Verify the security type produced by Trusted Launch defaults

Source facts

For API version 2025-11-01 and later, Microsoft’s documented Trusted Launch default depends on compatible source media and VM size. If required conditions are not met, deployment can succeed as ordinary Gen2 without Trusted Launch. Defaulting does not override security inputs explicitly supplied in deployment code. The portal, CLI, and PowerShell default to Trusted Launch regardless of the subscription’s default-feature registration. Microsoft Learn.

Applicability

Review the actual deployment client, API version, source image or disk, VM size, and explicit security settings. Distinguish newly created resources from existing machines being upgraded. Do not infer the resulting security posture only from a successful deployment status or a Gen2 label.

DSE recommendation

Make the resulting security type and UEFI settings explicit acceptance checks for each deployment path. Have the infrastructure owner compare production templates with the approved security intent, including any deliberate Standard setting. Record unsupported source or size combinations as exceptions requiring a decision rather than allowing successful fallback to disappear in a deployment report.

Verification

Deploy an approved test case through the same client and API used by the workload, then inspect the resulting security profile. Compare it with the intended Secure Boot and vTPM state. Test relevant alternate image or size inputs before expanding the template’s use. Retain the inputs and observed profile together, and fail the acceptance check when the resource lacks a required protection even if resource creation itself succeeded.

Official references

Microsoft Learn: Trusted Launch for Azure virtual machines. Source reviewed September 9, 2026.