vTPM should be enabled on supported virtual machines

What does the recommendation "vTPM should be enabled on supported virtual machines" check?

Flags Trusted Launch capable Generation 2 virtual machines whose virtual Trusted Platform Module (vTPM) is switched off, meaning securityProfile.uefiSettings.vTpmEnabled is false. The vTPM is the measured-boot anchor that lets the platform record and attest the boot chain. The check is scoped only to machines that already support Trusted Launch: it does not cover Generation 1 VMs, VMs on sizes that lack Trusted Launch support, or machines that were never converted to the TrustedLaunch security type. It also does not verify that Secure Boot is on or that guest attestation is actually wired into Defender for Cloud; it only asserts the vTPM device exists and is enabled.

Why does "vTPM should be enabled on supported virtual machines" matter?

Without a vTPM there is nowhere to store boot measurements, so the platform cannot prove the VM started from trusted firmware and an untampered kernel. That removes your defence against bootkits and rootkits that load before the operating system and stay invisible to in-guest tooling. It also blocks guest attestation, so Defender for Cloud loses a high-fidelity signal it uses to recognise boot-integrity tampering across the fleet. For regulated workloads the business consequence is concrete: you cannot demonstrate hardware-rooted boot integrity to an auditor, and a compromised image can persist undetected through reboots and reimaging.

How do I fix "vTPM should be enabled on supported virtual machines"?

1. Confirm the machine is Generation 2 on a Trusted Launch supported size and image, then stop and deallocate it, because the security profile cannot change while it is running: 'az vm deallocate -g <rg> -n <vm>'.
2. Set the security type and enable the vTPM (Secure Boot is recommended alongside it): 'az vm update -g <rg> -n <vm> --security-type TrustedLaunch --enable-vtpm true --enable-secure-boot true', then restart with 'az vm start -g <rg> -n <vm>' and confirm uefiSettings.vTpmEnabled is true.
3. Prevent regressions by assigning the built-in audit policy across the subscription so new non-compliant VMs surface automatically. Look the definition up by display name rather than hardcoding a GUID: pid=$(az policy definition list --query "[?displayName=='[Preview]: vTPM should be enabled on supported virtual machines'].name" -o tsv); az policy assignment create --name audit-vtpm --policy "$pid" --scope /subscriptions/<sub-id>.

# Upgrade one VM in place to a verified boot chain.
# Secure Boot + vTPM is a security-profile change, so the VM must be deallocated first.
RG="workloads-rg"
VM="payments-api-prod"

az vm deallocate --resource-group "$RG" --name "$VM"

az vm update --resource-group "$RG" --name "$VM" \
  --security-type TrustedLaunch \
  --enable-secure-boot true \
  --enable-vtpm true

az vm start --resource-group "$RG" --name "$VM"

# Install the guest attestation extension so Defender can read the boot remotely.
# Publisher is Microsoft.Azure.Security.LinuxAttestation for Linux,
# Microsoft.Azure.Security.WindowsAttestation for Windows.
az vm extension set \
  --resource-group "$RG" --vm-name "$VM" \
  --name GuestAttestation \
  --publisher Microsoft.Azure.Security.LinuxAttestation \
  --enable-auto-upgrade true

# Ratchet it shut: audit any future machine that lacks Secure Boot.
# Look the built-in policy up by its exact display name; never paste a guessed GUID.
pid=$(az policy definition list \
  --query "[?displayName=='Secure Boot should be enabled on supported Windows virtual machines'].name" -o tsv)

az policy assignment create \
  --name audit-secure-boot \
  --policy "$pid" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"