Remove check for "UseStandardSecurityType" AFEC for security-type Standard

[AjKundnani]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

• az vm create --security-type Standard
• az vm update --security-type Standard
• az vmss create --security-type Standard
• az vmss update --security-type Standard

Resource Provider

Microsoft.Compute/virtualMachines

Description of Feature or Work Requested

Today, security-type with value Standard is only supported if AFEC Microsoft.Compute\UseStandardSecurityType is registered on the VM or VMSS subscription.

CRP API now supports Standard as first-class enum for securityType starting API version 2025-11-01. i.e., there's no longer any AFEC dependency for using security type Standard.

ASK: Remove dependency on AFEC Microsoft.Compute\UseStandardSecurityType. Allow end users to specify security-type Standard without mandatory AFEC registration.

IMPORTANT - CRP API also returns Standard as default value of securityType in API response or in GET API if end user has not set any value for securityType at time of VM Create / Update.

Minimum API Version Required

2025-11-01

Swagger PR link / SDK link

Azure/azure-rest-api-specs#39957

Request Example

• https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/stable/2025-11-01/examples/virtualMachineExamples/VirtualMachine_Create_FromAGeneralizedSharedImage.json
• https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/stable/2025-11-01/examples/virtualMachineScaleSetExamples/VirtualMachineScaleSet_Create_FromAGeneralizedSharedImage.json

Target Date

2026-05-31

PM Contact

ajkundna

Engineer Contact

bhnayyar

Additional context

IMPORTANT - CRP API also returns Standard as default value of securityType in API response or in GET API if end user has not set any value for securityType at time of VM Create / Update.

https://techcommunity.microsoft.com/blog/AzureCompute/upcoming-compute-api-change-always-return-non-null-securitytype/4500387

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• CLI - Add Standard as SecurityType Option for backward compatibility #24127
• Enable Trusted Launch on existing VMSS | az vmss update #26972

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

If the CLI users pass the parameter --security-type='Standard', the API call made will exclude the SecurityProfile block in the API request. This behavior ensures that the Standard security type is used without explicitly sending the SecurityProfile block in the API request.

Reference:

• CLI - Add Standard as SecurityType Option for backward compatibility #24127 (comment)
• CLI - Add Standard as SecurityType Option for backward compatibility #24127 (comment)

Solution 2:

The default value for security-type should apply only when the user does not provide any input. If the user specifies a value for --security-type, that value should take precedence over the default. For example, if the user sets --enable-secure-boot true, then it should remain true, and the default value should not apply.

Reference:

• Enable Trusted Launch on existing VMSS | az vmss update #26972 (comment)

Powered by issue-sentinel