How to use Trusted Launch VM types as base templates in Parallels RAS Azure and AVD providers

Azure Trusted Launch is a security feature for Azure Generation 2 VMs that enables Secure Boot, a virtual Trusted Platform Module (vTPM), and Measured Boot to protect VMs against advanced threats. Starting with Parallels RAS 21.2, Trusted Launch VM types are supported as base templates for both the Azure and Azure Virtual Desktop (AVD) providers.

In Parallels RAS versions prior to 21.2, using a VM with Trusted Launch as a template base caused provisioning failures. Upgrading to RAS 21.2 or later resolves this.

Supported Trusted Launch features

When creating a Trusted Launch template in Parallels RAS 21.2, the following feature configuration is supported:

How to create a Trusted Launch template

1. In the RAS Console, expand the Farm node in the left pane and navigate to your Azure or AVD provider.
2. Right-click the Templates node (or use the Add button in the toolbar) to open the template creation wizard.
3. When selecting the base VM, choose an Azure Generation 2 VM that has its security type set to Trusted Launch.
4. On the security configuration step, verify the following:
   • Security type: Trusted Launch (inherited from the source VM - this cannot be changed)
   • Secure Boot: Enabled
   • vTPM: Enabled
   • Integrity Monitoring: Disabled
5. Complete the remaining wizard steps and click Finish. Parallels RAS uses Azure VM Images to create the template - this process may take several minutes, which is normal for Trusted Launch templates.
6. Once the template is created, verify it appears in the Templates list and that VMs provisioned from it have the Trusted Launch security type in the Azure portal.

Note: The security type of a template is fixed at creation time and cannot be changed afterward. To switch between standard and Trusted Launch, create a new template from a VM of the desired security type.

Maintenance mode

Trusted Launch templates support entering and leaving maintenance mode in the same way as standard templates. When you exit maintenance mode, Parallels RAS creates a new image version in the Azure Compute Gallery automatically.

1. In the RAS Console, right-click the template and select Enable Maintenance Mode. A maintenance clone is created from the template image.
2. Connect to the maintenance VM and apply the required updates or changes.
3. Once finished, right-click the template and select Disable Maintenance Mode. RAS creates a new image version from the updated VM and adds it to the gallery. Sessions using the previous image version are not interrupted until they reconnect.

Additional resources

• Trusted launch for Azure virtual machines - Microsoft Learn
• Windows 11 support on Azure virtual machines - Microsoft Learn