Secure Boot update from 2011 to 2023 certificates: Trusted Launch VMs (TVM) and Confidential VMs (CVM)

Introduction

Secure Boot is a UEFI firmware security feature that helps ensure that only trusted, digitally signed software runs during the device boot sequence. Microsoft Secure Boot certificates issued in 2011 begin expiring in June 2026. 

To maintain Secure Boot protections and continued servicing of the early boot process, Azure Trusted Launch and Confidential virtual machines must be updated with both of the following: 

• Secure Boot 2023 certificates in virtual firmware

• A Windows Boot Manager signed by the updated certificates

These components work together: the certificates establish trust in virtual firmware, and the Boot Manager must be updated to be signed by that trust. 

To help prevent gaps in protection, verify that both components are updated and initiate updates where required. 

If a VM continues to rely on the 2011 certificates after expiration, it can continue to boot and receive standard Windows updates. However, it will no longer receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases and revocation lists, or mitigations for newly discovered boot-level vulnerabilities. 

To learn more, see When Secure Boot certificates expire on Windows devices.

back to top 

Identify scenarios that require action

In most cases, Windows applies the Secure Boot 2023 certificates automatically through monthly updates on eligible devices, including supported Azure Trusted Launch and Confidential VMs with Secure Boot enabled. Some VMs might not qualify for automatic deployment if sufficient compatibility signals are not available. In these cases, administrative action might be required to initiate updates from within the guest operating system. For more information on how to get Secure Boot certificates updates, visit: Secure Boot Certificate updates: Guidance for IT professionals and organizations.

Secure Boot updates for Azure Trusted Launch and Confidential VMs involve two components: 

• Secure Boot certificates stored in virtual firmware (platform‑managed)

• Windows Boot Manager (guest OS‑managed)

Virtual machines created after March 2024 typically already include the Secure Boot 2023 certificates in virtual firmware. These VMs generally require only a Windows Boot Manager update. 

Long-running virtual machines created prior to March 2024 do not include the Secure Boot 2023 certificates in virtual firmware and require updates to both Secure Boot certificates and Windows Boot Manager. 

Update operations are initiated from within the guest operating system through Windows servicing and rely on platform support to apply authenticated updates to Secure Boot variables in virtual firmware. 

After identifying applicable scenarios, inventory your environment to determine which VMs require updates. 

Actions required: 

• Ensure that guest VMs are updated with the March 2026 Windows update or later (April 2026 or later if using hotpatching). See more: Hotpatch for Windows Server.

• Verify that all Azure Trusted Launch and Confidential VMs have the Secure Boot 2023 certificates and an updated Windows Boot Manager.

• Initiate updates from within the guest operating system to apply Secure Boot certificate and Windows Boot Manager updates where required.

• Audit the Windows System event logs: Event ID 1808 and Event ID 1801 or monitor the UEFICA2023Status registry key to confirm whether updated Secure Boot certificates have been applied and whether the Windows Boot Manager has been updated.

For devices that have not applied these updates, use the monitoring and deployment methods described in the Secure Boot playbook, Windows Server Secure Boot playbook for certificates expiring in 2026, and at https://aka.ms/GetSecureBoot for complete guidance. 

back to top

Azure guest VM considerations

Review the following scenarios and required actions for session hosts:

back to top

Monitor update status

Monitoring and deployment for Secure Boot certificate updates in Azure Trusted Launch and Confidential virtual machines follows the same Windows servicing guidance used for physical and virtualized devices. 

For detailed monitoring guidance, including how to inventory devices, verify firmware variable updates, and track update progress, see the Secure Boot Playbook for Windows Server and https://aka.ms/GetSecureBoot.

Deploy updates

Secure Boot certificate updates for Azure Trusted Launch and Confidential virtual machines are initiated from within the guest operating system using Windows servicing.  

Follow the deployment guidance in the Secure Boot Playbook for Windows Server for:

• automatic deployment via Windows Update

• IT-initiated deployment methods

• servicing registry keys

• deployment sequencing

When using custom or reused virtual machine images, see Golden image considerations in this article before advancing the Windows Boot Manager. 

back to top

Resources

• Bookmark Get Secure Boot for more information about this change, detailed guidance for managing the Secure Boot certificate update, and answers to frequently asked questions.

• Secure Boot Playbook for Windows Server

• Secure Boot Certificate updates: Guidance for IT professionals and organizations

• For more details about Event Log events, see Secure Boot DB and DBX variable update events.

• For more details about Secure Boot registry keys, see Registry key updates for Secure Boot: Windows devices with IT-managed updates.

If you have a support plan and need technical help, please submit a support request. 

back to top

Change log

back to top