Do you need to buy a TPM module? Discrete, integrated and firmware TPM, and what actually requires one
Desktop motherboards carry a TPM header, modules are sold to plug into it, and the CPU side offers fTPM on AMD or Intel PTT. Which should you use? Microsoft's answer is unusually direct: Windows uses any compatible TPM in the same way, and Microsoft does not take a position on how a TPM should be implemented. This guide was written on 2026-09-21 from Microsoft's TPM recommendations and covers the three implementations, the most common reason a TPM appears to be missing, and which features genuinely require one. No module was tested here and none is recommended.
Published · Updated · FaultNote editorial policy
Who this guide is for and what to prepare
- People looking at a TPM header and wondering whether to buy the module
- People who found fTPM or Intel PTT in their UEFI and want to know whether enabling it is enough
- People told a TPM cannot be found, who want the likely causes before buying anything
What you need
- Run tpm.msc on Windows and note whether a TPM and a specification version appear — this is read-only
- Look in UEFI (BIOS) setup for entries named fTPM, AMD fTPM, Intel PTT or Security Device Support
- If the machine is encrypted, confirm where the recovery key is before changing any firmware setting
1. There are three implementations, and Windows does not distinguish between them
Microsoft's TPM recommendations lists them: There are three implementation options for TPMs: Discrete TPM chip as a separate component in its own semiconductor package. Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components. Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit.
A separate chip (dTPM); dedicated hardware sharing a package with other components but logically separate from them (integrated); and firmware running in the trusted execution mode of a general purpose computation unit (fTPM).
Then comes the sentence that settles the question this guide is named after: Windows uses any compatible TPM in the same way. Microsoft doesn't take a position on which way a TPM should be implemented and there's a wide ecosystem of available TPM solutions, which should suit all needs.
So this guide will not tell you that a discrete TPM is more secure. Microsoft does not say so. The practical reading is that if the CPU or board offers fTPM or Intel PTT, enabling it is enough — but that reading is this guide's interpretation of the sentence above, not a sentence Microsoft wrote.
2. When a TPM cannot be found, the usual cause is the BIOS mode
Something to check before buying anything is on the same page: TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled.
That is explicit. A machine can have the hardware and still not present it, because of a firmware setting.
But the order matters, and the page warns about it: Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool MBR2GPT before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
This guide gives no MBR2GPT steps. It is an operation whose own documentation states the machine will stop booting if the order is wrong, and nothing here was reproduced on hardware. If you go ahead, read Microsoft's page directly, and first back up anything important and confirm where the recovery key is if the drive is encrypted — this site covers that check separately.
3. Whether a TPM is required depends on the feature
Microsoft publishes a per-feature table. The rows below are the ones that bear on home and personal use; the full table has more, and it is on the source page.
The row that matters most here is that BitLocker and Device Encryption are separate entries. BitLocker does not require a TPM. Device Encryption does — and it comes with a condition attached.
Scroll horizontally to see the full table →
| Feature | TPM required | Microsoft's detail, summarised |
|---|---|---|
| BitLocker | No | TPM 1.2 or 2.0 supported, 2.0 recommended. The same row states that Device Encryption requires Modern Standby including TPM 2.0 support |
| Device Encryption | Yes | Stated to require Modern Standby/Connected Standby certification, which requires TPM 2.0 |
| Windows Hello / Hello for Business | No | TPM 2.0 recommended over 1.2 for performance and security; Windows Hello as a FIDO platform authenticator takes advantage of TPM 2.0 for key storage |
| Measured Boot | Yes | Requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 1.2 only supports SHA-1, which is being deprecated |
| System Guard (DRTM) | Yes | TPM 1.2 is not supported. TPM 2.0 and UEFI firmware are required |
| Credential Guard | No | 1.2 and 2.0 are both supported, but Windows 11 requires TPM 2.0 by default |
| UEFI Secure Boot | No | A separate requirement from the TPM |
4. Three things to check before buying a module
Turning the above into a purchase decision gives three checks, in order.
Most people stop at the first one, which is the practical point of this guide. If UEFI offers fTPM or Intel PTT, the question is already answered.
