The Microsoft Pluton security processor is a chip-to-cloud security technology designed with Zero Trust principles at its core. It offers hardware-based root of trust, secure identity, secure attestation, and cryptographic services. Pluton technology combines a secure subsystem within the System on Chip (SoC) with Microsoft-authored software running on this integrated secure subsystem.
Currently, Microsoft Pluton is available on devices equipped with AMD Ryzen® 6000, 7000, 8000, Ryzen AI, and Qualcomm Snapdragon® 8cx Gen 3 and Snapdragon X series processors. It can be enabled on devices with Pluton-capable processors running Windows 11, version 22H2 and later.
What is Microsoft Pluton?
Microsoft Pluton, designed by Microsoft and built by silicon partners, is a secure crypto-processor integrated into the CPU to ensure core-level security and code integrity. Updates are delivered directly by Microsoft through Windows Update, providing the latest protection. Pluton safeguards credentials, identities, personal data, and encryption keys, making it significantly harder for attackers to remove information, even with malware installation or complete physical possession of the PC.
Pluton is designed to provide Trusted Platform Module (TPM) functionality while delivering additional security features beyond the TPM 2.0 specification. This allows for the continuous delivery of Pluton firmware and OS features via Windows Update. For more details, refer to Microsoft Pluton as TPM.
Built on proven technology from Xbox and Azure Sphere, Pluton offers robust, integrated security capabilities for Windows 11 devices in partnership with leading silicon manufacturers. For more information, see Meet the Microsoft Pluton processor – The security chip designed for the future of Windows PCs.
How can Pluton help customers?
Pluton is designed to enhance end-to-end security experiences for customers through three key strategies:
Zero-Trust Security and Reliability: Pluton ensures seamless security across devices and cloud services. Windows PCs and services like Microsoft Entra and Intune work together to provide frictionless security. Pluton is developed and maintained in close collaboration with various Microsoft teams to deliver both high security and reliability.
Innovation: The Pluton platform is informed by customer feedback and Microsoft’s threat intelligence. For instance, in 2024, Pluton platforms in AMD and Intel systems will start using a Rust-based firmware foundation, emphasizing memory safety.
Continuous Improvement: Pluton supports the loading of new firmware through operating system updates, in addition to the traditional UEFI capsule updates. This capability allows for continuous improvements, including bug fixes and new features, by dynamically loading valid new Pluton firmware through OS updates.
A practical example: zero-trust security with device-based conditional access policies
An increasingly critical zero-trust workflow is conditional access, which controls access to resources such as SharePoint documents by verifying if requests originate from valid, secure sources. Microsoft Intune supports various conditional access workflows, including device-based conditional access, allowing organizations to enforce policies that ensure managed devices are healthy and compliant before accessing apps and services.
To ensure Intune accurately assesses a device's health as part of these policies, tamper-resistant logs on the state of relevant security capabilities are essential. This is where hardware security becomes crucial, as malicious software on the device might attempt to provide false signals. A core benefit of hardware security technologies like TPM (Trusted Platform Module) is their ability to maintain a tamper-resistant log of the system's state. Services can cryptographically validate that the logs and associated system state reported by the TPM are genuinely from the TPM.
For successful large-scale deployment of this end-to-end scenario, hardware-based security alone isn't sufficient. Since access to enterprise assets hinges on security settings reported by TPM logs, these logs must be reliably available. Zero-trust security fundamentally requires high reliability.
When Pluton is configured as the system's TPM, customers using conditional access benefit from Pluton's security architecture and implementation. This advantage is enhanced by the reliability derived from the tight integration and collaboration between Pluton and other Microsoft components and services.
Firmware load flow
During system boot, Pluton hardware initializes by loading its firmware from the Serial Peripheral Interface (SPI) flash storage on the motherboard. However, once Windows starts up, the operating system uses the latest version of the Pluton firmware. If no newer firmware is available, Windows continues using the firmware loaded during hardware initialization. The following diagram illustrates this process:
Find out more here.