---
title: "Azure Confidential VM Attestation - Windows"
slug: "fortanix-ccm-azure-cvm-attestation-windows"
updated: 2026-07-22T14:17:13Z
published: 2026-07-22T14:17:13Z
canonical: "support.fortanix.com/fortanix-ccm-azure-cvm-attestation-windows"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Confidential VM Attestation - Windows

## 1.0 Introduction

This article describes the procedure for completing the attestation workflow for an Azure Confidential Virtual Machine (CVM) using Fortanix Confidential Computing Manager (CCM) in **Windows**-based environments.

After configuring the application and build in Fortanix CCM and registering the required Platform Configuration Register (PCR) values, the Azure CVM must run the Fortanix Attestation Client for Windows to establish trust and register itself as an approved compute instance.

## 2.0 Prerequisites

Before proceeding, ensure the following:

- Ensure to download the Fortanix Azure CVM Attestation Client binary from [*here*](https://fortanix.zendesk.com/hc/en-us/articles/46157933975060-Fortanix-CCM-Attestation-Client-Windows).
- The Azure CVM has been deployed and is accessible.
- A Fortanix CCM application and its associated build have been created and approved.
- PCR values collected from the Azure CVM environment have been mapped to the build in Fortanix CCM. *For more information on VM creation and PCR extraction, refer to* [*Azure Confidential VM Setup - Windows*](/v1/docs/azure-confidential-vm-setup-windows-1)*.*
- Network access exists between the Azure CVM and Fortanix CCM endpoint.
- You have access to the following configuration values:
  - Fortanix CCM tenant URL
  - Join token

> [!NOTE]
> NOTE
> 
> Attestation cannot proceed if the application build has not been approved in Fortanix CCM.

## 3.0 Configure Execution Permissions

The Fortanix Azure CVM Attestation Client for Windows must be executed from an elevated PowerShell session because it requires administrative privileges to access the TPM and write attestation artifacts.

Perform the following steps:

1. On the Azure Windows CVM, open **PowerShell** as an Administrator.
2. If you are using a Windows Server version with a graphical user interface (GUI), right-click **Windows PowerShell** and select **Run as administrator**.

> [!NOTE]
> NOTE
> 
> On Windows Server Core (no GUI), commands are typically run from an Administrator-elevated `cmd.exe` session. In this case, run `powershell.exe` to enter **Windows PowerShell**; the session is usually already running with Administrator privileges.
3. Run the following command to verify that the current session has administrative privileges:

```bash
(New-Object Security.Principal.WindowsPrincipal( 
    [Security.Principal.WindowsIdentity]::GetCurrent() 
)).IsInRole( 
    [Security.Principal.WindowsBuiltInRole]::Administrator 
)
```

**Output**:
  - If the command returns **True**, the PowerShell session has Administrator privileges.
  - If the command returns **False**, you are not running as an administrator. To gain administrator access, close this PowerShell window and reopen it using “Run as Administrator”.

## 4.0 Configure Environment Variables

The Fortanix Attestation Client uses the following environment variables to determine where to write output and how to connect to the Fortanix CCM service:

> [!NOTE]
> NOTE
> 
> The `JOIN_TOKEN` is mandatory. Without it, the node will not register with Fortanix CCM. The `FORTANIX_CLIENT_OUTPUT_DIR` is also required, as there is no default output location for the generated files.

| Environment Variable | Default Value | Description |
| --- | --- | --- |
| `FORTANIX_CLIENT_OUTPUT_DIR` | unset | Client writes `key.pem` and `cert.pem` after successful attestation. |
| `RUST_LOG` | `ERROR` | Set to `DEBUG`, `ERROR`, `WARN`, `INFO`, `TRACE`, or `OFF` to enable verbose logging. |
| `MANAGER_ENDPOINT` | https://ccm.fortanix.com | Fortanix CCM service endpoint for attestation request. > [!NOTE] > NOTE > > The value must begin with `https://` |
| `JOIN_TOKEN` | unset | Must be set to the join token generated in Fortanix CCM. |

