For environments where Secure Boot is currently disabled (Azure VMs, VMware, Nutanix, etc.), is the following approach considered valid and supported by Microsoft?

1. Keep Secure Boot disabled today
2. Install all required 2023 Secure Boot certificate and bootloader updates through normal OS patching before June 2026
3. After June 2026, enable Secure Boot during a controlled maintenance window
4. Reboot the VM so it boots using the updated 2023 certificate chain

In other words:

• Can organizations safely prepare the new Secure Boot trust chain in advance without enabling Secure Boot immediately?
• Is there any risk that systems with Secure Boot disabled today would fail to boot after June 2026 if the new certificates are already installed?
• Does Microsoft recommend this phased approach for enterprise server workloads where enabling Secure Boot immediately may introduce operational risk?

We would appreciate guidance specifically for Azure IaaS server workloads and enterprise Linux/Windows Server environments.