update

src/azure-cli/azure/cli/command_modules/vm/_params.py

@@ -318,6 +318,10 @@ def load_arguments(self, _):
                    help="enable/disable disk write accelerator. Use singular value 'true/false' to apply across, or specify individual disks, e.g.'os=true 1=true 2=true' for os disk and data disks with lun of 1 & 2")
         c.argument('disk_caching', nargs='*', help="Use singular value to apply across, or specify individual disks, e.g. 'os=ReadWrite 0=None 1=ReadOnly' should enable update os disk and 2 data disks")
         c.argument('ultra_ssd_enabled', ultra_ssd_enabled_type)
+        c.argument('enable_secure_boot', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable secure boot.')
+        c.argument('enable_vtpm', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable vTPM.')
 
     with self.argument_context('vm create') as c:
         c.argument('name', name_arg_type, validator=_resource_not_exists(self.cli_ctx, 'Microsoft.Compute/virtualMachines'))

src/azure-cli/azure/cli/command_modules/vm/custom.py

@@ -1285,7 +1285,8 @@ def show_vm(cmd, resource_group_name, vm_name, show_details=False):
 
 def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None,
               write_accelerator=None, license_type=None, no_wait=False, ultra_ssd_enabled=None,
-              priority=None, max_price=None, proximity_placement_group=None, workspace=None, **kwargs):
+              priority=None, max_price=None, proximity_placement_group=None, workspace=None, enable_secure_boot=None,
+              enable_vtpm=None, **kwargs):
     from msrestazure.tools import parse_resource_id, resource_id, is_valid_resource_id
     from ._vm_utils import update_write_accelerator_settings, update_disk_caching
     vm = kwargs['parameters']
@@ -1329,6 +1330,12 @@ def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None
     if proximity_placement_group is not None:
         vm.proximity_placement_group = {'id': proximity_placement_group}
 
+    if enable_secure_boot is not None or enable_vtpm is not None:
+        vm.security_profile = {'uefiSettings': {
+            'secureBootEnabled': enable_secure_boot,
+            'vTpmEnabled': enable_vtpm
+        }}
+
     if workspace is not None:
         workspace_id = _prepare_workspace(cmd, resource_group_name, workspace)
         workspace_name = parse_resource_id(workspace_id)['name']

src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py

@@ -5073,6 +5073,7 @@ def test_vm_ssh_key(self, resource_group):
 
 
 class VMTrustedLaunchScenarioTest(ScenarioTest):
+    @unittest.skip('image not found')
     @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_')
     def test_vm_trusted_launch(self, resource_group):
         self.cmd('vm create -g {rg} -n vm --image MicrosoftWindowsServer:windowsserver-gen2preview-preview:windows10-tvm:18363.592.2001092016 --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username AzureUser --admin-password testPassword0 --nsg-rule None')
@@ -5082,6 +5083,12 @@ def test_vm_trusted_launch(self, resource_group):
             self.check('securityProfile.UefiSettings.vTpmEnabled', True)
         ])
 
+    @unittest.skip('image not found')
+    @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_update_')
+    def test_vm_trusted_launch_update(self, resource_group):
+        self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --admin-username AzureUser --admin-password testPassword0 --nsg-rule None')
+        self.cmd('vm update -g {rg} -n vm --enable-secure-boot true --enable-vtpm true')
+
 
 if __name__ == '__main__':
     unittest.main()