mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
Merge branch 'main' into v-smandalika-edit-3-of-4318240
This commit is contained in:
Siddarth Mandalika
GitHub
Binary file not shown.
|
After Width: | Height: | Size: 197 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 74 KiB |
@ -0,0 +1,124 @@
|
||||
---
|
||||
title: Configure Personal Data Encryption (PDE) in Intune
|
||||
description: Configuring and enabling Personal Data Encryption (PDE) required and recommended policies in Intune
|
||||
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.reviewer: rafals
|
||||
manager: aaroncz
|
||||
ms.topic: how-to
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-security
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/22/2022
|
||||
---
|
||||
|
||||
<!-- Max 5963468 OS 32516487 -->
|
||||
|
||||
# Configure Personal Data Encryption (PDE) policies in Intune
|
||||
|
||||
## Required prerequisites
|
||||
|
||||
### Enable Personal Data Encryption (PDE)
|
||||
|
||||
1. Sign into the Intune
|
||||
2. Navigate to **Devices** > **Configuration Profiles**
|
||||
3. Select **Create profile**
|
||||
4. Under **Platform**, select **Windows 10 and later**
|
||||
5. Under **Profile type**, select **Templates**
|
||||
6. Under **Template name**, select **Custom**, and then select **Create**
|
||||
7. On the ****Basics** tab:
|
||||
1. Next to **Name**, enter **Personal Data Encryption**
|
||||
2. Next to **Description**, enter a description
|
||||
8. Select **Next**
|
||||
9. On the **Configuration settings** tab, select **Add**
|
||||
10. In the **Add Row** window:
|
||||
1. Next to **Name**, enter **Personal Data Encryption**
|
||||
2. Next to **Description**, enter a description
|
||||
3. Next to **OMA-URI**, enter in **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption**
|
||||
4. Next to **Data type**, select **Integer**
|
||||
5. Next to **Value**, enter in **1**
|
||||
11. Select **Save**, and then select **Next**
|
||||
12. On the **Assignments** tab:
|
||||
1. Under **Included groups**, select **Add groups**
|
||||
2. Select the groups that the PDE policy should be deployed to
|
||||
3. Select **Select**
|
||||
4. Select **Next**
|
||||
13. On the **Applicability Rules** tab, configure if necessary and then select **Next**
|
||||
14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
|
||||
|
||||
#### Disable Winlogon automatic restart sign-on (ARSO)
|
||||
|
||||
1. Sign into the Intune
|
||||
2. Navigate to **Devices** > **Configuration Profiles**
|
||||
3. Select **Create profile**
|
||||
4. Under **Platform**, select **Windows 10 and later**
|
||||
5. Under **Profile type**, select **Templates**
|
||||
6. Under **Template name**, select **Administrative templates**, and then select **Create**
|
||||
7. On the ****Basics** tab:
|
||||
1. Next to **Name**, enter **Disable ARSO**
|
||||
2. Next to **Description**, enter a description
|
||||
8. Select **Next**
|
||||
9. On the **Configuration settings** tab, under **Computer Configuration**, navigate to **Windows Components** > **Windows Logon Options**
|
||||
10. Select **Sign-in and lock last interactive user automatically after a restart**
|
||||
11. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK**
|
||||
12. Select **Next**
|
||||
13. On the **Scope tags** tab, configure if necessary and then select **Next**
|
||||
12. On the **Assignments** tab:
|
||||
1. Under **Included groups**, select **Add groups**
|
||||
2. Select the groups that the ARSO policy should be deployed to
|
||||
3. Select **Select**
|
||||
4. Select **Next**
|
||||
13. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
|
||||
|
||||
## Recommended prerequisites
|
||||
|
||||
#### Disable crash dumps
|
||||
|
||||
1. Sign into the Intune
|
||||
2. Navigate to **Devices** > **Configuration Profiles**
|
||||
3. Select **Create profile**
|
||||
4. Under **Platform**, select **Windows 10 and later**
|
||||
5. Under **Profile type**, select **Settings catalog**, and then select **Create**
|
||||
6. On the ****Basics** tab:
|
||||
1. Next to **Name**, enter **Disable Hibernation**
|
||||
2. Next to **Description**, enter a description
|
||||
7. Select **Next**
|
||||
8. On the **Configuration settings** tab, select **Add settings**
|
||||
9. In the **Settings picker** windows, select **Memory Dump**
|
||||
