Upgrade existing Azure Gen1 VMs to Trusted launch
By: Date: 27/07/2026 Categories: azure Tags:

Important Note: Azure Trusted Launch (also known as Azure Secure VM) requires Gen2 VMs or later because it relies on TPM 2.0 and UEFI firmware, which are not supported on Gen1 VMs (which use TPM 1.2 and BIOS). Therefore, direct upgrade of Gen1 VMs to Trusted Launch is not possible. Instead, you must migrate your Gen1 VMs to Gen2, then enable Trusted Launch on the new Gen2 VM. Below is a step-by-step guide.

Step 1: Verify Current Gen1 VM Configuration

Before migration, confirm your VM is Gen1 and assess compatibility:

  1. Identify VM Generation:
  • Azure Portal:
    Navigate to Virtual machines > Select your VM > Properties > Check Generation.
    (Gen1 will show “Generation 1”, Gen2 will show “Generation 2”).
  • PowerShell:
    powershell $vm = Get-AzVM -ResourceGroupName <ResourceGroupName> -Name <VMName> $vm.HardwareProfile.VmSize -like "*Gen1*" # Check VM size family
  • CLI:
    bash az vm show --resource-group <ResourceGroupName> --name <VMName> --query "hardwareProfile.vmSize"
  1. Check Compatibility:
  • Gen2 Requirements:
    • Supported VM sizes (e.g., Ds_v3, Es_v3, B_series, Gv3, etc.).
    • OS images must support UEFI and Secure Boot (most modern OS images do).
    • TPM 2.0 must be enabled during creation.

Step 2: Prepare for Migration

A. Backup the Gen1 VM

  1. Create a Snapshot:
  • Take snapshots of all disks attached to the Gen1 VM:
    powershell $disk = Get-AzDisk -ResourceGroupName <ResourceGroupName> -VMName <VMName> -Name <DiskName> $snapshot = New-AzSnapshot -ResourceGroupName <ResourceGroupName> -Disk $disk -CreateOption Copy
  • Alternatively, use Azure Backup for full VM protection.
  1. Generalize the OS (if creating an image):
  • Windows: Run Sysprep (sysprep.exe -oobe -generalize -shutdown).
  • Linux: Use waagent -deprovision+user or clean SSH keys.

B. Create an Image from the Gen1 VM

  1. Stop the VM:
   Stop-AzVM -ResourceGroupName <ResourceGroupName> -Name <VMName> -Force
  1. Create a Managed Image:
   $vm = Get-AzVM -ResourceGroupName <ResourceGroupName> -Name <VMName>
   $image = New-AzImage -Location <Location> -SourceVirtualMachineId $vm.Id -OsDiskName "<OSDiskName>" -DataDiskNames <DataDiskNames>

Step 3: Deploy a Gen2 VM with Trusted Launch Enabled

A. Create a Gen2 VM from the Image

  1. Launch a Gen2 VM:
  • Azure Portal:
    • During VM creation, select Generation 2 under Hardware generation.
    • Choose a Gen2-compatible VM size (e.g., Standard_D2s_v3).
    • Under Security profile, enable:
    • Secure Boot: On
    • TPM Type: TPM 2.0
    • Trusted Launch: On
  • PowerShell:
    powershell $vmParams = @{ ResourceGroupName = "<ResourceGroupName>" Name = "Gen2-VM" Location = "<Location>" HardwareProfile = @{ VmSize = "Standard_D2s_v3" VmGeneration = "Gen2" } StorageProfile = @{ ImageReference = @{ Id = $image.Id # Use the image created earlier } OsDisk = @{ CreateOption = "FromImage" ManagedDisk = @{ StorageAccountType = "Premium_LRS" } } } SecurityProfile = @{ SecureBoot = "Enabled" TpmEnabled = $true TrustedLaunch = $true } } New-AzVM @vmParams
  • CLI:
    bash az vm create \ --resource-group <ResourceGroupName> \ --name "Gen2-VM" \ --image <ImageResourceId> \ --size Standard_D2s_v3 \ --generate-ssh-keys \ --hardware-profile Gen2 \ --security-type TrustedLaunch

B. Verify Trusted Launch Settings

  1. Azure Portal:
  • Go to Virtual machines > Select your VM > Security profile.
  • Confirm Trusted Launch is Enabled, Secure Boot is On, and TPM 2.0 is selected.
  1. PowerShell:
   $vm = Get-AzVM -ResourceGroupName <ResourceGroupName> -Name "Gen2-VM"
   $vm.SecurityProfile

Step 4: Post-Migration Configuration

A. OS-Level Adjustments

  1. Enable Secure Boot in OS (if not auto-configured):
  • Windows:
    • Secure Boot is automatically enabled if the VM was deployed with Trusted Launch.
    • Verify via BIOS/UEFI settings during boot.
  • Linux:
    • Ensure the bootloader supports UEFI and Secure Boot (e.g., SHIM signed bootloader).
    • Update GRUB:
      bash sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
    • Install shim-signed package for Secure Boot support.
  1. Enable Disk Encryption (Recommended):
  • Use Azure Disk Encryption with Customer-Managed Keys (CMK):
    powershell Set-AzVMEncryptionExtension -ResourceGroupName <ResourceGroupName> -VMName "Gen2-VM" -DiskEncryptionKeyVault <VaultResourceId> -KeyVaultResourceId <KeyVaultResourceId>

B. Network and Access

  • NSG Rules: Update network security groups to allow only required traffic.
  • Identity: Assign a Managed Identity to the VM for secure access to Azure resources.
  • Monitoring: Enable Azure Security Center and Azure Defender for Servers for threat detection.

Step 5: Decommission the Gen1 VM

  1. Validate the Gen2 VM:
  • Test applications, data integrity, and security settings.
  1. Stop and Delete Gen1 VM:
   Stop-AzVM -ResourceGroupName <ResourceGroupName> -Name <Gen1-VMName> -Force
   Remove-AzVM -ResourceGroupName <ResourceGroupName> -Name <Gen1-VMName>
  1. Release Resources:
  • Delete unattached disks, snapshots, and NICs to avoid unnecessary costs.

Security Best Practices

  1. Least Privilege Access:
  • Use RBAC to restrict access to the VM and related resources.
  1. Audit and Compliance:
  • Enable Azure Policy to enforce Trusted Launch and Gen2 VM requirements.
  • Use Azure Monitor and Log Analytics to track VM configuration changes.
  1. Backup Strategy:
  • Schedule regular backups of the Gen2 VM using Azure Backup.
  1. Patch Management:
  • Use Azure Automation Update Management to keep the OS and firmware updated.

Troubleshooting Tips

  • VM Generation Mismatch Error: Ensure the VM size supports Gen2 (e.g., avoid Basic_A series).
  • Secure Boot Failures:
  • For Linux, verify the kernel and initramfs support Secure Boot.
  • Re-sign boot files if necessary using sbsign.
  • TPM 2.0 Not Detected:
  • Confirm the VM size and deployment settings explicitly enabled TPM 2.0.

By following this workflow, you securely migrate Gen1 VMs to Gen2 and enable Trusted Launch, enhancing security with hardware-backed protections. Always test in a non-production environment before applying changes to production workloads.

Upgrade existing Azure Gen1 VMs to Trusted launch

Post Views: 221