Skip to content

Commit b6ccc64

Browse files
authored
Merge pull request #248996 from AjKundnani/main
Added new page for Gen2 to Trusted Launch Upgrade support
2 parents f279c6b + 2047c0e commit b6ccc64

9 files changed

+816
-242
lines changed

articles/virtual-machines/TOC.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1663,8 +1663,12 @@
16631663
DisplayName: Trusted Launch, shielded VM
16641664
- name: Deploy Trusted Launch VM
16651665
href: trusted-launch-portal.md
1666-
- name: Boot integrity monitoring overview
1666+
- name: Enable Trusted Launch on existing VM
1667+
href: trusted-launch-existing-vm.md
1668+
- name: Boot integrity monitoring
16671669
href: boot-integrity-monitoring-overview.md
1670+
- name: Trusted Launch FAQs
1671+
href: trusted-launch-faq.md
16681672

16691673
- name: Just-in-time access
16701674
href: ../security-center/security-center-just-in-time.md

articles/virtual-machines/boot-integrity-monitoring-overview.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,16 @@ ms.custom: template-concept
1414

1515
To help Trusted Launch better prevent malicious rootkit attacks on virtual machines, guest attestation through Microsoft Azure Attestation (MAA) endpoint is used to monitor the boot sequence integrity. This attestation is critical to provide validity of a platform’s states. If your [Azure Trusted Virtual Machines](trusted-launch.md) has Secure Boot and vTPM enabled and attestation extensions installed, Microsoft Defender for Cloud verifies that the status and boot integrity of your VM is set up correctly. To learn more about MDC integration, see the [trusted launch integration with Microsoft Defender for Cloud](trusted-launch.md#microsoft-defender-for-cloud-integration).
1616

17+
> [!IMPORTANT]
18+
> Automatic Extension Upgrade is now available for Boot Integrity Monitoring - Guest Attestation extension. Learn more about [Automatic extension upgrade](automatic-extension-upgrade.md).
19+
1720
## Prerequisites
1821

1922
An Active Azure Subscription + Trusted Launch Virtual Machine
2023

2124
## Enable integrity monitoring
2225

23-
# [Azure portal](#tab/portal)
26+
### [Azure portal](#tab/portal)
2427

2528
1. Sign in to the Azure [portal](https://portal.azure.com).
2629
1. Select the resource (**Virtual Machines**).
@@ -34,11 +37,11 @@ Now, under the virtual machines overview page, security type for integrity monit
3437

3538
This installs the guest attestation extension, which can be referred through settings within the extensions + applications tab.
3639

37-
# [Template](#tab/template)
40+
### [Template](#tab/template)
3841

3942
You can deploy the guest attestation extension for trusted launch VMs using a quickstart template:
4043

41-
### Windows
44+
#### Windows
4245

4346
```json
4447
{
@@ -72,7 +75,7 @@ You can deploy the guest attestation extension for trusted launch VMs using a qu
7275
]
7376
}
7477
```
75-
### Linux
78+
#### Linux
7679

7780
```json
7881
{
@@ -108,7 +111,7 @@ You can deploy the guest attestation extension for trusted launch VMs using a qu
108111

109112
```
110113

111-
# [CLI](#tab/cli)
114+
### [CLI](#tab/cli)
112115

113116
If Secure Boot and vTPM are ON, boot integrity will be ON.
114117

@@ -117,7 +120,7 @@ If Secure Boot and vTPM are ON, boot integrity will be ON.
117120
1. For existing VMs, you can enable boot integrity monitoring settings by updating to make sure both Secure Boot and vTPM are on (az vm update).
118121
For more information on creation or updating a virtual machine to include the boot integrity monitoring through the guest attestation extension, see [Deploy a VM with trusted launch enabled (CLI)](trusted-launch-portal.md#deploy-a-trusted-launch-vm).
119122

120-
# [PowerShell](#tab/powershell)
123+
### [PowerShell](#tab/powershell)
121124