10. When the settings appear in the lower pane, under **Setting name**, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window
|
||||
11. Change both **Allow Live Dump** and **Allow Crash Dump** to **Block**, and then select **Next**
|
||||
12. On the **Scope tags** tab, configure if necessary and then select **Next**
|
||||
13. On the **Assignments** tab:
|
||||
1. Under **Included groups**, select **Add groups**
|
||||
2. Select the groups that the crash dumps policy should be deployed to
|
||||
3. Select **Select**
|
||||
4. Select **Next**
|
||||
14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
|
||||
|
||||
#### Disable hibernation
|
||||
|
||||
1. Sign into the Intune
|
||||
2. Navigate to **Devices** > **Configuration Profiles**
|
||||
3. Select **Create profile**
|
||||
4. Under **Platform**, select **Windows 10 and later**
|
||||
5. Under **Profile type**, select **Settings catalog**, and then select **Create**
|
||||
6. On the ****Basics** tab:
|
||||
1. Next to **Name**, enter **Disable Hibernation**
|
||||
2. Next to **Description**, enter a description
|
||||
7. Select **Next**
|
||||
8. On the **Configuration settings** tab, select **Add settings**
|
||||
9. In the **Settings picker** windows, select **Power**
|
||||
10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window
|
||||
11. Change **Allow Hibernate** to **Block**, and then select **Next**
|
||||
12. On the **Scope tags** tab, configure if necessary and then select **Next**
|
||||
13. On the **Assignments** tab:
|
||||
1. Under **Included groups**, select **Add groups**
|
||||
2. Select the groups that the hibernation policy should be deployed to
|
||||
3. Select **Select**
|
||||
4. Select **Next**
|
||||
14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create**
|
||||
|
||||
## See also
|
||||
- [Personal Data Encryption (PDE)](overview-pde.md)
|
||||
- [Personal Data Encryption (PDE) FAQ](faq-pde.yml)
|
||||
@ -0,0 +1,74 @@
|
||||
### YamlMime:FAQ
|
||||
|
||||
metadata:
|
||||
title: Frequently asked questions for Personal Data Encryption (PDE)
|
||||
description: Answers to common questions regarding Personal Data Encryption (PDE).
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.reviewer: rafals
|
||||
manager: aaroncz
|
||||
ms.topic: faq
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-security
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/22/2022
|
||||
|
||||
title: Frequently asked questions for Personal Data Encryption (PDE)
|
||||
summary: |
|
||||
Here are some answers to common questions regarding Personal Data Encryption (PDE)
|
||||
|
||||
sections:
|
||||
- name: Single section - ignored
|
||||
questions:
|
||||
- question: Can PDE encrypt entire volumes or drives?
|
||||
answer: |
|
||||
No. PDE only encrypts specified files.
|
||||
|
||||
- question: Is PDE a replacement for BitLocker?
|
||||
answer: |
|
||||
No. It's still recommended to encrypt all volumes with BitLocker Drive Encryption for increased security.
|
||||
|
||||
- question: Can an IT admin specify which files should be encrypted?
|
||||
answer: |
|
||||
Yes, but it can only be done using the PDE APIs.
|
||||
|
||||
- question: Do I need to use OneDrive as my backup provider?
|
||||
answer: |
|
||||
No. PDE doesn't have a requirement for a backup provider including OneDrive. However, backups are strongly recommended in case the encryption keys used by PDE are lost. OneDrive is a recommended backup provider.
|
||||
|
||||
- question: What is the relation between Windows Hello for Business and PDE?
|
||||
answer: |
|
||||
Windows Hello for Business unlocks PDE encryption keys during user sign on.
|
||||
|
||||
- question: Can a file be encrypted with both PDE and EFS at the same time?
|
||||
answer: |
|
||||
No. PDE and EFS are mutually exclusive.
|
||||
|
||||
- question: Can a PDE encrypted files be accessed after signing on via a Remote Desktop connection (RDP)?
|
||||
answer: |
|
||||
No. Accessing PDE encrypted files over RDP isn't currently supported.
|
||||
|
||||
- question: Can a PDE encrypted files be access via a network share?
|
||||
answer: |
|
||||
No. PDE encrypted files can only be accessed after signing on locally to Windows with Windows Hello for Business credentials.
|
||||
|
||||
- question: How can it be determined if a file is encrypted with PDE?
