Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Hardware Security Module for All
Transcript
- Lucas: Microsoft has quietly added a new hardware requirement to the Windows 11 Enterprise feature set, and this one is going to land differently for IT departments than the TPM mandate did a few years ago. I'm talking about the mandate for a hardware security module — an HSM — on every enterprise-managed Windows 11 device. Luna: Okay, hold on. I know what a TPM is — it's the chip on the motherboard that stores encryption keys. But an HSM? Isn't that the same thing? Or is this a separate piece of hardware? Lucas: Great question. A TPM and an HSM do similar jobs — they store cryptographic keys — but they differ in tamper resistance and certification. A TPM is a low-cost chip soldered to the motherboard, designed to meet TCG specifications. An HSM is a dedicated, often removable device that meets much stricter standards — FIPS 140-2 Level 3 or higher, sometimes Level 4. It's physically hardened against probing, side-channel attacks, and even chemical etching. Luna: So an HSM is basically a TPM on steroids, with a much higher price tag. What's driving Microsoft to mandate it now? Lucas: That's the key question. The mandate appears in a Microsoft security baseline update posted on June 15, 2026, under the heading 'Hardware Security Module for Enterprise Key Storage'. The language says that as of December 31, 2026, all Windows 11 Enterprise devices must have either a dedicated HSM or a tpm backed virtual HSM to store credentials for BitLocker, Windows Hello for Business, and Azure AD certificate-based authentication. Luna: So it's not a blanket 'every device must have an HSM' — there's a virtual HSM option that uses the TPM. That's a big distinction. What's a virtual HSM? Lucas: A virtual HSM is a software-based module that runs in a secure enclave, backed by the TPM for key material encryption. It's included in Windows 11 Enterprise at no extra cost. Microsoft's documentation describes it as meeting FIPS 140-2 Level 2, which is a step up from the TPM alone but not as strong as a dedicated hardware HSM at Level 3 or 4. The virtual HSM is intended for standard enterprise devices. The dedicated HSM is for high-value endpoints like domain controllers, certificate authorities, or executive laptops. Luna: Makes sense. So most organizations will use the virtual HSM. But for those that need the real hardware, what are we talking about cost-wise? Lucas: Dedicated HSMs from Thales or Utimaco run anywhere from $2,000 to $5,000 per device, plus licensing. That's not something you roll out to every employee. But Microsoft is clear: if you have a device that handles certificate authority functions, or if you're storing keys that control access to your entire Azure AD tenant, the dedicated HSM is mandatory. Luna: That's a significant investment. What kind of attack is this meant to stop? Because the TPM has been considered secure for most scenarios. Lucas: The trigger seems to be the Golden Key malware discovered in late 2024. That malware exploited a firmware vulnerability in certain TPM implementations to extract private keys stored in the TPM's non-volatile memory. It specifically targeted BitLocker volume master keys and Windows Hello PIN credentials. The attack was demonstrated at Black Hat 2025 and showed that TPM firmware is not immune to physical attacks if the attacker has local access and the right equipment. Luna: Right. So Microsoft is essentially saying that for high-value keys, the TPM isn't enough anymore. They want a separate, hardened device that can't be read even if the TPM is compromised. Lucas: Exactly. And the mandate also aligns with the FIDO2 and WebAuthn standards, which increasingly require hsm level protection for authentication keys. Microsoft is effectively future-proofing enterprise devices against a class of attacks that we know are coming. Luna: If today's deep dive into the HSM mandate gave you something concrete to think about for your own deployment planning, that's exactly what we're here for. And if it was useful, the way these conversations stay ad-free is listener support at buy me a coffee dot com slash fexingo. It's a low-key way to keep the show independent. Lucas: Absolutely. It's not about perks or rewards — it's about keeping this resource available to IT pros who need it. So if you got value, that's the place. Now, back to the implementation timeline. Luna: Yeah, let's talk about what IT teams need to do before the December 31, 2026 deadline. Is this something they can plan for gradually, or is there a hard cutover? Lucas: Microsoft's baseline document includes a phased schedule. By October 1, 2026, all new Windows 11 Enterprise devices must ship with TPM 2.0 and the virtual HSM feature enabled. By December 31, 2026, existing devices must be upgraded or replaced to meet the requirement. The key enforcement mechanism is the Windows Security Center: devices that don't have a compliant HSM will show a red warning under 'Device Security' and eventually block access to Azure AD joined resources. Luna: So it's a hard block, not just a warning. That's going to create urgency for organizations that haven't upgraded their hardware in three or four years. Lucas: Yes. And there's another wrinkle: the virtual HSM requires the TPM to have firmware version 2.0 or later, with