Back to Checks
azure

Virtual Machine has Trusted Launch with Secure Boot and vTPM enabled

vm_trusted_launch_enabled
Service: vmSeverity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:microsoft.compute/virtualmachines

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled.

Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Prowler logoProwlerprowler-provider-azure

Risk

Missing Trusted Launch weakens boot-chain integrity. Attackers can persist via bootkits/rootkits, bypass OS controls, steal secrets, and tamper with drivers. Loss of attestation reduces detection, risking integrity, confidentiality, and availability through stealthy, hard-to-remediate compromises.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks vm_trusted_launch_enabled

Recommendation

Adopt defense in depth: enable Trusted Launch with Secure Boot and vTPM on Gen2 VMs. Standardize on images with signed boot components and use supported sizes/OS. Enforce least privilege for administrators and enable attestation monitoring to prevent and detect boot-level tampering.

Remediation

CLI

az vm update --resource-group <RESOURCE_GROUP> --name <VM_NAME> --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true

Terraform

# Patch the existing VM to enable Trusted Launch with Secure Boot and vTPM
resource "azapi_update_resource" "<example_resource_name>" {
  type        = "Microsoft.Compute/virtualMachines@2022-11-01"
  resource_id = "<example_resource_id>"

  body = jsonencode({
    properties = {
      securityProfile = {
        securityType = "TrustedLaunch" # Critical: sets VM security type to Trusted Launch
        uefiSettings = {
          secureBootEnabled = true      # Critical: enables Secure Boot
          vTpmEnabled       = true      # Critical: enables vTPM
        }
      }
    }
  })
}

NativeIaC

// Enables Trusted Launch with Secure Boot and vTPM on the VM
resource vm 'Microsoft.Compute/virtualMachines@2022-11-01' = {
  name: '<example_resource_name>'
  location: '<region>'
  properties: {
    securityProfile: {
      securityType: 'TrustedLaunch' // Critical: sets VM security type to Trusted Launch
      uefiSettings: {
        secureBootEnabled: true     // Critical: enables Secure Boot
        vTpmEnabled: true           // Critical: enables vTPM
      }
    }
  }
}

Other

1In Azure Portal, open the VM and click Stop to deallocate it
2Go to Settings > Configuration
3Under Security type, select Trusted launch
4Check Secure Boot and vTPM
5Click Save
6Start the VM from the Overview page

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.vm.vm_client import vm_client


class vm_trusted_launch_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, vms in vm_client.virtual_machines.items():
            subscription_name = vm_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for vm in vms.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=vm)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"VM {vm.resource_name} has trusted launch disabled in subscription {subscription_name} ({subscription_id})"

                if (
                    vm.security_profile
                    and vm.security_profile.security_type == "TrustedLaunch"
                    and vm.security_profile.uefi_settings.secure_boot_enabled
                    and vm.security_profile.uefi_settings.v_tpm_enabled
                ):
                    report.status = "PASS"
                    report.status_extended = f"VM {vm.resource_name} has trusted launch enabled in subscription {subscription_name} ({subscription_id})"

                findings.append(report)

        return findings

References