|
||||
answer: |
|
||||
Encrypted files will show a padlock on the file's icon. Additionally, `cipher.exe` can be used to show the encryption state of the file.
|
||||
|
||||
- question: Can users manually encrypt and decrypt files with PDE?
|
||||
answer: |
|
||||
Currently users can decrypt files manually but they can't encrypt files manually.
|
||||
|
||||
- question: If a user signs into Windows with a password instead of Windows Hello for Business, will they be able to access their PDE encrypted files?
|
||||
answer: |
|
||||
No. PDE encryption keys are protected Windows Hello for Business credentials and will only be unlocked when signing on with Windows Hello for Business PIN or biometrics.
|
||||
|
||||
- question: What encryption method and strength does PDE use?
|
||||
answer: |
|
||||
PDE uses AES-256 to encrypt files
|
||||
|
||||
additionalContent: |
|
||||
## See also
|
||||
- [Personal Data Encryption (PDE)](overview-pde.md)
|
||||
- [Configure Personal Data Encryption (PDE) polices in Intune](configure-pde-in-intune.md)
|
||||
@ -0,0 +1,27 @@
|
||||
---
|
||||
title: Personal Data Encryption (PDE) description
|
||||
description: Personal Data Encryption (PDE) description include file
|
||||
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.reviewer: rafals
|
||||
manager: aaroncz
|
||||
ms.topic: how-to
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-security
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/22/2022
|
||||
---
|
||||
|
||||
<!-- Max 5963468 OS 32516487 -->
|
||||
|
||||
Personal data encryption (PDE) is a security feature introduced in Windows 11, version 22H2 that provides additional encryption features to Windows. PDE differs from BitLocker in that it encrypts individual files instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker.
|
||||
|
||||
PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimize the number of credentials the user has to remember to gain access to files. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requirement requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business.
|
||||
|
||||
PDE is also accessibility friendly. For example, The BitLocker PIN entry screen doesn't have accessibility options. PDE however uses Windows Hello for Business, which does have accessibility features.
|
||||
|
||||
Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE encrypted files once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked.
|
||||
|
||||
> [!NOTE]
|
||||
> PDE is currently only available to developers via [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or encrypt files via PDE. Also, although there is an MDM policy that can enable PDE, there are no MDM policies that can be used to encrypt files via PDE.
|
||||
@ -0,0 +1,142 @@
|
||||
---
|
||||
title: Personal Data Encryption (PDE)
|
||||
description: Personal Data Encryption unlocks user encrypted files at user sign in instead of at boot.
|
||||
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.reviewer: rafals
|
||||
manager: aaroncz
|
||||
ms.topic: how-to
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-security
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/22/2022
|
||||
---
|
||||
|
||||
<!-- Max 5963468 OS 32516487 -->
|
||||
|
||||
# Personal Data Encryption (PDE)
|
||||
|
||||
(*Applies to: Windows 11, version 22H2 and later Enterprise and Education editions*)
|
||||
|
||||
[!INCLUDE [Personal Data Encryption (PDE) description](includes/pde-description.md)]
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### **Required**
|
||||
- [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join)
|
||||
- [Windows Hello for Business](../../identity-protection/hello-for-business/hello-overview.md)
|
||||
- Windows 11, version 22H2 and later Enterprise and Education editions
|
||||
|
||||
### **Not supported with PDE**
|
||||
- [FIDO/security key authentication](../../identity-protection/hello-for-business/microsoft-compatible-security-key.md)
|
||||
- [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-)
|
||||
- For information on disabling ARSO via Intune, see [Disable Winlogon automatic restart sign-on (ARSO)](configure-pde-in-intune.md#disable-winlogon-automatic-restart-sign-on-arso)).
|
||||
- [Windows Information Protection (WIP)](../windows-information-protection/protect-enterprise-data-using-wip.md)
|
||||
- [Hybrid Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join-hybrid)
|
||||
- Remote Desktop connections
|
||||
|
||||
### **Highly recommended**
|
||||
- [BitLocker Drive Encryption](../bitlocker/bitlocker-overview.md) enabled
|
||||
- Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to supplement BitLocker and not replace it.
|
||||
- Backup solution such as [OneDrive](/onedrive/onedrive)
|
||||
- In certain scenarios such as TPM resets or destructive PIN resets, the PDE encryption keys can be lost. In such scenarios, any file encrypted with PDE will no longer be accessible. The only way to recover such files would be from backup.
