Deprecated images FAQ

You receive an email notification when your virtual machine (VM) or virtual machine scale set runs on an image scheduled for deprecation. Publishers deprecate images for various reasons, including security concerns or when images reach end of life.

Deprecation levels

Deprecation occurs at three levels:

• Image version deprecation: A specific VM image version.
• Plan/SKU deprecation: An entire plan or SKU and all image versions within it.
• Offer deprecation: The entire VM offer, including all plans and image versions.

Deprecation timeline

Notice period (90 days before enforcement)

During the notice period:

• You receive email notifications and Azure Advisor recommendations about the upcoming deprecation.
• Existing VMs and virtual machine scale set instances continue to run normally.
• You can deploy new instances by using Azure CLI, PowerShell, or APIs.
• Deprecation warnings appear in the Azure portal, Azure CLI, and APIs.
• You can migrate or update your deployments until the enforcement date.

After enforcement date (soft delete)

After the enforcement date:

• You receive email notifications and Azure Advisor recommendations about the deprecation enforcement.
• New VM or virtual machine scale set deployments that use deprecated images are blocked.
• Existing VM instances continue to run without disruption.
• Existing virtual machine scale set deployments remain operational but can't scale out.
• You can't redeploy VMs that use deprecated images (for example, after deallocation or failure).

Impact summary

The following table summarizes the impact of image deprecation:

Required actions

To avoid disruption:

• Migrate to a supported image before the enforcement date if you want your virtual machine scale set to scale out after deprecation.
• If you configured automatic OS upgrades, only offer or plan deprecation affects you, not individual version deprecation.

Use Azure Resource Graph

Run the following queries in Azure Resource Graph to identify affected resources.

Find virtual machines using deprecated images

resources 
| where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'MicrosoftWindowsServer' //Optional: Filter by publisher
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //Optional: Filter by SKU (Plan)
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //Optional: Filter by version
| project name, subscriptionId, resourceGroup, ImagePublisher=properties.storageProfile.imageReference.publisher, ImageOffer=properties.storageProfile.imageReference.offer, imageSku=properties.storageProfile.imageReference.sku, imageVersion=properties.storageProfile.imageReference.exactVersion

Find virtual machine scale sets using deprecated images

resources 
| where type == "microsoft.compute/virtualmachinescalesets" 
//| where properties.virtualMachineProfile.storageProfile.imageReference.publisher =~ 'MicrosoftWindowsServer' //Optional: Filter by publisher
//| where properties.virtualMachineProfile.storageProfile.imageReference.sku =~ '2016-Datacenter' //Optional: Filter by SKU (Plan)
//| where properties.virtualMachineProfile.storageProfile.imageReference.version == '14393.4467.2106061537' //Optional: Filter by version
//| where properties.virtualMachineProfile.storageProfile.imageReference.version != "latest" //Optional: Exclude scale sets using "latest"
| project name, subscriptionId, resourceGroup, ImagePublisher=properties.virtualMachineProfile.storageProfile.imageReference.publisher, ImageOffer=properties.virtualMachineProfile.storageProfile.imageReference.offer, imageSku=properties.virtualMachineProfile.storageProfile.imageReference.sku, imageVersion=properties.virtualMachineProfile.storageProfile.imageReference.version

Use Azure CLI

List VMs with deprecated plan/SKU

az vm show --resource-group $rgName --name $vmName --query "storageProfile.imageReference.exactVersion"
az vm list --query "[?storageProfile.imageReference.sku=='2016-Datacenter'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

List VMs with deprecated version

az vm list --query "[?storageProfile.imageReference.version=='14393.4402.2105052108'].{VM:id, imageOffer:storageProfile.imageReference.offer, imagePublisher:StorageProfile.imageReference.publisher, imageSku: storageProfile.imageReference.sku, imageVersion:storageProfile.imageReference.version}"

Use PowerShell

List VMs with deprecated version

(Get-AzVM -ResourceGroupName $rgname -Name $vmname).StorageProfile.ImageReference.ExactVersion   

Find virtual machine scale sets using deprecated version

$vmsslist = Get-AzVmss
$vmsslist | Where-Object {$_.virtualMachineProfile.storageProfile.imageReference.Version -eq '14393.4402.2105052108'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

List virtual machine scale sets with deprecated plan/SKU

$vmsslist = Get-AzVmss
$vmsslist | Where-Object {$_.virtualMachineProfile.storageProfile.imageReference.Sku -eq '2016-Datacenter'} | Select-Object -Property ResourceGroupName, Name, @{label='imageOffer'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Offer}}, @{label='imagePublisher'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Publisher}}, @{label='imageSKU'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Sku}}, @{label='imageVersion'; expression={$_.virtualMachineProfile.storageProfile.imageReference.Version}}

Use automated script

Run Get-AzVMImageDeprecationStatus.ps1 to list all VMs or virtual machine scale sets in a subscription that were created from deprecated or soon-to-be-deprecated images.

Choose one of two options when you deal with deprecated images.

