Windows 11 Hyper‑V support

Question

Windows 11 Hyper‑V support

Ruscov Vladmir 40

Does Hyper-V provide a documented, officially supported API that enables a host application to authorize a one-time cold boot of a Linux virtual machine using a designated IGVM image?

0 comments

2 answers

Your answer

Answer 1

David 80 Independent Advisor

Hello Dear Ruscov,

Hyper-V does not provide a documented, officially supported API for authorizing a one-time cold boot of a Linux VM from a designated IGVM image. Microsoft documents Hyper-V management through the Hyper-V WMI Provider, Host Compute System (HCS) API, and Windows Hypervisor Platform (WHP), but none of these APIs expose a one-time boot authorization mechanism tied to an IGVM image.

The IGVM (Independent Guest Virtual Machine) project provides a file format and tooling for describing a VM's initial state and launch configuration, but I couldn't find documentation showing a supported Hyper-V API that consumes an IGVM and enforces a single-use boot authorization policy.

If your requirement is "boot exactly once," that logic would typically need to be implemented by the host application itself, using Hyper-V lifecycle management APIs to start the VM and tracking authorization state externally.

Don't hesitate to reach out via reply on this if you need more clarification or support.

Dave.

Ruscov Vladmir 40 Reputation points

2026-11-12T09:49:28.61+00:00

No, any documentation that supports your answer?
David 80 Reputation points Independent Advisor

2026-11-12T10:06:33.0366667+00:00
Sir, actually the challenge is that Microsoft doesn't have a document that explicitly says:

"Hyper-V does not support one-time cold boot authorization from an IGVM image."

Usually in my point of view, the evidence comes from the official list of supported Hyper‑V APIs. Microsoft documents the available Hyper‑V API surfaces as:

Hyper‑V WMI Provider

Host Compute System (HCS) API

Host Compute Network API

Windows Hypervisor Platform (WHP)

Virtual Hard Disk Interface

Hypervisor Instruction Emulator API

VM Saved Dump Provider API

as documented here: https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/, and none of the documented interfaces describe an IGVM boot authorization workflow or a one‑time boot mechanism.

Answer 2

No publicly documented, officially supported Windows 11 Hyper‑V API provides one-time cold-boot authorization of a Linux VM from a designated IGVM image.

What the supported APIs provide

Microsoft documents three principal Hyper‑V API surfaces:

Hyper‑V WMI provider — high-level management of Hyper‑V services and conventional VMs.
Host Compute System (HCS) API — lower-level management of local VMs and containers.
Windows Hypervisor Platform (WHP) — lets a third-party virtualization stack create partitions, map memory, and control virtual processors.

None of the documented operations identifies an IGVM image as a Hyper‑V boot source or exposes a one-time boot-authorization token or policy. WHP also requires the application to supply its own virtualization stack; it is not an authorization extension for a Hyper‑V-managed VM.^1^

IGVM—Independent Guest Virtual Machine—describes an isolated VM’s initial state in Microsoft’s public project material. That establishes a file format and related tooling, but not a supported Windows 11 Hyper‑V management contract for loading an IGVM and authorizing exactly one cold boot.

Closest supported Hyper‑V mechanism

For protected workloads, the documented mechanism is a Generation 2 shielded VM, with:

Secure Boot, including Linux-compatible templates
virtual TPM and encrypted VM state
a Key Protector
optionally, Host Guardian Service (HGS)

HGS authorizes approved Hyper‑V hosts to start shielded VMs. A Key Protector can likewise be updated to authorize another host.^2^

That authorization is host/VM protection policy—not a documented consumable permit that authorizes one cold boot and is then invalidated. Consequently, HGS or Key Protectors should not be represented as satisfying one-time boot semantics.

Practical design choices

For an application requiring this behavior:

Use a conventional Hyper‑V VM and manage its lifecycle through WMI or HCS.
Enforce the one-time rule in the host application, such as recording authorization consumption before requesting VM start.
Treat that rule as an application policy, not a Hyper‑V security boundary: a sufficiently privileged host administrator can manage the VM independently.
If protection from host administrators is required, evaluate shielded VMs/HGS, but redesign around persistent host attestation and authorization rather than a one-use boot grant.
If the requested capability came from an SDK, partner specification, preview, or confidential-computing design, obtain its exact API name and support statement. The public Hyper‑V interfaces do not establish that scenario as supported.

On Windows 11, Hyper‑V itself is available in Pro, Enterprise, and Education editions.^3^ This edition support does not add an IGVM boot-authorization API.

References