|
||||
- [Windows Hello for Business PIN reset service](../../identity-protection/hello-for-business/hello-feature-pin-reset.md)
|
||||
- Destructive PIN resets will cause PDE encryption keys to be lost. The destructive PIN reset will make any file encrypted with PDE no longer accessible after a destructive PIN reset. Files encrypted with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets.
|
||||
- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)
|
||||
- Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN
|
||||
- [Kernel and user mode crash dumps disabled](/windows/client-management/mdm/policy-csp-memorydump)
|
||||
- Crash dumps can potentially cause the PDE encryption keys to be exposed. For greatest security, disable kernel and user mode crash dumps. For information on disabling crash dumbs via Intune, see [Disable crash dumps](configure-pde-in-intune.md#disable-crash-dumps).
|
||||
- [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate)
|
||||
- Hibernation files can potentially cause the PDE encryption keys to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation).
|
||||
|
||||
## PDE protection levels
|
||||
|
||||
PDE uses AES-256 to encrypt files and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the PDE APIs.
|
||||
|
||||
| Item | Level 1 | Level 2 |
|
||||
|---|---|---|
|
||||
| Data is accessible when user is signed in | Yes | Yes |
|
||||
| Data is accessible when user has locked their device | Yes | No |
|
||||
| Data is accessible after user signs out | No | No |
|
||||
| Data is accessible when device is shut down | No | No |
|
||||
| Decryption keys discarded | After user signs out | After user locks device or signs out |
|
||||
|
||||
## PDE encrypted files accessibility
|
||||
|
||||
When a file is encrypted with PDE, its icon will show a padlock. If the user hasn't signed in locally with Windows Hello for Business or an unauthorized user attempts to access a PDE encrypted file, they'll be denied access to the file.
|
||||
|
||||
Scenarios where a user will be denied access to a PDE encrypted file include:
|
||||
|
||||
- User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN.
|
||||
- If specified via level 2 protection, when the device is locked.
|
||||
- When trying to access files on the device remotely. For example, UNC network paths.
|
||||
- Remote Desktop sessions.
|
||||
- Other users on the device who aren't owners of the file, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE encrypted files.
|
||||
|
||||
## How to enable PDE
|
||||
|
||||
To enable PDE on devices, push an MDM policy to the devices with the following parameters:
|
||||
|
||||
- Name: **Personal Data Encryption**
|
||||
- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption**
|
||||
- Data type: **Integer**
|
||||
- Value: **1**
|
||||
|
||||
There's also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) available for MDM solutions that support it.
|
||||
|
||||
> [!NOTE]
|
||||
> Enabling the PDE policy on devices only enables the PDE feature. It does not encrypt any files. To encrypt files, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) to create custom applications and scripts to specify which files to encrypt and at what level to encrypt the files. Additionally, files will not encrypt via the APIs until this policy has been enabled.
|
||||
|
||||
For information on enabling PDE via Intune, see [Enable Personal Data Encryption (PDE)](configure-pde-in-intune.md#enable-personal-data-encryption-pde).
|
||||
|
||||
## Differences between PDE and BitLocker
|
||||
|
||||
| Item | PDE | BitLocker |
|
||||
|--|--|--|
|
||||
| Release of encryption keys | At user sign in via Windows Hello for Business | At boot |
|
||||
| Encryption keys discarded | At user sign out | At reboot |
|
||||
| Files encrypted | Individual specified files | Entire volume/drive |
|
||||
| Authentication to access encrypted file | Windows Hello for Business | When BitLocker with PIN is enabled, BitLocker PIN plus Windows sign in |
|
||||
| Accessibility | Windows Hello for Business is accessibility friendly | BitLocker with PIN doesn't have accessibility features |
|
||||
|
||||
## Differences between PDE and EFS
|
||||
|
||||
The main difference between encrypting files with PDE instead of EFS is the method they use to encrypt the file. PDE uses Windows Hello for Business to secure the encryption keys that encrypts the files. EFS uses certificates to secure and encrypt the files.
|
||||
|
||||
To see if a file is encrypted with PDE or EFS:
|
||||
|
||||
1. Open the properties of the file
|
||||
2. Under the **General** tab, select **Advanced...**
|
||||
3. In the **Advanced Attributes** windows, select **Details**
|
||||
|
||||
For PDE encrypted files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the attribute of **On**.
