method B: Use snapshots (for OS disk data or backup requirements)

If you need to preserve OS disk data or create a backup before migration:

1. Create a snapshot of the data disks.
2. Create managed disks from the snapshots.
3. Attach the disks to the new VM. For more information, see Attach a data disk to a Linux VM or Attach a data disk to a Windows VM.

Method C: Use file-based transfer

Use OS transfer tools for selective data migration:

• Windows: Robocopy or SMB share
• Linux: rsync, scp, or sftp
• Cross-OS: AzCopy with Azure Storage as an intermediate location

Part 3: Switch over

1. Validate: Verify network connectivity, application functionality, firewall rules, and extensions.
2. Update references: Point DNS names, load balancers, or API endpoints to the new VM.
3. Decommission: Keep the old VM briefly for rollback, then deallocate and delete it.

The migration approach depends on whether an image version, plan/SKU, or entire offer is deprecated.

Version deprecation

If only a specific image version is deprecated:

• Using "latest" version: No action required for new instances. Azure resolves to the newest available version at deployment time. Existing instances remain on their original version.
• Using automatic OS upgrades: No action required. Azure upgrades existing instances to the latest version automatically, regardless of whether your image reference uses "latest" or a pinned version.
• Using a pinned version without automatic OS upgrades: Update the image reference to a supported version. See Modify an Azure virtual machine scale set. After updating the model, upgrade existing instances using one of these methods:
  • Manual upgrade: Use az vmss update-instances (CLI) or Update-AzVmssInstance (PowerShell) to upgrade specific instances.
  • Rolling upgrade policy: Configure the upgrade policy to "Rolling" so instances automatically upgrade when the model changes.

Plan/SKU deprecation

If an entire plan or SKU is deprecated, update to a different SKU from the same offer using a scale-out/scale-in approach:

1. Find an alternative SKU from your deprecation email. For more information, see Find and use images using the Azure CLI or Find and use images using Azure PowerShell.

2. Update the VMSS model to use the new SKU:

   az vmss update --resource-group <resource-group> --name <vmss-name> \
     --set virtualMachineProfile.storageProfile.imageReference.sku=<new-sku> \
     --set virtualMachineProfile.storageProfile.imageReference.version=latest
   

3. Scale out to create new instances using the updated image, then scale in to remove old instances. Or delete specific old instances and let the scale set replace them with new ones.

Offer deprecation

If an entire offer is deprecated, create a new virtual machine scale set with a supported image:

1. Find a replacement offer from your deprecation email or search in the Azure Marketplace.

2. Create a new virtual machine scale set using the replacement image. Match your existing configuration (networking, extensions, scaling rules).

3. Test application compatibility thoroughly. A different publisher or offer may have significant OS or configuration differences.

4. Migrate traffic to the new scale set, then delete the old one.

Azure notifies you about image deprecation through two channels:

• Email notifications: Sent directly to subscription administrators with the Owner or Account Admin role on the subscription.
• Azure Advisor recommendations: Deprecation recommendations appear in Azure Advisor.

Option 1: Use Azure CLI

az vm image show --location chinanorth2 --urn MicrosoftWindowsServer:WindowsServer:2016-Datacenter:14393.4169.2101090332 --query [imageDeprecationStatus]

Option 2: Use PowerShell

To check a single image version:

Get-AzVMImage -Location "chinanorth2" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2016-Datacenter" -Version "14393.4169.2101090332" | Select-Object -ExpandProperty "ImageDeprecationStatus"

To check all versions of a SKU with deprecation details:

Get-AzVMImage -Location "chinanorth2" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Select-Object Version, @{
    Name = "DeprecationDetails"
    Expression = { $_.ImageDeprecationStatus | Out-String }
  } | Format-Table -Wrap -AutoSize

Option 3: Use REST API

Use the Virtual Machine Images - Get API. If the image is deprecated, you receive a response like:

{
  "error": {
    "code": "ImageVersionDeprecated",
    "message": "VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated."
  }
}

Option 4: Use automated script

Run Get-AzVMImageDeprecationStatus.ps1 locally to check all VMs and virtual machine scale sets in a subscription for deprecated images.

Active images are images that aren't scheduled for deprecation or already deprecated.

Option 1: Use Azure CLI

az vm image list --location chinanorth2 --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2022-Datacenter" --all --query "[?imageDeprecationStatus.imageState=='Active']"

Option 2: Use PowerShell

Get-AzVMImage -Location "chinanorth2" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Where-Object { $_.ImageDeprecationStatus.ImageState -eq "Active" } |
  Select-Object Version

Your SQL Server remains unaffected when a SQL Server Azure Marketplace image is deprecated:

• Your Azure VM continues to run without interruption.
• Your SQL Server instance continues to function normally.
• You can't deploy new VMs using the deprecated SQL Server image.

Existing deployments require no action.