In your PowerShell session, run the following commands to configure the environment variables:

```bash
$env:FORTANIX_CLIENT_OUTPUT_DIR="<Desired output directory for key and certificate>" 
$env:JOIN_TOKEN="<JOIN TOKEN VALUE>"
```

Where,

- `&lt;JOIN TOKEN VALUE&gt;` : The join token you generated from Fortanix CCM.
- `&lt;Desired output directory for key and certificate&gt;` : The desired output directory path where the Fortanix Attestation Client will save the key and certificate file.

Optionally, configure logging and a custom Fortanix CCM endpoint:

```bash
$env:RUST_LOG="<log_level>" 
$env:MANAGER_ENDPOINT="<URL of CCM instance>"
```

Where,

- `&lt;log_level&gt;` : Sets the logging verbosity, such as `DEBUG`, `ERROR`, `WARN`, `INFO`, `TRACE`, or `OFF`.
- `&lt;URL of CCM instance&gt;` : The Fortanix CCM endpoint. For example, **https:/ccm.fortanix.com**.

## 5.0 Generate a Join Token

Perform the following steps to generate a join token in Fortanix CCM:

1. Log in to Fortanix Armor Platform. *For more information,* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started)*.*
2. Navigate to the Fortanix CCM user interface (UI). *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.*
3. In the CCM user interface (UI) left navigation panel, click **Infrastructure → COMPUTE NODES → Azure SEV Containers**, and then click **ADD NODE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3882).png)

**Figure 1: Add node**
4. In the **Enroll Compute Node** window, click **COPY** to copy the Join Token. This Join Token is used by the compute node to authenticate itself.

## 6.0 Run the Attestation Client

After configuring the environment variables, run the Fortanix Attestation Client for Windows to perform attestation.

Perform the following steps in a PowerShell session with administrative privileges:

1. Run the following command to install the CVM Attestation Client:

```bash
.\CVMAttestationClientSetup.exe /quiet /norestart /log "C:\Users\<user>\install.log"
```
2. Navigate to the `C:\Program Files\Fortanix\CVMAttestationClient` directory.
3. Run the following command to execute the client:

```bash
.\ccm_attestation_client_azurecvm.exe
```

If the client runs successfully:

> [!NOTE]
> NOTE
> 
> If error occurs during execution, verify the following:
> 
> - The PowerShell session is running as Administrator.
> - The `JOIN_TOKEN` and `FORTANIX_CLIENT_OUTPUT_DIR` environment variables are set correctly.
> - The Azure Windows CVM can reach the Fortanix CCM endpoint configured in `MANAGER_ENDPOINT`.
> - To obtain additional error details, set the `RUST_LOG` environment variable to `INFO`.
  - No error messages are displayed in the console.
  - The directory specified in `FORTANIX_CLIENT_OUTPUT_DIR` contains two files:
    - `key.pem` - The private key generated during attestation.
    - `cert.pem` - The certificate generated during attestation.

The attestation process begins automatically. During this time, the client collects platform evidence, verifies signatures, and submits measurements to Fortanix CCM. The process may take several minutes, depending on the compute environment and network conditions.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/CVM Windows- 5.png)

**Figure 2: Evidence and certificate are fetched**

## 7.0 Verify Attestation Status in Fortanix CCM

After the attestation client has completed execution, verify the attestation result in Fortanix CCM by confirming that the attestation certificate is available for download.

Perform the following steps to download the certificate:

1. Navigate to the Fortanix CCM UI. *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.*
2. Navigate to **Applications** and select the Azure CVM application, then go to its detailed view and navigate to **CERTIFICATES** tab.
3. Click **DOWNLOAD CERTIFICATE** to verify its validity.

Attestation is considered successful when the attestation certificate appears and is available for download. This confirms that the hardware measurements match the PCR values configured for the build in Fortanix CCM.