Check ID: vm_trusted_launch_enabled
Provider: Azure
Service: vm
Severity: MEDIUM
Categories: node-security
Resource type: microsoft.compute/virtualmachines

What this check verifies

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled. Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Risk

Missing Trusted Launch weakens boot-chain integrity. Attackers can persist via bootkits/rootkits, bypass OS controls, steal secrets, and tamper with drivers. Loss of attestation reduces detection, risking integrity, confidentiality, and availability through stealthy, hard-to-remediate compromises.

Recommendation

Adopt defense in depth: enable Trusted Launch with Secure Boot and vTPM on Gen2 VMs. Standardize on images with signed boot components and use supported sizes/OS. Enforce least privilege for administrators and enable attestation monitoring to prevent and detect boot-level tampering.

Remediation

az vm update —resource-group <RESOURCE_GROUP> —name <VM_NAME> —security-type TrustedLaunch —enable-secure-boot true —enable-vtpm true

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = vm_trusted_launch_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks