{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "slug": "dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block", "url": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/" }, "title": "Do not treat a gallery image's end-of-life date as a deployment block", "summary": "Will setting an Azure Compute Gallery image end-of-life date prevent new VMs from using it?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:29+00:00", "modified_at": "2026-09-10T00:35:08+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 240, "potentially_affected": "Image owners defining lifecycle rules for Azure Compute Gallery definitions and versions.", "dse_recommendation": "Document the enforcement mechanism separately from the image's informational end-of-life metadata.", "primary_source": { "name": "Share VM images in a compute gallery - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Compute Gallery end-of-life dates are informational: users can still create VMs from image versions after those dates. A definition groups versions and carries their shared metadata, but deployment uses an image version rather than the definition itself. An informational lifecycle date is therefore separate from the decision to allow a particular version in deployment. Microsoft Learn.

\n

Applicability

\n

Review both the image definition and the individual version referenced by a deployment workflow. Identify whether consumers pin a specific version or request latest. Clarify whether the business requirement is a notice, a preferred version, or an actual prohibition on new deployments.

\n

DSE recommendation

\n

Document the enforcement mechanism separately from the image’s informational end-of-life metadata. Ask the image owner to map each consumer’s selection method before announcing that an old version is retired. Maintain an approved-version record and have the deployment owner demonstrate how its workflow applies that decision. Do not claim a date field alone satisfies a prohibition.

\n

Verification

\n

In a nonproduction check, inspect which version a representative workflow actually selects and compare it with the approved-version record. Include a pinned reference and a latest request if both are used. Test the proposed lifecycle restriction directly under authorized conditions rather than merely checking that the date was saved. Preserve the selected version ID and outcome, and investigate any consumer that can still choose a disallowed version.

\n

Official references

\n

Microsoft Learn: Azure Compute Gallery images and versions. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Compute Gallery end-of-life dates are informational: users can still create VMs from image versions after those dates. A definition groups versions and carries their shared metadata, but deployment uses an image version rather than the definition itself. An informational lifecycle date is therefore separate from the decision to allow a particular version in deployment. Microsoft Learn.\nApplicability\nReview both the image definition and the individual version referenced by a deployment workflow. Identify whether consumers pin a specific version or request latest. Clarify whether the business requirement is a notice, a preferred version, or an actual prohibition on new deployments.\nDSE recommendation\nDocument the enforcement mechanism separately from the image’s informational end-of-life metadata. Ask the image owner to map each consumer’s selection method before announcing that an old version is retired. Maintain an approved-version record and have the deployment owner demonstrate how its workflow applies that decision. Do not claim a date field alone satisfies a prohibition.\nVerification\nIn a nonproduction check, inspect which version a representative workflow actually selects and compare it with the approved-version record. Include a pinned reference and a latest request if both are used. Test the proposed lifecycle restriction directly under authorized conditions rather than merely checking that the date was saved. Preserve the selected version ID and outcome, and investigate any consumer that can still choose a disallowed version.\nOfficial references\nMicrosoft Learn: Azure Compute Gallery images and versions. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Compute Gallery end-of-life dates are informational: users can still create VMs from image versions after those dates. A definition groups versions and carries their shared metadata, but deployment uses an image version rather than the definition itself. An informational lifecycle date is therefore separate from the decision to allow a particular version in deployment. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries).\n\n## Applicability\n\nReview both the image definition and the individual version referenced by a deployment workflow. Identify whether consumers pin a specific version or request latest. Clarify whether the business requirement is a notice, a preferred version, or an actual prohibition on new deployments.\n\n## DSE recommendation\n\nDocument the enforcement mechanism separately from the image’s informational end-of-life metadata. Ask the image owner to map each consumer’s selection method before announcing that an old version is retired. Maintain an approved-version record and have the deployment owner demonstrate how its workflow applies that decision. Do not claim a date field alone satisfies a prohibition.\n\n## Verification\n\nIn a nonproduction check, inspect which version a representative workflow actually selects and compare it with the approved-version record. Include a pinned reference and a latest request if both are used. Test the proposed lifecycle restriction directly under authorized conditions rather than merely checking that the date was saved. Preserve the selected version ID and outcome, and investigate any consumer that can still choose a disallowed version.\n\n## Official references\n\n[Microsoft Learn: Azure Compute Gallery images and versions](https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "url": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not treat a gallery image's end-of-life date as a deployment block", "item": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "url": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/", "headline": "Do not treat a gallery image's end-of-life date as a deployment block", "description": "Will setting an Azure Compute Gallery image end-of-life date prevent new VMs from using it?", "abstract": "Will setting an Azure Compute Gallery image end-of-life date prevent new VMs from using it?", "articleBody": "Source facts\nAzure Compute Gallery end-of-life dates are informational: users can still create VMs from image versions after those dates. A definition groups versions and carries their shared metadata, but deployment uses an image version rather than the definition itself. An informational lifecycle date is therefore separate from the decision to allow a particular version in deployment. Microsoft Learn.\nApplicability\nReview both the image definition and the individual version referenced by a deployment workflow. Identify whether consumers pin a specific version or request latest. Clarify whether the business requirement is a notice, a preferred version, or an actual prohibition on new deployments.\nDSE recommendation\nDocument the enforcement mechanism separately from the image’s informational end-of-life metadata. Ask the image owner to map each consumer’s selection method before announcing that an old version is retired. Maintain an approved-version record and have the deployment owner demonstrate how its workflow applies that decision. Do not claim a date field alone satisfies a prohibition.\nVerification\nIn a nonproduction check, inspect which version a representative workflow actually selects and compare it with the approved-version record. Include a pinned reference and a latest request if both are used. Test the proposed lifecycle restriction directly under authorized conditions rather than merely checking that the date was saved. Preserve the selected version ID and outcome, and investigate any consumer that can still choose a disallowed version.\nOfficial references\nMicrosoft Learn: Azure Compute Gallery images and versions. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:29+00:00", "dateModified": "2026-09-10T00:35:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-087-do-not-treat-a-gallery-image-s-end-of-life-date-as-a-deployment-block/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not treat a gallery image's end-of-life date as a deployment block" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 240, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Share VM images in a compute gallery - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries" } } ] } }