Getting a compatible image to boot as a ‘Generation 2’ VM is not all that obvious. This article gives a good explanation. The critical bit:

After you have created the Virtual Machine using the wizard, go into the settings of the virtual machine. Switch to the Security section and choose the Microsoft UEFI Certificate Authority Secure Boot Template.