Strengthen SQL Server security on Azure Local with Trusted Launch

SQL Server continues to power mission-critical applications across industries, where organizations depend on its performance, availability, and security to protect important data. As customers modernize infrastructure while keeping workloads close to their data, Azure Local provides a Microsoft-managed, distributed infrastructure platform for running SQL Server in virtual machines at customer locations. This combination brings Azure operations and services to on-premises environments while organizations retain control over workload placement, latency, and regulatory requirements. Because these databases support critical business processes, securing the virtual machine from its first instruction is an essential part of the deployment. Trusted Launch helps establish that stronger foundation.

Protecting SQL Server requires more than securing the database engine. The virtual machine, operating system, and boot process form the foundation beneath every database workload, and a weakness at any layer can put applications and data at risk.

Azure Local provides the distributed infrastructure for running SQL Server in Windows Server or Linux virtual machines at customer locations. Trusted Launch strengthens that foundation with Secure Boot, a virtual Trusted Platform Module (vTPM), and automatic preservation of vTPM state when a VM moves between nodes in the same Azure Local cluster.

For SQL Server workloads, the value is straightforward: strengthen the VM's security posture while maintaining the security state that guest operating system features depend on.

Protect SQL Server from the moment the VM starts

Secure Boot checks that boot components are signed by trusted publishers. It helps reduce the risk of boot-level malware compromising the operating system that hosts SQL Server.

The vTPM provides a dedicated vault for keys, certificates, and secrets. SQL Server itself does not require a vTPM, but the guest operating system can use it to support security capabilities. For example, BitLocker on supported Windows guests can use the vTPM as a key protector for the operating system volume.

Trusted Launch does not automatically encrypt SQL Server databases or data volumes. Configure the encryption your workload requires, and continue to apply SQL Server access controls, operating system updates, and database backup policies.

Maintain security continuity when SQL Server VMs move

Cluster maintenance and host failures can move a SQL Server VM from one node to another. For workloads such as BitLocker-protected SQL volumes that use the vTPM as a key protector, preserving vTPM state helps maintain continuity.

Trusted Launch automatically transfers vTPM state when a VM migrates or fails over within an Azure Local cluster. This allows applications and operating system features that use the vTPM to continue using that state on the destination node. Microsoft's vTPM state-transfer example demonstrates this behavior with a BitLocker-protected operating system volume.

Combine this VM-level capability with your SQL Server high-availability design. Database-level availability, backup, and recovery remain separate parts of protecting the complete workload.

Verify boot integrity with guest attestation

Guest attestation, also called boot integrity verification, helps you assess whether a VM started in a known good state. It checks the boot chain for unexpected changes and exposes an attestation status on the VM resource in the Azure portal.

Guest attestation is currently in preview for Azure Local 2509 and later. It requires a supported image and access to the required Azure services. It is not enabled for custom images. Treat attestation as an additional, explicitly configured capability rather than assuming every Trusted Launch VM has integrity monitoring enabled.

Get started with SQL Server on a Trusted Launch VM

• Choose a supported configuration. Review the Azure Local requirements and select a Windows Server or Linux guest image supported by both your SQL Server version and Trusted Launch. Check guest-attestation image requirements separately.
• Select Trusted Launch when creating the VM. In the Azure portal, choose Trusted launch virtual machines as the security type. Follow the Azure Local VM creation guidance and retain Secure Boot and vTPM protection.
• Install and configure SQL Server. Follow the SQL Server on Azure Local deployment guide, then configure workload-specific storage, encryption, access, and availability.
• Verify protection and recovery. Enable and review guest attestation where supported. Back up the VM guest state protection key along with the VM files, and test recovery before relying on the deployment for production workloads.

vTPM state transfer within a cluster is not a substitute for disaster recovery. Review the Trusted Launch backup, recovery, and security guidance. This also recommends protecting live-migration network traffic with network-layer encryption, such as IPsec.

A stronger foundation for your database workloads

When SQL Server runs in a Trusted Launch-enabled virtual machine, the vTPM provides a root of trust for disk encryption and attestation. Because the vTPM state remains highly available as the virtual machine fails over or migrates within an Azure Local cluster, SQL Server workloads can retain that security foundation through planned maintenance and unplanned host events.