# Verify the security type produced by Trusted Launch defaults

> Can a successful Gen2 deployment still lack Trusted Launch when default behavior is expected?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:24+00:00
- Modified: 2026-09-10T00:35:08+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Can a successful Gen2 deployment still lack Trusted Launch when default behavior is expected?

## Potentially affected

Teams relying on Trusted Launch defaults in new Azure Gen2 VM or scale-set deployment workflows.

## DSE recommendation

Make the resulting security type and UEFI settings explicit acceptance checks for each deployment path.

## Article

## Source facts

For API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch).

## Applicability

Review the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.

## DSE recommendation

Make the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.

## Verification

Deploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.

## Official references

[Microsoft Learn: Trusted Launch for Azure virtual machines](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch). Source reviewed September 9, 2026.

## Primary reference

- Name: Trusted Launch for Azure VMs - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify the security type produced by Trusted Launch defaults,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-092-verify-the-security-type-produced-by-trusted-launch-defaults/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.