|
| 1 | +--- |
| 2 | +title: Enable Trusted Launch on existing VMs |
| 3 | +description: Enable Trusted Launch on existing Azure VMs. |
| 4 | +author: AjKundnani |
| 5 | +ms.author: ajkundna |
| 6 | +ms.reviewer: cynthn |
| 7 | +ms.service: virtual-machines |
| 8 | +ms.subservice: trusted-launch |
| 9 | +ms.topic: how-to |
| 10 | +ms.date: 08/13/2023 |
| 11 | +ms.custom: template-how-to, devx-track-azurecli, devx-track-azurepowershell |
| 12 | +--- |
| 13 | + |
| 14 | +# Enable Trusted Launch on existing Azure VMs |
| 15 | + |
| 16 | +**Applies to:** :heavy_check_mark: Linux VM :heavy_check_mark: Windows VM :heavy_check_mark: Generation 2 VM |
| 17 | + |
| 18 | +Azure Virtual Machines supports enabling Trusted Launch on existing [Azure Generation 2](generation-2.md) VMs by upgrading to [Trusted launch](trusted-launch.md) security type. |
| 19 | + |
| 20 | +[Trusted launch](trusted-launch.md) is a way to enable foundational compute security on [Azure Generation 2 VMs](generation-2.md). Trusted launch protects your Virtual Machines against advanced and persistent attack techniques like boot kits and rootkits by combining infrastructure technologies like Secure Boot, vTPM and Boot Integrity Monitoring on your VM. |
| 21 | + |
| 22 | +> [!IMPORTANT] |
| 23 | +> Enabling Trusted Launch on existing virtual machines (VMs) is currently not supported for following scenarios: |
| 24 | +> |
| 25 | +> - Azure Generation 1 VMs is currently not supported. |
| 26 | +> - Azure Virtual Machine Scale Sets (VMSS) Uniform & Flex is currently not supported. |
| 27 | +
|
| 28 | +## Prerequisites |
| 29 | + |
| 30 | +- Azure Generation 2 VM(s) is configured with: |
| 31 | + - [Trusted Launch supported size family](trusted-launch.md#virtual-machines-sizes) |
| 32 | + - [Trusted Launch supported OS Image](trusted-launch.md#operating-systems-supported). For custom OS image or disks, the base image should be **Trusted Launch capable**. |
| 33 | +- Azure Generation 2 VM(s) is not using [features currently not supported with Trusted Launch](trusted-launch.md#unsupported-features). |
| 34 | +- Azure Generation 2 VM(s) should be **stopped and deallocated** before enabling Trusted Launch security type. |
| 35 | +- Azure Backup if enabled for Generation 2 VM(s) should be configured with [Enhanced Backup Policy](../backup/backup-azure-vms-enhanced-policy.md). Trusted Launch security type cannot be enabled for Generation 2 VM(s) configured with *Standard Policy* backup protection. |
| 36 | + |
| 37 | +## Best practices |
| 38 | + |
| 39 | +- [Create restore point](create-restore-points.md) for Azure Generation 2 VM(s) before enabling Trusted Launch security type. You can use the Restore Point to re-create the disks and Generation 2 VM with the previous well-known state. |
| 40 | +- Enable Trusted launch on a test Generation 2 VM and ensure if any changes are required to meet the prerequisites before enabling Trusted Launch on Generation 2 VMs running production workloads. |
| 41 | + |
| 42 | +## Enable Trusted Launch on existing VM |
| 43 | + |
| 44 | +### [CLI](#tab/cli) |
| 45 | + |
| 46 | +This section steps through using the Azure CLI to enable Trusted Launch on existing Azure Generation 2 VM. |
| 47 | + |
| 48 | +Make sure that you've installed the latest [Azure CLI](/cli/azure/install-az-cli2) and are logged in to an Azure account with [az login](/cli/azure/reference-index). |
| 49 | + |
| 50 | +1. Log in to Azure Subscription |
| 51 | + |
| 52 | +```azurecli-interactive |
| 53 | +az login |
| 54 | +
|
| 55 | +az account set --subscription 00000000-0000-0000-0000-000000000000 |
| 56 | +``` |
| 57 | + |
| 58 | +2. **Deallocate** VM |
| 59 | + |
| 60 | +```azurecli-interactive |
| 61 | +az vm deallocate \ |
| 62 | + --resource-group myResourceGroup --name myVm |
| 63 | +``` |
| 64 | + |
| 65 | +3. Enable Trusted Launch by setting `--security-type` to `TrustedLaunch`. |
| 66 | + |
| 67 | +> [!NOTE] |
| 68 | +> |
| 69 | +> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration). |
| 70 | +> - **vTPM** is enabled by default. |
| 71 | +> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM. |
| 72 | +
|
| 73 | +```azurecli-interactive |
| 74 | +az vm update \ |
