Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Enable Trusted Launch for Azure Virtual Machines

Enable Trusted Launch for Azure Virtual Machines

Written By Jitesh Kumar
Last Updated October 6, 2023
Posted In Azure
SHARE

This post walks you through the steps to Enable Trusted Launch for existing Azure Virtual Machines. Enabling Trusted Launch for Azure Virtual Machines improves the security of generation 2 VMs to safeguard your workloads against advanced threats, enhancing the trustworthiness of the boot process.

Azure offers trusted launch as a seamless way to improve the security of generation 2 VMs. Trusted launch protects against advanced and persistent attack techniques against boot kits, rootkits, and kernel-level malware.

Trusted launch requires the creation of a new virtual machine scale set (VMSS). You cannot enable trusted launch on existing VMSS that were initially created without it. Trusted launch as default for VMs deployed through the Azure portal.

Enabling Trusted Launch on existing VM presents certain limitations in specific scenarios within the Azure environment. Generation 1 VMs are not currently compatible with Trusted Launch. Additionally, Trusted Launch is not supported for Azure Virtual Machine Scale Sets (VMSS) in both Uniform and Flex configurations.

Patch My PC

Prerequisites for Enabling Trusted Launch for Azure VMs

Following the prerequisites is essential if you are planning to enable trusted launch on existing Azure Virtual Machines.

  • Azure Generation 2 VM(s) is configured with Trusted launch supported size family and supported OS Image. The base image should be Trusted launch capable of custom OS images or disks.
  • Azure Generation 2 VM(s) should be stopped and deallocated before enabling the Trusted launch security type.
  • Azure Backup, if enabled for Generation 2 VM(s) should be configured with Enhanced Backup Policy. Trusted launch security type cannot be enabled for Generation 2 VM(s) configured with Standard Policy backup protection.

Enable Trusted Launch for Azure Virtual Machines

The steps help you through using the Azure portal to enable Trusted launch on existing Azure Generation 2 VM, You also have the option to Create a virtual machine with trusted launch enabled.

  • Log in to the Azure portal. Navigate to the Virtual Machines tab for Validating virtual machine generation is V2 and Stop the VM if it is already in running state.
Enable Trusted Launch for Azure Virtual Machines Fig.1
Enable Trusted Launch for Azure Virtual Machines Fig.1

On the Overview page in VM Properties, Select Standard under Security type. This navigates to the Configuration page for VM.

Enable Trusted Launch for Azure Virtual Machines Fig.2
Enable Trusted Launch for Azure Virtual Machines Fig.2

Select the drop-down Security type under the Security type section of the Configuration page. Select Trusted Launch under the drop-down and select checkboxes to enable Secure Boot and vTPM. Click Save after making the required changes.

  • Secure boot – At the root of trusted launch is Secure Boot for your VM. This mode, implemented in platform firmware, protects against installing malware-based rootkits and boot kits. Secure Boot works to ensure that only signed operating systems and drivers can boot.
  • vTPM is a virtualized version of a hardware Trusted Platform Module compliant with the TPM2.0 spec. It serves as a dedicated secure vault for keys and measurements.
Enable Trusted Launch for Azure Virtual Machines Fig.3
Enable Trusted Launch for Azure Virtual Machines Fig.3

Close the Configuration page once the update is successfully complete and validate the Security type under Virtual machine properties.

Enable Trusted Launch for Azure Virtual Machines Fig.4
Enable Trusted Launch for Azure Virtual Machines Fig.4

Once you start the upgraded Trusted launch VM ensure that it has started successfully, and verify that you are able to log in to the VM using RDP (for Windows VM).

Author

About Author – Jitesh, Microsoft MVP, has over six years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10/11 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

Written by

Jitesh has over 5 years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus area is Windows 10 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Azure

Azure Files Goes Cloud-Native with Entra-Only Identities and Managed Identities

Key Takeaways Managed Identity and Entra-Only identities for Azure Files help organizations build a fully cloud-native and secure storage environment by removing the need for passwords, storage account keys, on-premises Active Directory, or hybrid identity infrastructure. With native Microsoft Entra ID authentication, applications, virtual machines, and users can securely access Azure Files using identity-based authentication […]

AC Anoop C Nair 4 min read
Azure

Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios

key Takeaways: Let’s discuss about Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios. Microsoft announced the Maintenance mode in Dev Box, and no additional features are planned. Microsoft’s investments for developer cloud environments are focused on Windows 365, which provides a unified, scalable solution for developer scenarios. Microsoft […]

AC Anoop C Nair 3 min read
Azure

Multi-Zone Management Platform Architecture for Windows Cloud Solutions

Key Takeaways Multi-Zone Management Platform Architecture for Windows Cloud Solutions! This architecture highlights the core MicrosoftMicrosoft Azure components used to host and deliver Cloud PC services. To ensure high availability and reliability, the infrastructure is distributed across multiple availability zones within each region. This design helps protect the service from zonal outages and keeps workloads […]

AC Anoop C Nair 4 min read
Azure

How to Protect and Recover your Infrastructure with Azure Site Recovery

Key Takeaways Azure Site Recovery is a disaster-recovery service in Microsoft Azure that helps keep your applications running if a cloud region fails. Normally, your virtual machines (VMs) run in one region. ASR creates a copy of those machines in another region so that if the main region goes down, your services can continue running […]

AC Anoop C Nair 4 min read