Azure Virtual Desktop Session Hosts does not KEK update, just errors with Firmware_Unknown.  States it cannot update Azure VM's. Is this true? whats the alternative

Thank you for the session. Most of my questions have been answered.

We have Intune managed endpoints, Azure Virtual Desktops and Azure Virtual Machines to managed with a combination of Intune and GPO.  A mixture of these machines have secure boot turned off. Will those machines become inherently vulnerable, and not updated if they were to have secure boot turned on at a later stage?

What determines if a device falls into the High Confidence bucket? We have lots of older model devices that are high confidence but most of our newer models have not.

When should I tick this box on my sccm boot image?

We have a small number of remote devices with no local IT support where Secure Boot is currently disabled. Will the KEK and DB updates still be applied to the bios on these devices while Secure Boot is inactive, or does the update process strictly require Secure Boot to be enabled to write the new certificates?

What determines if a device falls into the High Confidence bucket?

The Playbook makes this reference - 

https://support.microsoft.com/en-us/topic/sample-secure-boot-inventory-data-collection-script-d02971d2-d4b5-42c9-b58a-8527f0ffa30b

IMPORTANT This article containing the sample script has been retired. Starting with the Windows updates released on and after May 12, 2026, the sample script is located in the %systemroot%\SecureBoot\ExampleRolloutScripts folder on your device.​​​​​​​

Our machines are fully patched and updated - but this folder does not yet exist.

On OEM devices that are not getting firmware updates, how do we update the cert manually and a suggested way to roll out enterprise environment if they are not in high confidence bucket after june update? setting the registry key to x5944 moves to in progress but the device is in the temporarily paused bucket 

Since we're June and most device confidence level is still not High Confidence, should we do the cert update ourselves via the registry key so that we're done on time?

So one of our servers is "up to date" with the secure boot certificate, but we did nothing to it to update. How do we know which servers Microsoft is updating? Other VMs in the same host are not able to update because it looks like of some firmware update. Which is weird because the one that is up to date is on the same VM Host.