diff --git a/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch b/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
new file mode 100644
index 0000000..017e2c5
--- /dev/null
+++ b/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
@@ -0,0 +1,59 @@
+From 5691fd1ce3eb430c8da19538b5988eba7da6d2be Mon Sep 17 00:00:00 2001
+From: Eduardo Otubo <otubo@redhat.com>
+Date: Thu, 21 Jan 2021 09:57:53 +0100
+Subject: [PATCH] DataSourceAzure: update password for defuser if exists (#671)
+
+RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
+RH-MergeRequest: 36: DataSourceAzure: update password for defuser if exists (#671)
+RH-Commit: [1/1] a834a44ca127480512137b4258ff01e993fbee41 (eterrell/cloud-init)
+RH-Bugzilla: 1916839
+
+commit eea754492f074e00b601cf77aa278e3623857c5a
+Author: Anh Vo <anhvo@microsoft.com>
+Date:   Thu Nov 19 00:35:46 2020 -0500
+
+    DataSourceAzure: update password for defuser if exists (#671)
+
+    cc_set_password will only update the password for the default user if
+    cfg['password'] is set. The existing code of datasource Azure will fail
+    to update the default user's password because it does not set that
+    metadata. If the default user doesn't exist in the image, the current
+    code works fine because the password is set during user create and
+    not in cc_set_password
+
+Signed-off-by: Eduardo Otubo <otubo@redhat.com>
+---
+ cloudinit/sources/DataSourceAzure.py          | 2 +-
+ tests/unittests/test_datasource/test_azure.py | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
+index 6fb889c4..69454c40 100755
+--- a/cloudinit/sources/DataSourceAzure.py
++++ b/cloudinit/sources/DataSourceAzure.py
+@@ -1206,7 +1206,7 @@ def read_azure_ovf(contents):
+     if password:
+         defuser['lock_passwd'] = False
+         if DEF_PASSWD_REDACTION != password:
+-            defuser['passwd'] = encrypt_pass(password)
++            defuser['passwd'] = cfg['password'] = encrypt_pass(password)
+ 
+     if defuser:
+         cfg['system_info'] = {'default_user': defuser}
+diff --git a/tests/unittests/test_datasource/test_azure.py b/tests/unittests/test_datasource/test_azure.py
+index a809fd87..f141dc6c 100644
+--- a/tests/unittests/test_datasource/test_azure.py
++++ b/tests/unittests/test_datasource/test_azure.py
+@@ -899,6 +899,9 @@ scbus-1 on xpt0 bus 0
+                          crypt.crypt(odata['UserPassword'],
+                                      defuser['passwd'][0:pos]))
+ 
++        # the same hashed value should also be present in cfg['password']
++        self.assertEqual(defuser['passwd'], dsrc.cfg['password'])
++
+     def test_user_not_locked_if_password_redacted(self):
+         odata = {'HostName': "myhost", 'UserName': "myuser",
+                  'UserPassword': dsaz.DEF_PASSWD_REDACTION}
+-- 
+2.18.4
+
diff --git a/SPECS/cloud-init.spec b/SPECS/cloud-init.spec
index 673efce..00a198a 100644
--- a/SPECS/cloud-init.spec
+++ b/SPECS/cloud-init.spec
@@ -6,7 +6,7 @@
 
 Name:           cloud-init
 Version:        19.4
-Release:        11%{?dist}.1
+Release:        11%{?dist}.2
 Summary:        Cloud instance init scripts
 
 Group:          System Environment/Base
@@ -64,6 +64,8 @@ Patch26: ci-Add-config-modules-for-controlling-IBM-PowerVM-RMC.-.patch
 Patch27: ci-Explicit-set-IPV6_AUTOCONF-and-IPV6_FORCE_ACCEPT_RA-.patch
 # For bz#1894015 - Add support for ipv6_autoconf[rhel-8.3.0.z]
 Patch28: ci-net-fix-rendering-of-static6-in-network-config-77.patch
+# For bz#1916839 - [Azure] Update existing user password RHEL8x [rhel-8.3.0.z]
+Patch29: ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
 
 BuildArch:      noarch
 
@@ -247,6 +249,11 @@ fi
 %config(noreplace) %{_sysconfdir}/rsyslog.d/21-cloudinit.conf
 
 %changelog
+* Tue Jan 26 2021 Miroslav Rezanina <mrezanin@redhat.com> - 19.4-11.el8_3.2
+- ci-DataSourceAzure-update-password-for-defuser-if-exist.patch [bz#1916839]
+- Resolves: bz#1916839
+  ([Azure] Update existing user password RHEL8x [rhel-8.3.0.z])
+
 * Mon Nov 09 2020 Miroslav Rezanina <mrezanin@redhat.com> - 19.4-11.el8_3.1
 - ci-DHCP-sandboxing-failing-on-noexec-mounted-var-tmp-52.patch [bz#1879989]
 - ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1890551]