Option 1: Create a custom image

To continue using the deprecated image:

1. Generalize your VM.
2. Deallocate the VM.
3. Create a custom image from the VM.
4. Update your VM or virtual machine scale set deployment to use the custom image.

For detailed steps, see Capture an image of a VM in the portal.

Option 2: Migrate to another image

Step 1: Find alternative images from the same publisher

Use Azure CLI:

# List all offers from a publisher
az vm image list --location "westeurope" --publisher "MicrosoftWindowsServer"

# List all plans under an offer
az vm image list --location "westeurope" --publisher "MicrosoftWindowsServer" --offer "WindowsServer"

# List all versions of a specific SKU
az vm image list --location "westeurope" --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2019-Datacenter-with-Containers" --all

Use PowerShell:

# List all offers from a publisher
Get-AzVMImage -Location "westeurope" -PublisherName "MicrosoftWindowsServer"

# List all plans under an offer
Get-AzVMImage -Location "westeurope" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer"

# List all versions of a specific SKU
Get-AzVMImage -Location "westeurope" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2019-Datacenter-with-Containers"

Step 2: Test compatibility

Before you migrate, verify that the new image supports your workloads and runs them properly.

Step 3: Update your deployments

For virtual machine scale sets (minimal downtime)

1. Set the upgrade policy to Manual or Rolling to avoid downtime:

   • Manual: Existing instances aren't reimaged until you manually upgrade them.
   • Rolling: Azure automatically upgrades instances in batches.

2. Update the image reference by following Modify an Azure virtual machine scale set.

3. Upgrade all instances to the latest model by either:

   • Upgrading existing instances, or
   • Scaling out with new instances, then deleting old instances.

4. Restore the upgrade policy to its original setting if needed.

5. Enable automatic OS image upgrade to automatically apply the latest images without manual intervention.

For virtual machines

Virtual machines don't support in-place image reference replacement. Create new VMs with the updated image and migrate your workloads.

Important considerations for paid Marketplace images

When a paid Marketplace image with purchase plan information is deprecated:

• VM restore from backups might fail after the image is removed from the marketplace.
• New VM creation is blocked after deprecation.
• Azure Site Recovery operations fail because of missing plan information.
• Backup restore operations fail because of missing plan information.

Recommended action

Create new VMs by using a supported image and migrate your workloads before the deprecation enforcement date.

For free Marketplace images (no purchase plan required):

• Existing VM and virtual machine scale set workloads continue to run without interruption.
• You can restore VMs from backups.
• You can't create new VMs or virtual machine scale set deployments after deprecation.

Generally, yes. However, confirm against the list of valid versions in a plan by using the Virtual Machine Images - List API.

To receive deprecation notifications, you must have one of the following roles on your subscription:

• Owner
• Account Admin
• Service Administrator

Use REST API

Use the Virtual Machine Images - Get API to check deprecation status.

If the image is deprecated, you receive the following response:

{
  "error": {
    "code": "ImageVersionDeprecated",
    "message": "VM Image from publisher: MicrosoftWindowsServer with - Offer: WindowsServer, Sku: 2016-Datacenter, Version: 14393.4169.2101090332 is deprecated."
  }
}

Use Azure CLI

az vm image show --location eastus --urn MicrosoftWindowsServer:WindowsServer:2016-Datacenter:14393.4169.2101090332 --query [imageDeprecationStatus]

Use PowerShell

Check a single image version:

Get-AzVMImage -Location "eastus" -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2016-Datacenter" -Version "14393.4169.2101090332" | Select-Object -ExpandProperty "ImageDeprecationStatus"

Check all versions of a SKU with deprecation details:

Get-AzVMImage -Location "westus" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Select-Object Version, @{
    Name = "DeprecationDetails"
    Expression = { $_.ImageDeprecationStatus | Out-String }
  } | Format-Table -Wrap -AutoSize

Use automated script

Run Get-AzVMImageDeprecationStatus.ps1 in Cloud Shell or locally to check all VMs and virtual machine scale sets in a subscription for deprecated images.

Your SQL Server remains unaffected when a SQL Server Azure Marketplace image is deprecated:

• Your Azure VM continues to run without interruption.
• Your SQL Server instance continues to function normally.
• You can't deploy new VMs by using the deprecated SQL Server image.

Existing deployments require no action.

Active images are images that aren't scheduled for deprecation or already deprecated.

Use Azure CLI

az vm image list --location eastus --publisher "MicrosoftWindowsServer" --offer "WindowsServer" --sku "2022-Datacenter" --all --query "[?imageDeprecationStatus.imageState=='Active']"

Use PowerShell

Get-AzVMImage -Location "westus" `
  -PublisherName "center-for-internet-security-inc" `
  -Offer "cis-rocky" `
  -Skus "cis-rockylinux-9-l1-gen2-azure-observability" `
  -Expand "properties/imageDeprecationStatus" |
  Where-Object { $_.ImageDeprecationStatus.ImageState -eq "Active" } |
  Select-Object Version