Check provider logo

Virtual Machine has Trusted Launch with Secure Boot and vTPM enabled

vm_trusted_launch_enabled

Severitymedium
Servicevm
by Prowler
node-security

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled.

Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Risk

Missing Trusted Launch weakens boot-chain integrity. Attackers can persist via bootkits/rootkits, bypass OS controls, steal secrets, and tamper with drivers. Loss of attestation reduces detection, risking integrity, confidentiality, and availability through stealthy, hard-to-remediate compromises.

Run this check with Prowler CLI

prowler azure --checks vm_trusted_launch_enabled

Run in Prowler Cloud

Recommendation

Adopt defense in depth: enable Trusted Launch with Secure Boot and vTPM on Gen2 VMs. Standardize on images with signed boot components and use supported sizes/OS. Enforce least privilege for administrators and enable attestation monitoring to prevent and detect boot-level tampering.

Remediation

CLI

az vm update --resource-group <RESOURCE_GROUP> --name <VM_NAME> --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true

Native IaC
Terraform
Other
  1. In Azure Portal, open the VM and click Stop to deallocate it
  2. Go to Settings > Configuration
  3. Under Security type, select Trusted launch
  4. Check Secure Boot and vTPM
  5. Click Save
  6. Start the VM from the Overview page

Source Code

Resource Type

microsoft.compute/virtualmachines

References