|
||||
|
||||
For EFS encrypted files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**.
|
||||
|
||||
Encryption information including what encryption method is being used can be obtained with the command line `cipher.exe /c` command.
|
||||
|
||||
## Disable PDE and decrypt files
|
||||
|
||||
Currently there's no method to disable PDE via MDM policy. However, PDE can be disabled locally and files can be decrypted using `cipher.exe`.
|
||||
|
||||
In certain scenarios a user may be able to manually decrypt a file using the following steps:
|
||||
|
||||
1. Open the properties of the file
|
||||
2. Under the **General** tab, select **Advanced...**
|
||||
3. Uncheck the option **Encrypt contents to secure data**
|
||||
4. Select **OK**, and then **OK** again
|
||||
|
||||
> [!Important]
|
||||
> Once a user selects to manually decrypt a file, they will not be able to manually encrypt the file again.
|
||||
|
||||
## Windows out of box applications that support PDE
|
||||
|
||||
Certain Windows applications support PDE out of the box. If PDE is enabled on a device, these applications will utilize PDE.
|
||||
|
||||
- Mail
|
||||
- Supports encrypting both email bodies and attachments
|
||||
|
||||
## See also
|
||||
- [Personal Data Encryption (PDE) FAQ](faq-pde.yml)
|
||||
- [Configure Personal Data Encryption (PDE) polices in Intune](configure-pde-in-intune.md)
|
||||
@ -0,0 +1,52 @@
|
||||
---
|
||||
title: Microsoft Pluton security processor
|
||||
description: Learn more about Microsoft Pluton security processor
|
||||
ms.reviewer:
|
||||
ms.prod: m365-security
|
||||
author: vinaypamnani-msft
|
||||
ms.author: vinpa
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.collection:
|
||||
- M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/15/2022
|
||||
appliesto:
|
||||
- ✅ <b>Windows 11, version 22H2</b>
|
||||
---
|
||||
|
||||
# Microsoft Pluton security processor
|
||||
|
||||
Microsoft Pluton security processor is a chip-to-cloud security technology built with [Zero Trust](/security/zero-trust/zero-trust-overview) principles at the core. Microsoft Pluton provides hardware-based root of trust, secure identity, secure attestation, and cryptographic services. Pluton technology is a combination of a secure subsystem which is part of the System on Chip (SoC) and Microsoft authored software that runs on this integrated secure subsystem.
|
||||
|
||||
Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 series processors. Microsoft Pluton can be enabled on devices with Pluton capable processors running Windows 11, version 22H2.
|
||||
|
||||
## What is Microsoft Pluton?
|
||||
|
||||
Designed by Microsoft and built by silicon partners, Microsoft Pluton is a secure crypto-processor built into the CPU for security at the core to ensure code integrity and the latest protection with updates delivered by Microsoft through Windows Update. Pluton protects credentials, identities, personal data and encryption keys. Information is significantly harder to be removed even if an attacker has installed malware or has complete physical possession of the PC.
|
||||
|
||||
Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module as well as deliver other security functionality beyond what is possible with the TPM 2.0 specification, and allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. For more information, see [Microsoft Pluton as TPM](pluton-as-tpm.md).
|
||||
|
||||
Pluton is built on proven technology used in Xbox and Azure Sphere, and provides hardened integrated security capabilities to Windows 11 devices in collaboration with leading silicon partners. For more information, see [Meet the Microsoft Pluton processor – The security chip designed for the future of Windows PCs](https://www.microsoft.com/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs/).