| 75 | + --resource-group myResourceGroup --name myVm \ |
| 76 | + --security-type TrustedLaunch \ |
| 77 | + --enable-secure-boot true --enable-vtpm true |
| 78 | +``` |
| 79 | + |
| 80 | +4. **Validate** output of previous command. `securityProfile` configuration is returned with command output. |
| 81 | + |
| 82 | +```json |
| 83 | +{ |
| 84 | + "securityProfile": { |
| 85 | + "securityType": "TrustedLaunch", |
| 86 | + "uefiSettings": { |
| 87 | + "secureBootEnabled": true, |
| 88 | + "vTpmEnabled": true |
| 89 | + } |
| 90 | + } |
| 91 | +} |
| 92 | +``` |
| 93 | + |
| 94 | +5. **Start** the VM. |
| 95 | + |
| 96 | +```azurecli-interactive |
| 97 | +az vm start \ |
| 98 | + --resource-group myResourceGroup --name myVm |
| 99 | +``` |
| 100 | + |
| 101 | +6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM). |
| 102 | + |
| 103 | +### [PowerShell](#tab/powershell) |
| 104 | + |
| 105 | +This section steps through using the Azure PowerShell to enable Trusted Launch on existing Azure Generation 2 VM. |
| 106 | + |
| 107 | +Make sure that you've installed the latest [Azure PowerShell](/powershell/azure/install-azps-windows) and are logged in to an Azure account with [Connect-AzAccount](/powershell/module/az.accounts/connect-azaccount). |
| 108 | + |
| 109 | +1. Log in to Azure Subscription |
| 110 | + |
| 111 | +```azurepowershell-interactive |
| 112 | +Connect-AzAccount -SubscriptionId 00000000-0000-0000-0000-000000000000 |
| 113 | +``` |
| 114 | + |
| 115 | +2. **Deallocate** VM |
| 116 | + |
| 117 | +```azurepowershell-interactive |
| 118 | +Stop-AzVM -ResourceGroupName myResourceGroup -Name myVm |
| 119 | +``` |
| 120 | + |
| 121 | +3. Enable Trusted Launch by setting `--security-type` to `TrustedLaunch`. |
| 122 | + |
| 123 | +> [!NOTE] |
| 124 | +> |
| 125 | +> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration). |
| 126 | +> - **vTPM** is enabled by default. |
| 127 | +> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM. |
| 128 | +
|
| 129 | +```azurepowershell-interactive |
| 130 | +Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm ` |
| 131 | + | Update-AzVM -SecurityType TrustedLaunch ` |
| 132 | + -EnableSecureBoot $true -EnableVtpm $true |
| 133 | +``` |
| 134 | + |
| 135 | +4. **Validate** `securityProfile` in updated VM configuration. |
| 136 | + |
| 137 | +```azurepowershell-interactive |
| 138 | +# Following command output should be `TrustedLaunch` |
| 139 | +
|
| 140 | +(Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm ` |
| 141 | + | Select-Object -Property SecurityProfile ` |
| 142 | + -ExpandProperty SecurityProfile).SecurityProfile.SecurityType |
| 143 | +
|
| 144 | +# Following command output should return `SecureBoot` and `vTPM` settings |
| 145 | +(Get-AzVM -ResourceGroupName myResourceGroup -VMName myVm ` |
| 146 | + | Select-Object -Property SecurityProfile ` |
| 147 | + -ExpandProperty SecurityProfile).SecurityProfile.Uefisettings |
| 148 | +
|
| 149 | +``` |
| 150 | + |
| 151 | +5. **Start** the VM. |
| 152 | + |
| 153 | +```azurepowershell-interactive |
| 154 | +Start-AzVM -ResourceGroupName myResourceGroup -Name myVm |
| 155 | +``` |
| 156 | + |
| 157 | +6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM). |
| 158 | + |
| 159 | +### [Template](#tab/template) |
| 160 | + |
| 161 | +This section steps through using an ARM template to enable Trusted Launch on existing Azure Generation 2 VM. |
| 162 | + |
| 163 | +[!INCLUDE [About Azure Resource Manager](../../includes/resource-manager-quickstart-introduction.md)] |
| 164 | + |
| 165 | +1. Review the template. |
| 166 | + |
| 167 | +```json |
| 168 | +{ |
| 169 | + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", |
| 170 | + "contentVersion": "1.0.0.0", |
| 171 | + "parameters": { |
| 172 | + "vmsToMigrate": { |
| 173 | + "type": "object", |
| 174 | + "metadata": { |
| 175 | + "description": "Specifies the list of Gen2 virtual machines to be migrated to Trusted Launch." |
| 176 | + } |
| 177 | + }, |
| 178 | + "vTpmEnabled": { |
| 179 | + "type": "bool", |
| 180 | + "defaultValue": true, |
| 181 | + "metadata": { |
| 182 | + "description": "Specifies whether vTPM should be enabled on the virtual machine." |
| 183 | + } |
| 184 | + } |