a specific set of PCR banks enabled. Some older TPMs, even version 2.0 chips, don't support the required capabilities. Microsoft has published a compatibility list, but it's not exhaustive. IT teams need to inventory their TPM firmware versions now. Luna: That sounds like a lot of legwork. Are there any exceptions? For example, kiosk devices or IoT endpoints that don't store sensitive keys? Lucas: Good point. The mandate applies to devices that are Azure AD joined or hybrid joined. It does not apply to devices that are only domain joined on-premises without Azure AD. Also, devices that are used exclusively as kiosks or thin clients, with no user sign-in, can be exempted via a Group Policy setting. But Microsoft strongly recommends enabling the virtual HSM anyway, because even kiosks can be used as a pivot point. Luna: So the smart play is to enable it everywhere you can. Let's talk about the practical steps. If I'm an IT admin, what do I do first? Lucas: First, check your current TPM firmware version. Use the Get-Tpm cmdlet in PowerShell. Look for 'SpecVersion' — it should be 2.0 or higher. Then check 'ManufacturerVersion' against Microsoft's compatibility list. If your TPM is on the list, you can enable the virtual HSM by deploying the 'Enable Virtual HSM' policy under Computer Configuration > Administrative Templates > Windows Components > Virtual HSM. Set it to 'Enabled' and target a pilot group first. Luna: And if the TPM isn't compatible? Then what? Lucas: Then you have two options. One: replace the device with one that has a compatible TPM. Two: install a dedicated HSM, like a Thales nShield Connect or a Utimaco SecurityServer, if the device is a high-value endpoint. For most standard desktops, replacement is cheaper. Microsoft's recommendation is to start budgeting now for a hardware refresh cycle that completes by Q4 2026. Luna: That's a tight timeline. It's July 2026 now, so effectively six months. For a large enterprise with thousands of devices, that's a major project. Lucas: Exactly. And there's a cost angle beyond hardware: every device that needs a dedicated HSM will require a procurement process, possibly a security review, and integration with your existing key management infrastructure. The virtual HSM, by contrast, is a simple policy change. So the vast majority of organizations should aim to use the virtual HSM for 95 percent of devices and only buy dedicated HSMs for the handful of systems that genuinely need Level 3 protection. Luna: That's sensible. But I want to push back a little: is this mandate really about security, or is it about pushing organizations toward newer hardware and ultimately to Windows 11? Because the TPM mandate did drive hardware upgrades. Lucas: I think it's both. The security rationale is solid — the Golden Key attack showed a real vulnerability in TPM firmware. But Microsoft also benefits from a faster hardware refresh cycle, which means more devices running the latest Windows 11 features and a smaller support burden for older OS versions. That said, the virtual HSM option means you don't have to buy new hardware if your TPM is compatible. So it's not a pure hardware push. Luna: Fair point. And let's be real: many enterprises are already on a three-year refresh cycle. If they bought devices in 2023 or later, those likely have TPM 2.0 with compatible firmware. So the mandate might not be as disruptive as it sounds. Lucas: Right. The real pain point is for organizations that stretched their hardware to five or six years. Those 2020 or 2021 devices with TPM 2.0 but outdated firmware are the ones that will need attention. Microsoft's compatibility list specifically calls out certain Intel PTT and AMD fTPM versions that don't support the virtual HSM. Luna: So the message is: inventory your TPMs, test the virtual HSM in pilot, and plan for exceptions. That's a manageable project if started now. Lucas: Absolutely. And there's a silver lining: once the virtual HSM is enabled, you get stronger protection for BitLocker keys, Windows Hello credentials, and Azure AD certificates. That reduces the risk of lateral movement after a device compromise. In a world where ransomware gangs are getting better at exfiltrating credentials, that's a meaningful improvement. Luna: I think this is one of those mandates that, while it creates work, actually makes enterprises more resilient. And Microsoft's phased approach gives IT teams a clear path. Lucas: One final point: the mandate also impacts how you manage recovery keys. With the virtual HSM, BitLocker recovery keys are generated and stored in the HSM's secure storage, not in Active Directory or Azure AD. That changes your key recovery process. Make sure your helpdesk understands how to access hsm backed recovery keys through the Windows Recovery Environment. Luna: That's a critical operational detail. Thanks for flagging it. So we've covered the what, the why, the cost, and the implementation steps. Anything else IT pros should know? Lucas: Only that Microsoft is hosting a series of webinars this month on the topic. The first one is July 15, 2026, and it covers the virtual HSM deployment guide. I'll drop a link in the show notes. Otherwise, start your inventory this week. Luna: Good advice. Thanks, Lucas. And thanks to our listeners for tuning in. We'll be back tomorrow with another Windows 11 deep dive.