{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "slug": "dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks", "url": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/" }, "title": "Include the attestation endpoint in Trusted Launch integrity-monitoring checks", "summary": "What should be checked when a Trusted Launch VM's Guest Attestation extension fails behind network controls?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:26+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 252, "potentially_affected": "Azure Trusted Launch VM operators configuring or troubleshooting Guest Attestation.", "dse_recommendation": "Review the attestation communication path before treating an extension-provisioning failure as a boot-integrity finding.", "primary_source": { "name": "Boot integrity monitoring overview - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/boot-integrity-monitoring-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Trusted Launch uses guest attestation through Azure Attestation to monitor the boot sequence. Installing the attestation extensions requires both Secure Boot and vTPM. Microsoft identifies NSG or proxy configuration as a possible cause of Guest Attestation provisioning failure: the extension needs communication with the attestation endpoint. The documented NSG procedure permits outbound access using the AzureAttestation service tag. Microsoft Learn.

\n

Applicability

\n

Use this check for a Trusted Launch VM whose integrity-monitoring deployment or reporting needs investigation. Record its security settings and actual extension status. Distinguish the investigation of an unavailable attestation path from an assessment of the VM’s boot evidence.

\n

DSE recommendation

\n

Review the attestation communication path before treating an extension-provisioning failure as a boot-integrity finding. Ask the network owner to inspect the relevant outbound policy and proxy route. Propose only the narrowly scoped change justified by the documented endpoint requirement. Keep the VM security configuration, extension deployment, and network exception in the same investigation record so one team’s successful change does not close another team’s unresolved check.

\n

Verification

\n

After an approved correction, inspect the Guest Attestation extension’s provisioning result and the corresponding integrity-monitoring status. Confirm that the intended outbound rule applies to the tested VM and that unrelated access was not broadened. Preserve any remaining error message with the tested configuration. Require the responsible security reviewer to interpret the resulting attestation information; a successful network connection alone should not be used as the investigation’s final acceptance criterion.

\n

Official references

\n

Microsoft Learn: Boot integrity monitoring overview. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Trusted Launch uses guest attestation through Azure Attestation to monitor the boot sequence. Installing the attestation extensions requires both Secure Boot and vTPM. Microsoft identifies NSG or proxy configuration as a possible cause of Guest Attestation provisioning failure: the extension needs communication with the attestation endpoint. The documented NSG procedure permits outbound access using the AzureAttestation service tag. Microsoft Learn.\nApplicability\nUse this check for a Trusted Launch VM whose integrity-monitoring deployment or reporting needs investigation. Record its security settings and actual extension status. Distinguish the investigation of an unavailable attestation path from an assessment of the VM’s boot evidence.\nDSE recommendation\nReview the attestation communication path before treating an extension-provisioning failure as a boot-integrity finding. Ask the network owner to inspect the relevant outbound policy and proxy route. Propose only the narrowly scoped change justified by the documented endpoint requirement. Keep the VM security configuration, extension deployment, and network exception in the same investigation record so one team’s successful change does not close another team’s unresolved check.\nVerification\nAfter an approved correction, inspect the Guest Attestation extension’s provisioning result and the corresponding integrity-monitoring status. Confirm that the intended outbound rule applies to the tested VM and that unrelated access was not broadened. Preserve any remaining error message with the tested configuration. Require the responsible security reviewer to interpret the resulting attestation information; a successful network connection alone should not be used as the investigation’s final acceptance criterion.\nOfficial references\nMicrosoft Learn: Boot integrity monitoring overview. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Trusted Launch uses guest attestation through Azure Attestation to monitor the boot sequence. Installing the attestation extensions requires both Secure Boot and vTPM. Microsoft identifies NSG or proxy configuration as a possible cause of Guest Attestation provisioning failure: the extension needs communication with the attestation endpoint. The documented NSG procedure permits outbound access using the AzureAttestation service tag. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/boot-integrity-monitoring-overview).\n\n## Applicability\n\nUse this check for a Trusted Launch VM whose integrity-monitoring deployment or reporting needs investigation. Record its security settings and actual extension status. Distinguish the investigation of an unavailable attestation path from an assessment of the VM’s boot evidence.\n\n## DSE recommendation\n\nReview the attestation communication path before treating an extension-provisioning failure as a boot-integrity finding. Ask the network owner to inspect the relevant outbound policy and proxy route. Propose only the narrowly scoped change justified by the documented endpoint requirement. Keep the VM security configuration, extension deployment, and network exception in the same investigation record so one team’s successful change does not close another team’s unresolved check.\n\n## Verification\n\nAfter an approved correction, inspect the Guest Attestation extension’s provisioning result and the corresponding integrity-monitoring status. Confirm that the intended outbound rule applies to the tested VM and that unrelated access was not broadened. Preserve any remaining error message with the tested configuration. Require the responsible security reviewer to interpret the resulting attestation information; a successful network connection alone should not be used as the investigation’s final acceptance criterion.\n\n## Official references\n\n[Microsoft Learn: Boot integrity monitoring overview](https://learn.microsoft.com/en-us/azure/virtual-machines/boot-integrity-monitoring-overview). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "url": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include the attestation endpoint in Trusted Launch integrity-monitoring checks", "item": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "url": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/", "headline": "Include the attestation endpoint in Trusted Launch integrity-monitoring checks", "description": "What should be checked when a Trusted Launch VM's Guest Attestation extension fails behind network controls?", "abstract": "What should be checked when a Trusted Launch VM's Guest Attestation extension fails behind network controls?", "articleBody": "Source facts\nAzure Trusted Launch uses guest attestation through Azure Attestation to monitor the boot sequence. Installing the attestation extensions requires both Secure Boot and vTPM. Microsoft identifies NSG or proxy configuration as a possible cause of Guest Attestation provisioning failure: the extension needs communication with the attestation endpoint. The documented NSG procedure permits outbound access using the AzureAttestation service tag. Microsoft Learn.\nApplicability\nUse this check for a Trusted Launch VM whose integrity-monitoring deployment or reporting needs investigation. Record its security settings and actual extension status. Distinguish the investigation of an unavailable attestation path from an assessment of the VM’s boot evidence.\nDSE recommendation\nReview the attestation communication path before treating an extension-provisioning failure as a boot-integrity finding. Ask the network owner to inspect the relevant outbound policy and proxy route. Propose only the narrowly scoped change justified by the documented endpoint requirement. Keep the VM security configuration, extension deployment, and network exception in the same investigation record so one team’s successful change does not close another team’s unresolved check.\nVerification\nAfter an approved correction, inspect the Guest Attestation extension’s provisioning result and the corresponding integrity-monitoring status. Confirm that the intended outbound rule applies to the tested VM and that unrelated access was not broadened. Preserve any remaining error message with the tested configuration. Require the responsible security reviewer to interpret the resulting attestation information; a successful network connection alone should not be used as the investigation’s final acceptance criterion.\nOfficial references\nMicrosoft Learn: Boot integrity monitoring overview. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:26+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-030-include-the-attestation-endpoint-in-trusted-launch-integrity-monitoring-checks/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include the attestation endpoint in Trusted Launch integrity-monitoring checks" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 252, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Boot integrity monitoring overview - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/boot-integrity-monitoring-overview" } } ] } }