Six years later, Microsoft quietly stepped down from its TPM role. Microsoft did not "remove the TPM." Windows 11's hard requirement for TPM 2.0 remains unchanged word for word, BitLocker still encrypts as usual, and Windows Hello still scans your face as usual. What it removed was one of Pluton's side jobs: starting with new chips in 2026, on AMD and Qualcomm platforms

💡 What You Will Learn

Six years later, Microsoft quietly stepped down from its TPM role. Microsoft did not "remove the TPM." Windows 11's hard requirement for TPM 2.0 remains unchanged word for word, BitLocker still encryp

Six years later, Microsoft quietly pulled itself off the TPM job

Microsoft didn't "remove TPM." Windows 11's hard requirement for TPM 2.0 hasn't changed a single word, BitLocker still encrypts as usual, and Windows Hello still scans your face as usual. What it pulled was one of Pluton's side gigs: starting with new chips in 2026, Pluton on AMD and Qualcomm platforms will no longer double as the TPM—that job goes back to the chip vendors' firmware TPM (fTPM) or a discrete chip on the motherboard.

What's really changing isn't the functionality, it's the patch pipeline—from now on, if your TPM has a vulnerability, you'll have to wait for your laptop vendor to release a BIOS.

A quick aside: this news was basically reported wrong in China.

All Microsoft changed was a footnote

No press conference, no official blog, no press release. Microsoft simply added an Important note to its support document "Microsoft Pluton as Trusted Platform Module": starting with 2026 silicon, Microsoft Pluton on AMD and Qualcomm platforms will no longer serve as the TPM; on these platforms as well as on Intel, TPM 2.0 will instead be provided by the vendor's firmware TPM or a discrete TPM.

Look closely at the grammar. The subject of "no longer serve as the TPM" is only AMD and Qualcomm; the following clause "as well as on Intel" is just adding that Intel, too, gets its TPM from fTPM.

Why doesn't Intel count as changed? Because Intel never had Pluton serve as the TPM in the first place. Core Ultra 200V and Series 3 do integrate a Pluton module, but the one responsible for TPM 2.0 has always been Intel's own PTT, or a discrete chip on the motherboard.

Yet in China, from IT之家 to Sohu to Tencent News, everyone wrote it as "Pluton on AMD, Intel, and Qualcomm will no longer handle TPM 2.0." The source is probably the English headline Microsoft Removes Pluton TPM Support From New AMD, Intel, and Qualcomm CPUs—the headline lists all three side by side, while the body actually lays out the details; by the time it reached Chinese, only the headline was left.

A one-word difference: "changed all three" versus "changed two, and Intel was always like this."

What was given up is exactly the selling point from back then

To understand the weight of this adjustment, you have to go back to November 2020. Microsoft teamed up with AMD, Intel, and Qualcomm to announce Pluton, and the logic presenter David Weston laid out was solid: an attacker with physical access can target the channel between the CPU and the TPM—put the security processor inside the CPU, and the channel disappears.

The other selling point was more practical—firmware delivered directly via Windows Update. Traditional TPM firmware depends on motherboard vendors releasing BIOS updates, whereas Pluton can be pushed like a system patch: at boot it first checks for new firmware, and only falls back to the old version in SPI flash if there isn't any. In May 2024, Microsoft also announced that all Copilot+ PCs would have Pluton enabled by default.

What's being given up now is exactly this direct-push capability.

Three steps become four, and every link can jam

The TPM stores BitLocker keys, Windows Hello credentials, and device identity. Once it has a vulnerability, the length of the fix path directly determines how quickly you can be secure again.

When Pluton doubled as the TPM, the chain was only three steps: Microsoft writes the firmware, Windows Update pushes it to you, done. Switching to fTPM makes it four steps, and every link can jam: the chip vendor writes the firmware, the laptop vendor packages it into a BIOS, you go to the official site and find the download by model, and you flash it manually. While flashing, BitLocker might even prompt for a recovery key.

This isn't hypothetical. In August this year, AMD disclosed two high-severity vulnerabilities in the TPM 2.0 reference code, affecting its own fTPM, and the official word to users was "please contact your OEM to obtain the BIOS update applicable to your product." Translated: the vulnerability is the chip vendor's, the patch waits on the laptop vendor, and the legwork is on you. If you bought a model that got one BIOS release and was never touched again, that hole may just sit there forever.

AMD's fTPM didn't have a great reputation to begin with. In 2022 it caused random stuttering on some Ryzen machines, only fixed by BIOS updates after AGESA 1207; in 2023, researchers at TU Berlin broke AMD fTPM on Zen 2 and Zen 3 with about $200 of hardware and a few hours of physical access.

Microsoft didn't explain a single word

The official document only says it changed, not why. For a project Microsoft led for six years, that's unusual.

There are a few guesses floating around—and I'll flag them as guesses. First, compatibility baggage was heavy: Lenovo's 2022 Ryzen 6000 ThinkPads shipped with Pluton disabled by default; Linux didn't support Pluton's TPM until kernel 6.3, and only because developer Matthew Garrett brute-forced it with zero documentation. Second, responsibility division: Pluton's firmware is written by Microsoft, so vulnerabilities are Microsoft's responsibility; hand it back to the vendors, and responsibility scatters across chip makers and OEMs.

There's also a subtle detail. Microsoft's main Pluton page was updated as recently as May and still says it's "designed to provide TPM functionality," directly contradicting the September footnote. The sloppy edit actually suggests this really was a low-key adjustment.

But don't panic

Nothing's missing—BitLocker, Windows Hello, and the TPM 2.0 threshold all work as usual. Old devices aren't affected either—Microsoft explicitly states that AMD and Qualcomm chips from 2025 and earlier, and devices that shipped with Pluton configured as the TPM, continue to receive full servicing support.

And fTPM doesn't mean insecure. It also runs inside the processor's secure execution environment, and it's actually immune to the CPU-to-TPM bus attack Weston described back then—that risk only exists with a discrete TPM chip. Don't get led astray by "no Pluton means insecure."

Two things you should do

Do this right now: press Win+R, type tpm.msc, and check the TPM manufacturer information. The spec version should be 2.0, and the manufacturer field will tell you who provides this TPM. If it shows a firmware TPM, save your BitLocker recovery key before flashing BIOS in the future.

When buying a laptop in 2026: don't just look at the CPU model. Go to the vendor's support page and search how many BIOS updates this model has received in the past two years—the answer will give you a whole new sense of this machine's security lifespan.

Six years ago, Microsoft said Pluton would solve the TPM patching problem. Six years later, it handed that problem back to the entire industry, and wrote it into a single footnote.

On your current computer, who's managing the TPM?

Image placement (body text 1241 words, excluding this section)

• figure-1.png: place at the end of the section "# What was given up is exactly the selling point from back then," to wrap up the six-year timeline
• figure-2.png: place at the start of the section "# Three steps become four, and every link can jam," giving the conclusion before expanding
• figure-3.png: place at the start of the section "# Two things you should do"
• cover.png: 1280×720, headline cover slot