{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "slug": "dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults", "url": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/" }, "title": "Verify the security type produced by Trusted Launch defaults", "summary": "Can a successful Gen2 deployment still lack Trusted Launch when default behavior is expected?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:24+00:00", "modified_at": "2026-09-10T00:35:08+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 247, "potentially_affected": "Teams relying on Trusted Launch defaults in new Azure Gen2 VM or scale-set deployment workflows.", "dse_recommendation": "Make the resulting security type and UEFI settings explicit acceptance checks for each deployment path.", "primary_source": { "name": "Trusted Launch for Azure VMs - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. Microsoft Learn.

\n

Applicability

\n

Review the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.

\n

DSE recommendation

\n

Make the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.

\n

Verification

\n

Deploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.

\n

Official references

\n

Microsoft Learn: Trusted Launch for Azure virtual machines. Source reviewed September 9, 2026.

", "content_text": "Source facts\nFor API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. Microsoft Learn.\nApplicability\nReview the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.\nDSE recommendation\nMake the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.\nVerification\nDeploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.\nOfficial references\nMicrosoft Learn: Trusted Launch for Azure virtual machines. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nFor API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch).\n\n## Applicability\n\nReview the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.\n\n## DSE recommendation\n\nMake the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.\n\n## Verification\n\nDeploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.\n\n## Official references\n\n[Microsoft Learn: Trusted Launch for Azure virtual machines](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "url": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify the security type produced by Trusted Launch defaults", "item": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "url": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/", "headline": "Verify the security type produced by Trusted Launch defaults", "description": "Can a successful Gen2 deployment still lack Trusted Launch when default behavior is expected?", "abstract": "Can a successful Gen2 deployment still lack Trusted Launch when default behavior is expected?", "articleBody": "Source facts\nFor API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. Microsoft Learn.\nApplicability\nReview the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.\nDSE recommendation\nMake the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.\nVerification\nDeploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.\nOfficial references\nMicrosoft Learn: Trusted Launch for Azure virtual machines. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:24+00:00", "dateModified": "2026-09-10T00:35:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify the security type produced by Trusted Launch defaults" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 247, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Trusted Launch for Azure VMs - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch" } } ] } }