|
||||
|
||||
## Microsoft Pluton security architecture overview
|
||||
|
||||
|
||||
|
||||
Pluton Security subsystem consists of the following layers:
|
||||
|
||||
| | Description |
|
||||
|--|--|
|
||||
| **Hardware** | Pluton Security Processor is a secure element tightly integrated into the SoC subsystem. It provides a trusted execution environment while delivering cryptographic services required for protecting sensitive resources and critical items like keys, data, etc. |
|
||||
| **Firmware** | Microsoft authorized firmware provides required secure features and functionality, and exposes interfaces that operating system software and applications can use to interact with Pluton. The firmware is stored in the flash storage available on the motherboard. When the system boots, the firmware is loaded as a part of Pluton Hardware initialization. During Windows startup, a copy of this firmware (or the latest firmware obtained from Windows Update, if available) is loaded in the operating system. For additional information, see [Firmware load flow](#firmware-load-flow) |
|
||||
| **Software** | Operating system drivers and applications available to an end user to allow seamless usage of the hardware capabilities provided by the Pluton security subsystem. |
|
||||
|
||||
## Firmware load flow
|
||||
|
||||
When the system boots, Pluton hardware initialization is performed by loading the Pluton firmware from the Serial Peripheral Interface (SPI) flash storage available on the motherboard. During Windows startup however, the latest version of the Pluton firmware is used by the operating system. If newer firmware is not available, Windows uses the firmware that was loaded during the hardware initialization. The diagram below illustrates this process:
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
[Microsoft Pluton as TPM](pluton-as-tpm.md)
|
||||
@ -0,0 +1,50 @@
|
||||
---
|
||||
title: Microsoft Pluton as Trusted Platform Module (TPM 2.0)
|
||||
description: Learn more about Microsoft Pluton security processor as Trusted Platform Module (TPM 2.0)
|
||||
ms.reviewer:
|
||||
ms.prod: m365-security
|
||||
author: vinaypamnani-msft
|
||||
ms.author: vinpa
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.collection:
|
||||
- M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/15/2022
|
||||
appliesto:
|
||||
- ✅ <b>Windows 11, version 22H2</b>
|
||||
---
|
||||
|
||||
# Microsoft Pluton as Trusted Platform Module
|
||||
|
||||
Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM) thereby establishing the silicon root of trust. Microsoft Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPM including BitLocker, Windows Hello, and Windows Defender System Guard.
|
||||
|
||||
As with other TPMs, credentials, encryption keys, and other sensitive information cannot be easily extracted from Pluton even if an attacker has installed malware or has complete physical possession of the device. Storing sensitive data like encryption keys securely within the Pluton processor, which is isolated from the rest of the system, helps ensure that emerging attack techniques such as speculative execution cannot access key material.
|
||||
|
||||
Pluton also solves the major security challenge of keeping its own root-of-trust firmware up to date across the entire PC ecosystem, by delivering firmware updates from Windows Update. Today customers receive updates to their security firmware from a variety of different sources, which may make it difficult for them to apply these updates.
|
||||
|
||||
To learn more about the TPM related scenarios that benefit from Pluton, see [TPM and Windows Features](/windows/security/information-protection/tpm/tpm-recommendations#tpm-and-windows-features).
|
||||
|
||||
## Microsoft Pluton as a security processor alongside discrete TPM
|
||||
|
||||
Microsoft Pluton can be used as a TPM, or in conjunction with a TPM. Although Pluton builds security directly into the CPU, device manufacturers may choose to use discrete TPM as the default TPM, while having Pluton available to the system as a security processor for use cases beyond the TPM.
|
||||
|
||||
Pluton is integrated within the SoC subsystem, and provides a flexible, updatable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. We encourage users owning devices that are Pluton capable, to enable Microsoft Pluton as the default TPM.
|
||||
|
||||
## Enable Microsoft Pluton as TPM
|
||||
|
||||
Devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 series processors are Pluton Capable, however enabling and providing an option to enable Pluton is at the discretion of the device manufacturer. Pluton is supported on these devices and can be enabled from the Unified Extensible Firmware Interface (UEFI) setup options for the device.
|
||||
|
||||
UEFI setup options differ from product to product, visit the product website and check for guidance to enable Pluton as TPM.
|
||||
|
||||
> [!WARNING]
|
||||
> If BitLocker is enabled, We recommend disabling BitLocker before changing the TPM configuration to prevent lockouts. After changing TPM configuration, re-enable BitLocker which will then bind the BitLocker keys with the Pluton TPM. Alternatively, save the BitLocker recovery key onto a USB drive.
|
||||
>
|
||||
> Windows Hello must be re-configured after switching the TPM. Setup alternate login methods before changing the TPM configuration to prevent any login issues.
|
||||
|
||||
> [!TIP]
|
||||
> On most Lenovo devices, entering the UEFI options requires pressing Enter key at startup followed by pressing F1. In the UEFI Setup menu, select Security option, then on the Security page, select Security Chip option, to see the TPM configuration options. Under the drop-down list for Security Chip selection, select **MSFT Pluton** and click F10 to Save and Exit.
|
||||
|
||||
## Related topics
|
||||
|
||||
[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)
|
||||
Reference in New Issue
Block a user