When creating a host pool with Windows 11 session hosts, how should you configure the VM security settings to enable secure boot and vTPM?

To enable secure boot and vTPM for Windows 11 session hosts in Azure Virtual Desktop, you must set the Security type to "Trusted launch virtual machines" during the VM creation process. Trusted launch provides foundational security features like secure boot, vTPM (virtual Trusted Platform Module), and integrity monitoring, which are crucial for enhancing the security posture of your virtual machines, especially for a modern OS like Windows 11. Enabling encryption at rest and a platform-managed key is a data protection measure, not a VM security setting for secure boot or vTPM. Enabling a system-assigned managed identity is for Azure resource authentication, not VM security features. Setting the Network security group to Advanced configures network traffic rules, which is unrelated to secure boot or vTPM.