Scroll horizontally to see the full table →
| Order | Where to look | What it settles |
|---|---|---|
| 1. Does the CPU or board offer fTPM / PTT | The security section of UEFI setup (AMD fTPM, Intel PTT, Security Device Support) | If it is there, enabling it is enough. Microsoft ranks no implementation above another |
| 2. Is the BIOS mode UEFI, with CSM disabled | The boot section of UEFI setup, and BIOS Mode in Windows System Information | TPM 2.0 is stated to be unsupported in Legacy and CSM modes |
| 3. Does the header match the module | The board manual and the maker's compatibility list | Header pinouts are board-specific. No compatibility list was read here, so no part number is named |
| (A separate question) Is the CPU on the Windows 11 supported list | Microsoft's processor lists, or the PC maker's guidance | Adding a TPM does not satisfy the requirement if the CPU is not listed. That is a different check |
5. 1.2 against 2.0, and the July 2016 line
On the difference between versions, the same page points at cryptographic agility: the TPM 1.2 specification allows only RSA and SHA-1, while TPM 2.0 supports newer algorithms. It also carries the caveat that not every TPM supports every algorithm.
There is a date worth knowing: Since July 28, 2016, all new device models, lines, or series (or if you're updating the hardware configuration of an existing model, line, or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0, followed by The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. It is a requirement on making new devices, not a retroactive one on machines you already own.
The specification itself is published by the Trusted Computing Group and standardised as ISO/IEC 11889. This guide did not read that standard; it is cited as what the source page states.
0Limitations and requirements
- Buying a TPM module does not, on its own, satisfy the Windows 11 requirement. If the CPU is not on the supported list, that is a separate problem, covered by this site's guide to checking a used machine.
- Microsoft states that changing the BIOS mode on a machine whose OS was installed in legacy mode will stop it booting. This guide gives no MBR2GPT steps. Back up first, and confirm the recovery key if the drive is encrypted.
- Do not clear the TPM casually. With an encrypted drive present, there is no way back without the recovery key.
- This guide says nothing about individual fTPM defect reports. Check your motherboard maker's current BIOS notes.
Frequently asked questions
My board has a TPM header. Should I buy the module?
Check UEFI setup for fTPM or Intel PTT first. Microsoft states that Windows uses any compatible TPM the same way and takes no position on how one should be implemented, so no ranking between implementations can be drawn from the source.
tpm.msc finds no TPM. Is the hardware broken?
It can be a setting. Microsoft states that TPM 2.0 is not supported in Legacy and CSM modes of the BIOS, and that the BIOS mode must be Native UEFI only with CSM disabled. Check the BIOS mode before concluding anything about the hardware.
Can I just switch the BIOS mode to UEFI?
If the OS was installed in legacy mode, Microsoft states the machine will stop booting, and the same page says to use MBR2GPT before changing the mode. This guide does not give those steps. Back up and confirm the recovery key first.
Does BitLocker require a TPM?
In Microsoft's per-feature table the TPM Required column for BitLocker is No. Device Encryption is Yes, and is stated to require Modern Standby/Connected Standby certification, which requires TPM 2.0. Two kinds of encryption, two different conditions.
Will adding a TPM module make an old PC eligible for Windows 11?
This guide does not say so. The TPM is one requirement among several, and whether the CPU is on the supported list is a separate check. Header pinouts are also board-specific, and no compatibility list was read here.
Sources and verification date
Sources checked: . These sources support the specifications, procedures or prices discussed here. Check each source for applicable conditions and current information.
Related practical guides
- Windows 11 runs but the feature is missing: checking the per-feature requirements before you buy
- Before buying a used business PC: how to read Windows 11's supported-CPU lists, and what "activated" does not prove
- How to Choose a USB-C Cable: 60W vs 240W Power Marks, 10Gbps to 80Gbps Data Rates and Video Output by Use
- What a quoted battery run time actually measures: reading JEITA-BAT 3.0 figures
- A self-encrypting SSD is not automatically an encrypted hard drive for Windows
- GPU value ranking, September 2026: ten models at Japanese retail prices