Edit

Migrate to Trusted Launch or Confidential Virtual machines by using Azure Migrate

Azure Migrate now supports migrating eligible machines to Trusted Launch and Confidential virtual machines in Azure.

Migrate Generation 2 virtual machines to Azure Trusted Launch virtual machines

Azure Migrate now supports migrating Generation 2 virtual machines to Azure Virtual Machines with Trusted Launch. This feature is now generally available.

  • Trusted Launch uses UEFI-based Secure Boot and a virtual Trusted Platform Module (vTPM) to establish a trusted boot chain. This trusted boot chain helps ensure that only approved and signed components load during startup, reducing the risk of bootkits, rootkits, and other low-level malware.
  • Trusted Launch is the default security type for supported Generation 2 virtual machines and virtual machine scale sets in Azure, where available. Learn more about Trusted Launch Virtual Machines.

Supported operating systems for Trusted Launch virtual machines

Azure Migrate supports all Operating systems that are supported for Trusted Launch in Azure. For more information, See Azure supported OS list and Virtual Machine sizes.

Note

Trusted Launch is a security feature for Generation 2 virtual machines. Generation 1 virtual machines use BIOS and MBR, and they don't support Secure Boot or vTPM by design. As a result, Generation 1 virtual machines can't use Trusted Launch and Azure Migrate doesn't support migrating Generation 1 virtual machines to Trusted Launch virtual machines.

Secure boot

At the root of Trusted Launch is Secure Boot,

  • Secure Boot is implemented in platform firmware and protects virtual machines from malware such as bootkits and rootkits. It ensures that only signed operating systems and drivers can start by establishing a trusted boot chain for the virtual machine.
  • When Secure Boot is enabled, all operating system boot components including the boot loader, kernel, and kernel drivers must be signed by trusted publishers.
  • Both Windows and supported Linux distributions support Secure Boot. If Secure Boot can't verify a trusted signature, the virtual machine fails to boot.

Note

  • You configure Secure Boot as part of the Trusted Launch settings on the target virtual machine. The setting isn't inherited from the source virtual machine.
  • Even if Secure Boot was enabled on the source virtual machine, it's not automatically enabled on the migrated Trusted Launch virtual machine. You must explicitly ensure Secure Boot is enabled in the Trusted Launch configuration during migration.

Migrate eligible machines to Azure Confidential Virtual machines

Azure Migrate now supports the migration of both Generation 1 and Generation 2 virtual machines (VMs) to Azure Confidential Virtual Machines (CVMs). Azure Migrate supports migrating eligible VMware, Hyper-V, and physical servers to Azure Confidential Virtual Machines.

  • Azure Confidential VMs offer strong security and confidentiality for tenants. They create a hardware-enforced boundary between your application and the virtualization stack. You can use them for cloud migrations without modifying your code, while the platform ensures that your VM’s state remains protected.
  • For more information on Azure Confidential machines, see Azure confidential virtual machines.

Note

  • Confidential Virtual Machines (CVMs) are a Generation 2 VMs capability. Azure Migrate supports the migration of both Generation 1 and Generation 2 VMs to Generation 2 CVMs in Azure.
  • Ensure that you install the latest updates for the respective operating system (OS) on the source machine before starting the migration.
  • If you choose Confidential Virtual Machines (CVMs) as the target security type during migration, only CVM-eligible VMs are available for selection and the rest are grayed out.

Supported operating systems for migrating to confidential virtual machines

Azure Migrate currently supports the migration of the following operating systems to Confidential Virtual Machines (CVMs):

  • Windows Server: 2019, 2022
  • Ubuntu: 20.04 LTS, 22.04 LTS, 24.04 LTS
  • Rocky Linux 9.4, 9.5, 9.6
  • RHEL 9.4, 9.5, 9.6

Confidential encryption for OS disks (optional)

Azure Migrate supports optional confidential encryption for OS disks during migration. This encryption protects all critical partitions of the disk. It also binds disk encryption keys to the virtual machine's TPM and makes the protected disk content accessible only to the VM.

  • Confidential OS disk encryption is optional. You can select from the following options:
    • A Confidential VM with Confidential OS disk encryption.
    • A Confidential VM without Confidential OS disk encryption.

Note

  • Only customer-managed key (CMK) are supported for confidential OS disk encryption for disks larger than 127 GB. For disks smaller than 127 GB, both platform-managed key (PMK) and customer-managed key (CMK) are supported.
  • Secure Boot is enabled by default on target VMs when Confidential OS disk encryption is selected.
  • Confidential OS disk encryption can increase the initial VM creation time during migration because of the encryption process that happens during hydration.
  • Data disks currently don't support confidential encryption. However, you can secure them by using host-based encryption with customer-managed keys (CMK) or platform-managed keys (PMK).
  • Last updated on