122125
If Secure Boot and vTPM are ON, boot integrity will be ON.
123126

articles/virtual-machines/ev4-esv4-series.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Remote Data disk storage is billed separately from virtual machines. To use prem
3030
[Premium Storage caching](premium-storage-performance.md): Not Supported<br>
3131
[Live Migration](maintenance-and-updates.md): Supported<br>
3232
[Memory Preserving Updates](maintenance-and-updates.md): Supported<br>
33-
[VM Generation Support](generation-2.md): Generation 1<br>
33+
[VM Generation Support](generation-2.md): Generation 1 and 2<br>
3434
[Accelerated Networking](../virtual-network/create-vm-accelerated-networking-cli.md): Supported <br>
3535
[Ephemeral OS Disks](ephemeral-os-disks.md): Not Supported <br>
3636
[Nested Virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization): Supported <br>

articles/virtual-machines/generation-2.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Azure now offers generation 2 support for the following selected VM series:
5151
|[Ddsv5-series](ddv5-ddsv5-series.md) | :heavy_check_mark: | :heavy_check_mark: |
5252
|[Ev3-series](ev3-esv3-series.md) | :heavy_check_mark: | :x: |
5353
|[Esv3-series](ev3-esv3-series.md) | :heavy_check_mark: | :heavy_check_mark: |
54-
|[Ev4-series](ev4-esv4-series.md) | :heavy_check_mark:| :x: |
54+
|[Ev4-series](ev4-esv4-series.md) | :heavy_check_mark:| :heavy_check_mark: |
5555
|[Esv4-series](ev4-esv4-series.md) | :heavy_check_mark:| :heavy_check_mark: |
5656
|[Eav4-series](eav4-easv4-series.md) | :heavy_check_mark: | :heavy_check_mark: |
5757
|[Easv4-series](eav4-easv4-series.md) | :heavy_check_mark: | :heavy_check_mark: |
@@ -70,12 +70,10 @@ Azure now offers generation 2 support for the following selected VM series:
7070
|[Fsv2-series](fsv2-series.md) | :heavy_check_mark: | :heavy_check_mark: |
7171
|[FX-series](fx-series.md) | :x: | :heavy_check_mark: |
7272
|[GS-series](sizes-previous-gen.md#gs-series) | :x:| :heavy_check_mark: |
73-
|[H-series](h-series.md) | :heavy_check_mark: | :x: |
7473
|[HB-series](hb-series.md) | :heavy_check_mark: | :heavy_check_mark: |
7574
|[HBv2-series](hbv2-series.md) | :heavy_check_mark: | :heavy_check_mark: |
7675
|[HBv3-series](hbv3-series.md) | :heavy_check_mark: | :heavy_check_mark: |
7776
|[HC-series](hc-series.md) | :heavy_check_mark: | :heavy_check_mark: |
78-
|[Ls-series](sizes-previous-gen.md#ls-series) | :x: | :heavy_check_mark: |
7977
|[Lsv2-series](lsv2-series.md) | :heavy_check_mark: | :heavy_check_mark: |
8078
|[M-series](m-series.md) | :heavy_check_mark: | :heavy_check_mark: |
8179
|[Mv2-series](mv2-series.md)<sup>1</sup> | :x: | :heavy_check_mark: |
36.6 KB
Loading
Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
---
2+
title: Enable Trusted Launch on existing VMs
3+
description: Enable Trusted Launch on existing Azure VMs.
4+
author: AjKundnani
5+
ms.author: ajkundna
6+
ms.reviewer: cynthn
7+
ms.service: virtual-machines
8+
ms.subservice: trusted-launch
9+
ms.topic: how-to
10+
ms.date: 08/13/2023
11+
ms.custom: template-how-to, devx-track-azurecli, devx-track-azurepowershell
12+
---
13+
14+
# Enable Trusted Launch on existing Azure VMs
15+
16+
**Applies to:** :heavy_check_mark: Linux VM :heavy_check_mark: Windows VM :heavy_check_mark: Generation 2 VM
17+
18+
Azure Virtual Machines supports enabling Trusted Launch on existing [Azure Generation 2](generation-2.md) VMs by upgrading to [Trusted launch](trusted-launch.md) security type.
19+
20+
[Trusted launch](trusted-launch.md) is a way to enable foundational compute security on [Azure Generation 2 VMs](generation-2.md). Trusted launch protects your Virtual Machines against advanced and persistent attack techniques like boot kits and rootkits by combining infrastructure technologies like Secure Boot, vTPM and Boot Integrity Monitoring on your VM.
21+
22+
> [!IMPORTANT]
23+
> Enabling Trusted Launch on existing virtual machines (VMs) is currently not supported for following scenarios:
24+
>
25+
> - Azure Generation 1 VMs is currently not supported.
26+
> - Azure Virtual Machine Scale Sets (VMSS) Uniform & Flex is currently not supported.
27+
28+
## Prerequisites
29+
30+
- Azure Generation 2 VM(s) is configured with:
31+
- [Trusted Launch supported size family](trusted-launch.md#virtual-machines-sizes)
32+
