Virtual machines should have Trusted Launch enabled

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled. The check identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Missing Trusted Launch weakens boot-chain integrity. Loss of attestation reduces detection, risking integrity, confidentiality, and availability through stealthy, hard-to-remediate compromises.

What this control checks

VMs must be set to TrustedLaunch with both Secure Boot and vTPM enabled.

Common pitfalls

Secure Boot and vTPM must be enabled together

Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.

Use Gen2 VMs with supported sizes and OS

Enable Trusted Launch with Secure Boot and vTPM on Gen2 VMs. Standardize on images with signed boot components and use supported sizes/OS.

Audit evidence

Evidence that deployed resources meet this control: Prowler check vm_trusted_launch_enabled (prowler azure --checks vm_trusted_launch_enabled); PowerPipe control azure_compliance.control.compute_vm_trust_launch_enabled.

Framework-specific interpretation

RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-1-1 (Annex I (1.1) - UCBs should maintain an up-to-date business IT Asset Inventory Register containing the following...).

CIS Azure Benchmark v2.1.0: Mapped to 7.9 (Ensure Trusted Launch is enabled on Virtual Machines).

CIS Azure Benchmark v3.0.0: Mapped to 8.11 (Ensure Trusted Launch is enabled on Virtual Machines).