Deploy a VM with trusted launch enabled

Article
03/08/2023
9 minutes to read

Applies to: ✔️ Linux VMs ✔️ Windows VMs ✔️ Flexible scale sets ✔️ Uniform scale sets

Trusted launch is a way to improve the security of generation 2 VMs. Trusted launch protects against advanced and persistent attack techniques by combining infrastructure technologies like vTPM and secure boot.

Prerequisites

You need to onboard your subscription to Microsoft Defender for Cloud if it isn't already. Microsoft Defender for Cloud has a free tier, which offers very useful insights for various Azure and Hybrid resources. Trusted launch leverages Defender for Cloud to surface multiple recommendations regarding VM health.
Assign Azure policies initiatives to your subscription. These policy initiatives need to be assigned only once per subscription. This will automatically install all required extensions on all supported VMs.
- Configure prerequisites to enable Guest Attestation on Trusted Launch enabled VMs
- Configure machines to automatically install the Azure Monitor and Azure Security agents on virtual machines
Make sure that the firewall policies are allowing access to *.attest.azure.net

Deploy a trusted launch VM

Create a virtual machine with trusted launch enabled. Choose an option below:

Sign in to the Azure portal.
Search for Virtual Machines.
Under Services, select Virtual machines.
In the Virtual machines page, select Add, and then select Virtual machine.
Under Project details, make sure the correct subscription is selected.
Under Resource group, select Create new and type a name for your resource group or select an existing resource group from the dropdown.
Under Instance details, type a name for the virtual machine name and choose a region that supports trusted launch.
For Security type select Trusted launch virtual machines. This will make two more options appear - Secure boot and vTPM. Select the appropriate options for your deployment.
Under Image, select an image from the Recommended Gen 2 images compatible with Trusted launch. For a list, see images that supports trusted launch.

Tip

If you don't see the Gen 2 version of the image you want in the drop-down, select See all images and then change the Security type filter to Trusted Launch.
Select a VM size that supports trusted launch. See the list of supported sizes.
Fill in the Administrator account information and then Inbound port rules.
At the bottom of the page, select Review + Create
On the Create a virtual machine page, you can see the details about the VM you are about to deploy. Once validation shows as passed, select Create.

It will take a few minutes for your VM to be deployed.

Make sure you are running the latest version of Azure CLI

az login

Create a virtual machine with Trusted Launch.

az group create -n myresourceGroup -l eastus 
az vm create \
   --resource-group myResourceGroup \
   --name myVM \
   --image Canonical:UbuntuServer:18_04-lts-gen2:latest \
   --admin-username azureuser \
   --generate-ssh-keys \
   --security-type TrustedLaunch \
   --enable-secure-boot true \ 
   --enable-vtpm true

For existing VMs, you can enable or disable secure boot and vTPM settings. Updating the virtual machine with secure boot and vTPM settings will trigger auto-reboot.

az vm update \
   --resource-group myResourceGroup \
   --name myVM \
   --enable-secure-boot true \
   --enable-vtpm true

In order to provision a VM with Trusted Launch, it first needs to be enabled with the TrustedLaunch using the Set-AzVmSecurityProfile cmdlet. Then you can use the Set-AzVmUefi cmdlet to set the vTPM and SecureBoot configuration. Use the below snippet as a quick start, remember to replace the values in this example with your own.

$rgName = "myResourceGroup"
$location = "West US"
$vmName = "myTrustedVM"
$vmSize = Standard_B2s
$publisher = "MicrosoftWindowsServer"
$offer = "WindowsServer"
$sku = "2019-datacenter-gensecond"
$version = latest
$cred = Get-Credential `
   -Message "Enter a username and password for the virtual machine."

$vm = New-AzVMConfig -VMName $vmName -VMSize $vmSize 

$vm = Set-AzVMOperatingSystem `
   -VM $vm -Windows `
   -ComputerName $vmName `
   -Credential $cred `
   -ProvisionVMAgent `
   -EnableAutoUpdate 

$vm = Add-AzVMNetworkInterface -VM $vm `
   -Id $NIC.Id 

$vm = Set-AzVMSourceImage -VM $vm `
   -PublisherName $publisher `
   -Offer $offer `
   -Skus $sku `
   -Version $version 

$vm = Set-AzVMOSDisk -VM $vm `
   -StorageAccountType "StandardSSD_LRS" `
   -CreateOption "FromImage" 

$vm = Set-AzVmSecurityProfile -VM $vm `
   -SecurityType "TrustedLaunch" 

