Microsoft Makes Trusted Launch the Default for New Azure Gen2 Virtual Machines
New deployments receive hardware-backed security protections automatically without added cost or configuration.
Key Takeaways:
- Trusted Launch is now enabled by default for eligible new Azure Gen2 VMs and VM scale sets.
- Security features such as Secure Boot and vTPM are automatically applied.
- Existing virtual machines are unaffected, and organizations can opt out when necessary.
Microsoft is making Azure virtual machines more secure out of the box with the general availability of Trusted Launch as Default (TLaD) for new Generation 2 (Gen2) VMs and virtual machine scale sets. The update automatically applies key security protections to new deployments without adding cost or administrative overhead.
Trusted Launch is a security capability for Azure Generation 2 virtual machines that helps protect systems from sophisticated threats targeting the boot process and operating system. This feature combines technologies (such as Secure Boot, a virtual Trusted Platform Module (vTPM), and continuous boot integrity checks) to create a trusted foundation for workloads and helps organizations detect unauthorized changes before they can compromise a virtual machine.
Microsoft highlighted that Trusted Launch as Default (TLaD) automatically strengthens the security of new Azure Gen2 virtual machines without requiring additional setup or costs. Organizations can enable protections (such as Secure Boot and vTPM by default) to reduce the risk of attacks that target a system during startup and establish a stronger security foundation for VMs.
TLaD also simplifies cloud security management by applying these protections automatically while still respecting any security settings explicitly defined by administrators. However, keep in mind that this change won’t impact existing virtual machines. For ARM templates, Bicep, Terraform, and Azure SDKs, a one-time subscription registration is required to enable Trusted Launch as the default setting for new deployments.
How does Trusted Launch as Default work?
After registration, deployments using newer Compute API versions will automatically use Trusted Launch when no security profile is specified, provided the selected VM size, operating system image, gallery image, and disk all support the feature. If any requirement is unsupported, deployment still succeeds as a standard Gen2 VM.
Microsoft notes that this feature is available across public Azure regions as well as Azure Government and Azure China environments. Organizations can choose to opt out for specific workloads by explicitly setting the security type to Standard when compatibility issues exist.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...