Root CA for Hyper-V virtual TPM Endorsement Key required for setting up Always Encrypted

Question

I'm trying to setup Always Encrypted with Secure Enclaves in a lab environment using Hyper-V. HostKey attestation is straightforward, but I'm struggling with TPM mode.

My setup is a Hyper-V host VM with Windows Server 2019, then within Hyper-V on that VM I have two VMs, one to run SQL Server and one to run HGS (both also on Windows Server 2019). The SQL VM is configured with a virtual TPM. I run into problems when I attempt to add the Endorsement Key (EK) for the VM to HGS using the Add-HgsAttestationTpmHost. I get an error saying that the EK is untrusted due to a partial chain. I assume this is because the root CA for the TPM does not exist in the TrustedTPM_RootCA store on the HGS VM, as well as any intermediate certificates required in the TrustedTPM_IntermediateCA store. I have installed the trusted TPM root certificates package from Microsoft for physical TPMs but that doesn't cover Hyper-V virtual machines.

The root CA for the EK belonging to the TPM on the Hyper-V VM is "Microsoft Hyper-V CA". I suspect this is a certificate that exists on my host VM - and is unique to it - but I can't find it anywhere. It could be that I am wrong in that and it is a global certificate, however I can't find it anywhere else or any reference where to gt it.

Any help / advice on where I can find the certificate, or how else I can import the EK to HGS would be much appreciated.