Azure just made Secure Boot and vTPM the default for every new Gen2 VM — here's what changes, who gets it automatically, and where it can bite you.
