Plan Trusted Launch rollback as a one-way security transition
Can an existing Azure Gen2 VM be freely toggled between Trusted Launch and Standard security?
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 48 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,626 articlesGuidance and analysis from DSE
Reconcile the retained Gen1 image reference after a Trusted Launch upgrade
Why should reimage and guest-patching workflows be reviewed after a Gen1 VM becomes Trusted Launch?
Read the guide
Choose UEFI key replacement or extension deliberately in a gallery image
Will a custom Azure image replace the default Secure Boot databases or add to their trust?
Read the guide
Account for fault-domain alignment when reattaching Premium SSD v2 disks
Why can repeated disk moves fail while Azure is aligning Premium SSD v2 storage with an availability-set VM?
Read the guide
Treat VM user data as mutable shared metadata rather than a secret delivery channel
What contract should an application follow when consuming Azure VM user data that can change without a reboot?
Read the guide
Model VM Application dependencies with order and failure behavior together
Which later VM Applications will still install if an earlier package fails?
Read the guide
Package Linux application dependencies for the VM's actual repository access
Will a VM Application package install when its target Linux VM cannot download missing dependencies?
Read the checklist
Read VM Application audit compliance within its operating-system filter
Does the supplied VM Application policy's compliant result prove the application exists on every resource?
Read the guide
Remove VM Application consumer references before deleting the published application
Can a published VM Application be deleted safely while VM profiles still reference it?
Read the guide
Attach the publishing identity to the gallery, not the destination VM
Which identity reads a private application blob when an Azure VM Application version is published?
Read the guide