$vm = Set-AzVmUefi -VM $vm `
   -EnableVtpm $true `
   -EnableSecureBoot $true 

New-AzVM -ResourceGroupName $rgName -Location $location -VM $vm

Deploy a trusted launch VM from an Azure Compute Gallery image

Sign in to the Azure portal.
To create an Azure Compute Gallery Image from a VM, open an existing Trusted launch VM and select Capture.
In the Create an Image page that follows, allow the image to be shared to the gallery as a VM image version. Creation of Managed Images is not supported for Trusted Launch VMs.
Create a new target Azure Compute Gallery or select an existing gallery.
Select the Operating system state as either Generalized or Specialized. If you want to create a generalized image, ensure that you generalize the VM to remove machine specific information before selecting this option. If Bitlocker based encryption is enabled on your Trusted launch Windows VM, you may not be able to generalize the same.
Create a new image definition by providing a name, publisher, offer and SKU details. The Security Type of the image definition should already be set to Trusted launch.
Provide a version number for the image version.
Modify replication options if required.
At the bottom of the Create an Image page, select Review + Create and when validation shows as passed, select Create.
Once the image version is created, go the image version directly. Alternatively, you can navigate to the required image version through the image definition.
On the VM image version page, select the + Create VM to land on the Create a virtual machine page.
In the Create a virtual machine page, under Resource group, select Create new and type a name for your resource group or select an existing resource group from the dropdown.
Under Instance details, type a name for the virtual machine name and choose a region that supports trusted launch.
The image and the security type are already populated based on the selected image version. The Secure Boot and vTPM checkboxes are enabled by default.
Fill in the Administrator account information and then Inbound port rules.
At the bottom of the page, select Review + Create
On the Create a virtual machine page, you can see the details about the VM you are about to deploy. Once validation shows as passed, select Create.

In case you want to use either a managed disk or a managed disk snapshot as a source of the image version (instead of a trusted launch VM), then use the following steps

Sign in to the portal
Search for VM Image Versions and select Create
Provide the subscription, resource group, region and image version number
Select the source as Disks and/or Snapshots
Select the OS disk as a managed disk or a managed disk snapshot from the dropdown list
Select a Target Azure Compute Gallery to create and share the image. If no gallery exists, create a new gallery.
Select the Operating system state as either Generalized or Specialized. If you want to create a generalized image, ensure that you generalize the disk or snapshot to remove machine specific information.
For the Target VM Image Definition select Create new. In the window that opens, select an image definition name and ensure that the Security type is set to Trusted launch. Provide the publisher, offer and SKU information and select OK.
The Replication tab can be used to set the replica count and target regions for image replication, if required.
The Encryption tab can also be used to provide SSE encryption related information, if required.
Select Create in the Review + create tab to create the image
Once the image version is successfully created, select the + Create VM to land on the Create a virtual machine page.
Please follow steps 12 to 17 as mentioned earlier to create a trusted launch VM using this image version

Make sure you are running the latest version of Azure CLI

az login

Create an image definition with TrustedLaunch security type

az sig image-definition create --resource-group MyResourceGroup --location eastus \ 
--gallery-name MyGallery --gallery-image-definition MyImageDef \ 
--publisher TrustedLaunchPublisher --offer TrustedLaunchOffer --sku TrustedLaunchSku \ 
--os-type Linux --os-state Generalized \ 
--hyper-v-generation V2 \ 
--features SecurityType=TrustedLaunch

To create an image version, we can capture an existing Linux based Trusted launch VM. Generalize the Trusted launch VM before creating the image version.

az sig image-version create --resource-group MyResourceGroup \
--gallery-name MyGallery --gallery-image-definition MyImageDef \
--gallery-image-version 1.0.0 \
--managed-image /subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM

In case a managed disk or a managed disk snapshot needs to be used as the image source for the image version, replace the --managed-image in the above command with --os-snapshot and provide the disk or the snapshot resource name

Create a Trusted Launch VM from the above image version

adminUsername=linuxvm
az vm create --resource-group MyResourceGroup \
    --name myTrustedLaunchVM \
    --image "/subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/galleries/MyGallery/images/MyImageDef" \
    --security-type TrustedLaunch \
    --enable-secure-boot true \ 
    --enable-vtpm true \
    --admin-username $adminUsername \
    --generate-ssh-keys

Create an image definition with TrustedLaunch security type

$rgName = "MyResourceGroup"
$galleryName = "MyGallery"
$galleryImageDefinitionName = "MyImageDef"
$location = "eastus"
$publisherName = "TrustedlaunchPublisher"
$offerName = "TrustedlaunchOffer"
$skuName = "TrustedlaunchSku"
$description = "My gallery"
$SecurityType = @{Name='SecurityType';Value='TrustedLaunch'}
$features = @($SecurityType)
New-AzGalleryImageDefinition -ResourceGroupName $rgName -GalleryName $galleryName -Name $galleryImageDefinitionName -Location $location -Publisher $publisherName -Offer $offerName -Sku $skuName -HyperVGeneration "V2" -OsState "Generalized" -OsType "Windows" -Description $description -Feature $features

To create an image version, we can capture an existing Windows based Trusted launch VM. Generalize the Trusted launch VM before creating the image version.

$rgName = "MyResourceGroup"
$galleryName = "MyGallery"
$galleryImageDefinitionName = "MyImageDef"
$location = "eastus"
$galleryImageVersionName = "1.0.0"
$sourceImageId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myVMRG/providers/Microsoft.Compute/virtualMachines/myVM"
New-AzGalleryImageVersion -ResourceGroupName $rgName -GalleryName $galleryName -GalleryImageDefinitionName $galleryImageDefinitionName -Name $galleryImageVersionName -Location $location -SourceImageId $sourceImageId

Create a Trusted Launch VM from the above image version

$rgName = "MyResourceGroup"
$galleryName = "MyGallery"
$galleryImageDefinitionName = "MyImageDef"
$location = "eastus"
$vmName = "myVMfromImage"
$vmSize = "Standard_D2s_v3"
$imageDefinition = Get-AzGalleryImageDefinition `
   -GalleryName $galleryName `
   -ResourceGroupName $rgName `
   -Name $galleryImageDefinitionName
$cred = Get-Credential `
   -Message "Enter a username and password for the virtual machine"
# Network pieces
$subnetConfig = New-AzVirtualNetworkSubnetConfig `
   -Name mySubnet `
   -AddressPrefix 192.168.1.0/24
$vnet = New-AzVirtualNetwork `
   -ResourceGroupName $rgName `
   -Location $location `
   -Name MYvNET `
   -AddressPrefix 192.168.0.0/16 `
   -Subnet $subnetConfig
$pip = New-AzPublicIpAddress `
   -ResourceGroupName $rgName `
   -Location $location `
  -Name "mypublicdns$(Get-Random)" `
  -AllocationMethod Static `
  -IdleTimeoutInMinutes 4
$nsgRuleRDP = New-AzNetworkSecurityRuleConfig `
   -Name myNetworkSecurityGroupRuleRDP  `
   -Protocol Tcp `
  -Direction Inbound `
   -Priority 1000 `
   -SourceAddressPrefix * `
   -SourcePortRange * `
   -DestinationAddressPrefix * `
   -DestinationPortRange 3389 `
   -Access Deny
$nsg = New-AzNetworkSecurityGroup `
   -ResourceGroupName $rgName `
   -Location $location `
  -Name myNetworkSecurityGroup `
  -SecurityRules $nsgRuleRDP
$nic = New-AzNetworkInterface `
   -Name myNic `
   -ResourceGroupName $rgName `
   -Location $location `
  -SubnetId $vnet.Subnets[0].Id `
  -PublicIpAddressId $pip.Id `
  -NetworkSecurityGroupId $nsg.Id
$vm = New-AzVMConfig -vmName $vmName -vmSize $vmSize | `
      Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred | `
      Set-AzVMSourceImage -Id $imageDefinition.Id | `
      Add-AzVMNetworkInterface -Id $nic.Id
$vm = Set-AzVMSecurityProfile -SecurityType "TrustedLaunch" -VM $vm
$vm = Set-AzVmUefi -VM $vm `
   -EnableVtpm $true `
   -EnableSecureBoot $true 
New-AzVM `
   -ResourceGroupName $rgName `
   -Location $location `
   -VM $vm

Verify or update your settings

For VMs created with trusted launch enabled, you can view the trusted launch configuration by visiting the Overview page for the VM in the portal. The Properties tab will show the status of Trusted Launch features:

Screenshot of the Trusted Launch properties of the VM.

To change the trusted launch configuration, in the left menu, under the Settings section, select Configuration. You can enable or disable Secure Boot and vTPM from the Security type section. Select Save at the top of the page when you are done.

Screenshot showing check boxes to change the Trusted Launch settings.

If the VM is running, you will receive a message that the VM will be restarted. Select Yes then wait for the VM to restart for changes to take effect.

Next steps

Learn more about trusted launch and Generation 2 VMs.