- [Trusted Launch supported OS Image](trusted-launch.md#operating-systems-supported). For custom OS image or disks, the base image should be **Trusted Launch capable**.
33+
- Azure Generation 2 VM(s) is not using [features currently not supported with Trusted Launch](trusted-launch.md#unsupported-features).
34+
- Azure Generation 2 VM(s) should be **stopped and deallocated** before enabling Trusted Launch security type.
35+
- Azure Backup if enabled for Generation 2 VM(s) should be configured with [Enhanced Backup Policy](../backup/backup-azure-vms-enhanced-policy.md). Trusted Launch security type cannot be enabled for Generation 2 VM(s) configured with *Standard Policy* backup protection.
36+
37+
## Best practices
38+
39+
- [Create restore point](create-restore-points.md) for Azure Generation 2 VM(s) before enabling Trusted Launch security type. You can use the Restore Point to re-create the disks and Generation 2 VM with the previous well-known state.
40+
- Enable Trusted launch on a test Generation 2 VM and ensure if any changes are required to meet the prerequisites before enabling Trusted Launch on Generation 2 VMs running production workloads.
41+
42+
## Enable Trusted Launch on existing VM
43+
44+
### [CLI](#tab/cli)
45+
46+
This section steps through using the Azure CLI to enable Trusted Launch on existing Azure Generation 2 VM.
47+
48+
Make sure that you've installed the latest [Azure CLI](/cli/azure/install-az-cli2) and are logged in to an Azure account with [az login](/cli/azure/reference-index).
49+
50+
1. Log in to Azure Subscription
51+
52+
```azurecli-interactive
53+
az login
54+
55+
az account set --subscription 00000000-0000-0000-0000-000000000000
56+
```
57+
58+
2. **Deallocate** VM
59+
60+
```azurecli-interactive
61+
az vm deallocate \
62+
--resource-group myResourceGroup --name myVm
63+
```
64+
65+
3. Enable Trusted Launch by setting `--security-type` to `TrustedLaunch`.
66+
67+
> [!NOTE]
68+
>
69+
> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration).
70+
> - **vTPM** is enabled by default.
71+
> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM.
72+
73+
```azurecli-interactive
74+
az vm update \
75+
--resource-group myResourceGroup --name myVm \
76+
--security-type TrustedLaunch \
77+
--enable-secure-boot true --enable-vtpm true
78+
```
79+
80+
4. **Validate** output of previous command. `securityProfile` configuration is returned with command output.
81+
82+
```json
83+
{
84+
"securityProfile": {
85+
"securityType": "TrustedLaunch",
86+
"uefiSettings": {
87+
"secureBootEnabled": true,
88+
"vTpmEnabled": true
89+
}
90+
}
91+
}
92+
```
93+
94+
5. **Start** the VM.
95+
96+
```azurecli-interactive
97+
az vm start \
98+
--resource-group myResourceGroup --name myVm
99+
```
100+
101+
6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM).
102+
103+
### [PowerShell](#tab/powershell)
104+
105+
This section steps through using the Azure PowerShell to enable Trusted Launch on existing Azure Generation 2 VM.
106+
107+
Make sure that you've installed the latest [Azure PowerShell](/powershell/azure/install-azps-windows) and are logged in to an Azure account with [Connect-AzAccount](/powershell/module/az.accounts/connect-azaccount).
108+
109+
1. Log in to Azure Subscription
110+
111+
```azurepowershell-interactive
112+
Connect-AzAccount -SubscriptionId 00000000-0000-0000-0000-000000000000
113+
```
114+
115+
2. **Deallocate** VM
116+
117+
```azurepowershell-interactive
118+
Stop-AzVM -ResourceGroupName myResourceGroup -Name myVm
119+
```
120+
121+
3. Enable Trusted Launch by setting `--security-type` to `TrustedLaunch`.
122+
123+
> [!NOTE]
124+
>
125+
> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration).
126+
> - **vTPM** is enabled by default.
127+
> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM.
128+
129+
```azurepowershell-interactive
130+
Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm `
131+
| Update-AzVM -SecurityType TrustedLaunch `
132+
-EnableSecureBoot $true -EnableVtpm $true
133+
```
134+
135+
4. **Validate** `securityProfile` in updated VM configuration.
136+
137+
```azurepowershell-interactive
138+
# Following command output should be `TrustedLaunch`
139+
140+
(Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm `
141+
| Select-Object -Property SecurityProfile `
142+
-ExpandProperty SecurityProfile).SecurityProfile.SecurityType
143+
144+
# Following command output should return `SecureBoot` and `vTPM` settings
145+
(Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm `
146+
| Select-Object -Property SecurityProfile `
147+
-ExpandProperty SecurityProfile).SecurityProfile.Uefisettings
148+
149+
```
150+
151+
5. **Start** the VM.
152+
153+
```azurepowershell-interactive
154+
Start-AzVM -ResourceGroupName myResourceGroup -Name myVm
155+
```
156+
157+
6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM).
158+
159+
### [Template](#tab/template)
160+
161+
This section steps through using an ARM template to enable Trusted Launch on existing Azure Generation 2 VM.
162+
163+
[!INCLUDE [About Azure Resource Manager](../../includes/resource-manager-quickstart-introduction.md)]
164+
165+
1. Review the template.
166+
167+
```json
168+
{
169+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
170+
"contentVersion": "1.0.0.0",
171+
"parameters": {
172+
"vmsToMigrate": {
173+
"type": "object",
174+
"metadata": {
175+
"description": "Specifies the list of Gen2 virtual machines to be migrated to Trusted Launch."
176+
}
177+
},
178+
"vTpmEnabled": {
179+
"type": "bool",
180+
"defaultValue": true,
181+
"metadata": {
182+
"description": "Specifies whether vTPM should be enabled on the virtual machine."
183+
}
184+
}
185+
},
186+
"resources": [
187+
{
188+
"type": "Microsoft.Compute/virtualMachines",
189+
"apiVersion": "2022-11-01",
190+
"name": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].vmName]",
191+
"location": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].location]",
192+
"properties": {
193+
"securityProfile": {
194+
"uefiSettings": {
195+
"secureBootEnabled": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].secureBootEnabled]",
196+
"vTpmEnabled": "[parameters('vTpmEnabled')]"
197+
},
198+
"securityType": "TrustedLaunch"
199+
}
200+
},
201+
"copy": {
202+
"name": "vmCopy",
203+
"count": "[length(parameters('vmsToMigrate').virtualMachines)]"
204+
}
205+
}
206+
]
207+
}
208+
```
209+
210+
2. Edit the **parameters** json file with virtual machines to be updated with `TrustedLaunch` security type.
211+
212+
```json
213+
{
214+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
215+
"contentVersion": "1.0.0.0",
216+
"parameters": {
217+
"vmsToMigrate": {
218+
"value": {
219+
"virtualMachines": [
220+
{
221+
"vmName": "myVm01",
222+
"location": "westus3",
223+
"secureBootEnabled": true
224+
},
225+
{
226+
"vmName": "myVm02",
227+
"location": "westus3",
228+
"secureBootEnabled": true
229+
}
230+
]
231+
}
232+
}
233+
}
234+
}
235+
```
236+
237+
**Parameter file definition**
238+
239+
Property | Description of Property | Example template value
240+
-|-|-
241+
vmName | Name of Azure Generation 2 VM | "myVm"
242+
location | Location of Azure Generation 2 VM | "westus3"
243+
secureBootEnabled | Enable secure boot with Trusted Launch security type | true
244+
245+
> [!NOTE]
246+
>
247+
> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration).
248+
> - **vTPM** is enabled by default.
249+
> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM.
250+
251+
3. **Deallocate** all Azure Generation 2 VM(s) to be updated.
252+
253+
```azurepowershell-interactive
254+
Stop-AzVM -ResourceGroupName myResourceGroup -Name myVm01
255+
```
256+
257+
4. Execute the ARM template deployment.
258+
259+
```azurepowershell-interactive
260+
$resourceGroupName = "myResourceGroup"
261+
$parameterFile = "folderPathToFile\parameters.json"
262+
$templateFile = "folderPathToFile\template.json"
263+
264+
New-AzResourceGroupDeployment `
265+
-ResourceGroupName $resourceGroupName `
266+
-TemplateFile $templateFile -TemplateParameterFile $parameterFile
267+
```
268+
269+
5. Verify that the deployment is successful. Check for the security type and UEFI settings of the VM using Azure portal. Check the Security type section in the Overview page.
270+
271+
:::image type="content" source="./media/trusted-launch/generation-2-trusted-launch-settings.png" alt-text="Screenshot of the Trusted Launch properties of the VM.":::
272+
273+
6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM).
274+
275+
---
276+
277+
## Next steps
278+
279+
**(Recommended)** Post-Upgrades enable [Boot Integrity Monitoring](trusted-launch.md#microsoft-defender-for-cloud-integration) to monitor the health of the VM using Microsoft Defender for Cloud.
280+
281+
Learn more about [trusted launch](trusted-launch.md) and review [frequently asked questions](trusted-launch-faq.md)

0 commit comments

Comments
 (0)