Repository navigation
feat(scanner): add AZ-XXX-000/AZ-XXX-000 Trusted Launch and Managed Identity rules #269
Description
Rule 1: VM Trusted Launch not enabled
- Rule ID: AZ-XXX-000
- Severity: MEDIUM
- Category: Compute
- Frameworks: CIS / NIST / ISO 27001
What it detects: Generation 2 VMs where Trusted Launch (Secure Boot and vTPM) is not enabled.
Detection logic: Check security_profile.security_type == "TrustedLaunch" and that both
uefi_settings.secure_boot_enabled and uefi_settings.v_tpm_enabled are true. Skip
(NOT_APPLICABLE) Generation 1 VMs, which don't support Trusted Launch.
Why it matters: Without Secure Boot and vTPM, malicious or unsigned code can run during boot and
persist beneath the OS, evading OS-level antimalware and EDR entirely.
Remediation: Portal (VM > Configuration > Security type), or
az vm update --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true
(requires a restart; only supported VM sizes/images).
Test plan (Rule 1 only)
- Tested against a real Azure free trial subscription
- Compliant case returns no findings
- Non-compliant case returns correct finding
- Gen1 VMs correctly return NOT_APPLICABLE for the Trusted Launch rule, not a false finding
- CLI playbook written and tested
- All four compliance framework JSONs updated
Coordination
The originally-scoped "VM without Managed Identity" rule (Rule 2) has been removed from this
issue to avoid overlapping the enterprise identity work. The Trusted Launch rule (Rule 1) above
is the sole remaining scope of this issue. The VM Managed Identity rule is now tracked within the
enterprise identity packs — #254 (App Identity/OAuth), #258 (Privileged Access/Identity), and the
closed #193 (Managed Identity pack) — and should be picked up as part of that pack rather than as
a standalone rule.
Activity
parthrohit22 commentedon Aug 13, 2026
Scope update — VM Managed Identity rule moved out to avoid overlap.
After cross-checking against the open enterprise-rule packs, the second rule originally in this issue ("VM without Managed Identity") was removed from this issue. It overlaps the enterprise identity scope already tracked in #254 (App Identity / OAuth), #258 (Privileged Access / Identity), and the closed #193 (Managed Identity pack).
Remaining scope of this issue: only Rule 1 — VM Trusted Launch not enabled (new rule, no existing duplicate). The Trusted Launch rule is a clean
new-rule/good first issueand does not conflict with any enterprise pack.The VM Managed Identity rule should be picked up as part of the enterprise identity pack rather than as a standalone rule. Tagging the identity work (#254, #258) so it is absorbed into the right place and no contributor double-builds it.
No new issue was created for the VM Managed Identity rule — that would itself add overlapping work; it simply moved home.
shariqueahmad108-ship-it commentedon Aug 13, 2026
I'd like to work on this — I've opened #273 implementing Rule 1 (
AZ-CMP-005, VM Trusted Launch / Secure Boot + vTPM), scoped to the Trusted Launch rule only per the Coordination note. It includes the remediation playbook, all four compliance-framework mappings, and unit tests for the compliant / non-compliant Gen2 / Gen1 NOT_APPLICABLE / unknown-generation / Confidential-VM cases. Happy to adjust anything in review.feat: add rule AZ-CMP-005 Trusted Launch (Secure Boot + vTPM) check
github-actions commentedon Sep 13, 2026
This issue has been inactive for 30 days and will be closed in 7 days unless there is activity.
feat: add rule AZ-CMP-005 Trusted Launch (Secure Boot + vTPM) check (O…