Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
vm_trusted_launch_enabledProvider: Azure
Service:
vmSeverity: MEDIUM
Categories:
node-securityResource type:
microsoft.compute/virtualmachinesWhat this check verifies
Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled. Identifies VMs not set toTrustedLaunch or missing secureBootEnabled and vTpmEnabled together.
Risk
Missing Trusted Launch weakens boot-chain integrity. Attackers can persist via bootkits/rootkits, bypass OS controls, steal secrets, and tamper with drivers. Loss of attestation reduces detection, risking integrity, confidentiality, and availability through stealthy, hard-to-remediate compromises.Recommendation
Adopt defense in depth: enable Trusted Launch with Secure Boot and vTPM on Gen2 VMs. Standardize on images with signed boot components and use supported sizes/OS. Enforce least privilege for administrators and enable attestation monitoring to prevent and detect boot-level tampering.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az vm update —resource-group <RESOURCE_GROUP> —name <VM_NAME> —security-type TrustedLaunch —enable-secure-boot true —enable-vtpm true
References
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = vm_trusted_launch_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks