How to enable vtpm for a confidential VM using the cli

Hi cloud D,

Welcome to the Microsoft Q&A forum and thank you for your question.

You're attempting to create a Confidential VM using the Azure CLI with the following configuration:

VM Size: Standard_DC2ads_v5 (Confidential Compute SKU)

Security Type: ConfidentialVM

OS Disk Security Encryption: VMGuestStateOnly

However, you're encountering the following error:

"Confidential VM or Virtual Machine Scale Set VM with 'managedDisk.securityProfile.securityEncryptionType' set as VMGuestStateOnly should have securityProfile.uefiSettings.vtpmEnabled set to true."

Root Cause

When using:

--security-type ConfidentialVM 
--os-disk-security-encryption-type VMGuestStateOnly

Azure requires that UEFI settings be explicitly enabled, particularly:

vtpmEnabled = true

(Optionally) secureBootEnabled = true

Note: As of now, the az vm create command does not expose CLI flags to configure UEFI settings like vTPM during VM creation.

Solution:

To resolve this, you must first create the VM and then patch it afterward using the az vm update command to enable vTPM.

Step-by-Step CLI Instructions

Step 1: Create the VM

az vm create \
  --name azure-temp \
  --resource-group resource_group \
  --size Standard_DC2ads_v5 \
  --security-type ConfidentialVM \
  --os-disk-security-encryption-type VMGuestStateOnly \
  --os-type Linux \
  --ssh-key-name azure \
  --nics azure-temp535 \
  --custom-data cloud-init.yaml

Step 2: Enable vTPM and Secure Boot

az vm update \
  --name azure-temp \
  --resource-group resource_group \
  --set securityProfile.uefiSettings.vtpmEnabled=true \
        securityProfile.uefiSettings.secureBootEnabled=true

This updates the VM’s UEFI settings to fulfill the compliance required for VMGuestStateOnly encryption under Confidential Compute.

Verify Configuration:

az vm show \
  --name azure-temp \
  --resource-group resource_group \
  --query "securityProfile.uefiSettings"

Expected output:

{
  "secureBootEnabled": true,
  "vtpmEnabled": true
}

References

Confidential VM CLI Reference – Azure REST API

UEFI Settings and vTPM Requirements

Confidential Compute + Semantic Search Overview

Let me know if you'd like help scripting this flow or integrating it into an automated deployment pipeline — happy to help!

Regards,
Chakravarthi Rangarajan Bhargavi

- If this answer helped, please click 'Yes' and accept the answer to help others in the community. Thank you! 😊