

Support for Secure Boot was first introduced in vSphere 6.5 and here is a blog post that gets into more details.

If you want to enable Secure Boot for Windows or any other OS that supports Secure Boot, UEFI firmware is a requirement.

UPDATE (01/07/21) - As of vSphere 6.7 Update 3, the default firmware for creating a Windows 10 and Windows Server 2016 guest OS is now EFI This is especially important since the default firmware type in vSphere for these OSes are BIOS. Interestingly, for Microsoft Windows 10 and Windows Server 2016, there are some important implications to be aware of on whether BIOS or UEFI is used. Like most customers, I do not even bother touching this setting and I just assume the system defaults are sufficient. When creating a Virtual Machine in either vSphere or Fusion/Workstation, customers have the option to override the default and specify the specific Firmware boot option whether that is BIOS or UEFI. Several weeks back I was chatting with a few of our Engineers from the Core Platform Team (vSphere) and they had shared an interesting tidbit which I thought I was worth mentioning to my readers.