| 185 | + }, |
| 186 | + "resources": [ |
| 187 | + { |
| 188 | + "type": "Microsoft.Compute/virtualMachines", |
| 189 | + "apiVersion": "2022-11-01", |
| 190 | + "name": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].vmName]", |
| 191 | + "location": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].location]", |
| 192 | + "properties": { |
| 193 | + "securityProfile": { |
| 194 | + "uefiSettings": { |
| 195 | + "secureBootEnabled": "[parameters('vmsToMigrate').virtualMachines[copyIndex()].secureBootEnabled]", |
| 196 | + "vTpmEnabled": "[parameters('vTpmEnabled')]" |
| 197 | + }, |
| 198 | + "securityType": "TrustedLaunch" |
| 199 | + } |
| 200 | + }, |
| 201 | + "copy": { |
| 202 | + "name": "vmCopy", |
| 203 | + "count": "[length(parameters('vmsToMigrate').virtualMachines)]" |
| 204 | + } |
| 205 | + } |
| 206 | + ] |
| 207 | +} |
| 208 | +``` |
| 209 | + |
| 210 | +2. Edit the **parameters** json file with virtual machines to be updated with `TrustedLaunch` security type. |
| 211 | + |
| 212 | +```json |
| 213 | +{ |
| 214 | + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", |
| 215 | + "contentVersion": "1.0.0.0", |
| 216 | + "parameters": { |
| 217 | + "vmsToMigrate": { |
| 218 | + "value": { |
| 219 | + "virtualMachines": [ |
| 220 | + { |
| 221 | + "vmName": "myVm01", |
| 222 | + "location": "westus3", |
| 223 | + "secureBootEnabled": true |
| 224 | + }, |
| 225 | + { |
| 226 | + "vmName": "myVm02", |
| 227 | + "location": "westus3", |
| 228 | + "secureBootEnabled": true |
| 229 | + } |
| 230 | + ] |
| 231 | + } |
| 232 | + } |
| 233 | + } |
| 234 | +} |
| 235 | +``` |
| 236 | + |
| 237 | +**Parameter file definition** |
| 238 | + |
| 239 | +Property | Description of Property | Example template value |
| 240 | +-|-|- |
| 241 | +vmName | Name of Azure Generation 2 VM | "myVm" |
| 242 | +location | Location of Azure Generation 2 VM | "westus3" |
| 243 | +secureBootEnabled | Enable secure boot with Trusted Launch security type | true |
| 244 | + |
| 245 | +> [!NOTE] |
| 246 | +> |
| 247 | +> - After enabling Trusted Launch, currently virtual machine cannot be rolled back to security type **Standard** (Non-Trusted Launch configuration). |
| 248 | +> - **vTPM** is enabled by default. |
| 249 | +> - **Secure Boot** is recommended to be enabled (not enabled by default) if you are not using custom unsigned kernel or drivers. Secure Boot preserves boot integrity and enables foundational security for VM. |
| 250 | +
|
| 251 | +3. **Deallocate** all Azure Generation 2 VM(s) to be updated. |
| 252 | + |
| 253 | +```azurepowershell-interactive |
| 254 | +Stop-AzVM -ResourceGroupName myResourceGroup -Name myVm01 |
| 255 | +``` |
| 256 | + |
| 257 | +4. Execute the ARM template deployment. |
| 258 | + |
| 259 | +```azurepowershell-interactive |
| 260 | +$resourceGroupName = "myResourceGroup" |
| 261 | +$parameterFile = "folderPathToFile\parameters.json" |
| 262 | +$templateFile = "folderPathToFile\template.json" |
| 263 | +
|
| 264 | +New-AzResourceGroupDeployment ` |
| 265 | + -ResourceGroupName $resourceGroupName ` |
| 266 | + -TemplateFile $templateFile -TemplateParameterFile $parameterFile |
| 267 | +``` |
| 268 | + |
| 269 | +5. Verify that the deployment is successful. Check for the security type and UEFI settings of the VM using Azure portal. Check the Security type section in the Overview page. |
| 270 | + |
| 271 | +:::image type="content" source="./media/trusted-launch/generation-2-trusted-launch-settings.png" alt-text="Screenshot of the Trusted Launch properties of the VM."::: |
| 272 | + |
| 273 | +6. Start the upgraded Trusted Launch VM and ensure that it has started successfully and verify that you are able to log in to the VM using either RDP (for Windows VM) or SSH (for Linux VM). |
| 274 | + |
| 275 | +--- |
| 276 | + |
| 277 | +## Next steps |
| 278 | + |
| 279 | +**(Recommended)** Post-Upgrades enable [Boot Integrity Monitoring](trusted-launch.md#microsoft-defender-for-cloud-integration) to monitor the health of the VM using Microsoft Defender for Cloud. |
| 280 | + |
| 281 | +Learn more about [trusted launch](trusted-launch.md) and review [frequently asked questions](trusted-launch-faq.md) |
0 commit comments