diff --git a/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep b/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
index 849a15c0ee..a049aeabc1 100644
--- a/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
+++ b/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
@@ -400,7 +400,7 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = {
         secrets: secrets
       }
       securityProfile: {
-        encryptionAtHost: encryptionAtHost
+        encryptionAtHost: encryptionAtHost ? encryptionAtHost : null
         securityType: securityType
         uefiSettings: securityType == 'TrustedLaunch' ? {
           secureBootEnabled: secureBootEnabled