Why Windows 11 requires TPM chips

“The Trusted Platform Module (TPM) is a chip that is either integrated into your PC’s motherboard or added separately into the CPU,” explained David Weston, Director of Enterprise and OS Security at Microsoft, in a blog post. “Its purpose is to help protect encryption keys, user credentials, and other sensitive data behind a hardware barrier so that malware and attackers can’t access or tamper with that data,” he added.

TPMs are actually already built into most enterprise-class PCs today, though they are often referred to by different names. They are used to encrypt data on a PC and prevent certain forms of cyber attacks. Chips like these have existed since 2011, so most high-end PCs already use them as an industry standard. However, very cheap PCs, especially like the ones sold in India do not.

The rationale seems simple — a PC that may be used for work or enterprise use cases needs this chip. But Microsoft is changing that, saying any Windows 11 user should at least have access to such a chip. “PCs of the future need this modern hardware root-of-trust to help protect from both common and sophisticated attacks like ransomware and more sophisticated attacks from nation-states,” Weston said in his post. “Requiring the TPM 2.0 elevates the standard for hardware security by requiring that built-in root-of-trust,” he added.

But adding such a requirement could make it more difficult to produce affordable PCs. Shen Ye, Senior Director of Global Head of Hardware Products at HTC Vive, questioned Microsoft’s move on Twitter. “Microsoft, can you not impose a TPM requirement during a silicon shortage? Especially considering most desktop motherboards support TPM only as a purchasable accessory,” he wrote.

“I work at Microsoft (not on Windows), and I think the TPM requirement is stupid for upgrading users. For new PCs/motherboards, it should be included. But for older hardware, why pull another Vista at the worst time?” another Twitter user wrote.

Users were also confused about which version of TPM will be required for Windows 11. A Microsoft webpage for Windows 11 requirements originally said it required TPM 2.0, but it was later clarified that TPM 1.2 and above will work.