diff --git a/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch b/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
new file mode 100644
index 0000000..017e2c5
--- /dev/null
+++ b/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
@@ -0,0 +1,59 @@
+From 5691fd1ce3eb430c8da19538b5988eba7da6d2be Mon Sep 17 00:00:00 2001
+From: Eduardo Otubo <otubo@redhat.com>
+Date: Thu, 21 Jan 2021 09:57:53 +0100
+Subject: [PATCH] DataSourceAzure: update password for defuser if exists (#671)
+
+RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
+RH-MergeRequest: 36: DataSourceAzure: update password for defuser if exists (#671)
+RH-Commit: [1/1] a834a44ca127480512137b4258ff01e993fbee41 (eterrell/cloud-init)
+RH-Bugzilla: 1916839
+
+commit eea754492f074e00b601cf77aa278e3623857c5a
+Author: Anh Vo <anhvo@microsoft.com>
+Date: Thu Nov 19 00:35:46 2020 -0500
+
+ DataSourceAzure: update password for defuser if exists (#671)
+
+ cc_set_password will only update the password for the default user if
+ cfg['password'] is set. The existing code of datasource Azure will fail
+ to update the default user's password because it does not set that
+ metadata. If the default user doesn't exist in the image, the current
+ code works fine because the password is set during user create and
+ not in cc_set_password
+
+Signed-off-by: Eduardo Otubo <otubo@redhat.com>
+---
+ cloudinit/sources/DataSourceAzure.py | 2 +-
+ tests/unittests/test_datasource/test_azure.py | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
+index 6fb889c4..69454c40 100755
+--- a/cloudinit/sources/DataSourceAzure.py
++++ b/cloudinit/sources/DataSourceAzure.py
+@@ -1206,7 +1206,7 @@ def read_azure_ovf(contents):
+ if password:
+ defuser['lock_passwd'] = False
+ if DEF_PASSWD_REDACTION != password:
+- defuser['passwd'] = encrypt_pass(password)
++ defuser['passwd'] = cfg['password'] = encrypt_pass(password)
+
+ if defuser:
+ cfg['system_info'] = {'default_user': defuser}
+diff --git a/tests/unittests/test_datasource/test_azure.py b/tests/unittests/test_datasource/test_azure.py
+index a809fd87..f141dc6c 100644
+--- a/tests/unittests/test_datasource/test_azure.py
++++ b/tests/unittests/test_datasource/test_azure.py
+@@ -899,6 +899,9 @@ scbus-1 on xpt0 bus 0
+ crypt.crypt(odata['UserPassword'],
+ defuser['passwd'][0:pos]))
+
++ # the same hashed value should also be present in cfg['password']
++ self.assertEqual(defuser['passwd'], dsrc.cfg['password'])
++
+ def test_user_not_locked_if_password_redacted(self):
+ odata = {'HostName': "myhost", 'UserName': "myuser",
+ 'UserPassword': dsaz.DEF_PASSWD_REDACTION}
+--
+2.18.4
+
diff --git a/SPECS/cloud-init.spec b/SPECS/cloud-init.spec
index 673efce..00a198a 100644
--- a/SPECS/cloud-init.spec
+++ b/SPECS/cloud-init.spec
@@ -6,7 +6,7 @@
Name: cloud-init
Version: 19.4
-Release: 11%{?dist}.1
+Release: 11%{?dist}.2
Summary: Cloud instance init scripts
Group: System Environment/Base
@@ -64,6 +64,8 @@ Patch26: ci-Add-config-modules-for-controlling-IBM-PowerVM-RMC.-.patch
Patch27: ci-Explicit-set-IPV6_AUTOCONF-and-IPV6_FORCE_ACCEPT_RA-.patch
# For bz#1894015 - Add support for ipv6_autoconf[rhel-8.3.0.z]
Patch28: ci-net-fix-rendering-of-static6-in-network-config-77.patch
+# For bz#1916839 - [Azure] Update existing user password RHEL8x [rhel-8.3.0.z]
+Patch29: ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
BuildArch: noarch
@@ -247,6 +249,11 @@ fi
%config(noreplace) %{_sysconfdir}/rsyslog.d/21-cloudinit.conf
%changelog
+* Tue Jan 26 2021 Miroslav Rezanina <mrezanin@redhat.com> - 19.4-11.el8_3.2
+- ci-DataSourceAzure-update-password-for-defuser-if-exist.patch [bz#1916839]
+- Resolves: bz#1916839
+ ([Azure] Update existing user password RHEL8x [rhel-8.3.0.z])
+
* Mon Nov 09 2020 Miroslav Rezanina <mrezanin@redhat.com> - 19.4-11.el8_3.1
- ci-DHCP-sandboxing-failing-on-noexec-mounted-var-tmp-52.patch [bz#1879989]
- ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1890551]