What it is
A TPM chip is a small security component on a laptop motherboard. It stores cryptographic keys and runs a limited set of crypto operations in its own protected memory. The operating system can ask it to create keys, seal data, sign measurements, or prove device identity. It cannot browse files or scan for malware.
Current business laptops use TPM 2.0. Windows 11 requires it. The chip can be a discrete part with its own silicon, or a firmware TPM built into the CPU and chipset, such as Intel Platform Trust Technology or AMD fTPM. Both present a TPM 2.0 interface to Windows. A discrete TPM keeps keys in separate hardware; a firmware TPM depends on the platform firmware and CPU. For most office laptops, either works if it is enabled and covered by your recovery process.
How it works
On first setup, the TPM creates an endorsement key and a storage root key. It also records measurements of firmware, bootloader, and early OS code into platform configuration registers, or PCRs. When a secret is sealed to the TPM, it can be tied to those measurements. If the boot chain changes, the TPM refuses to release the secret.
BitLocker uses that behavior. The TPM protects the volume master key, so the disk decrypts during a normal boot without a USB key. For higher-risk roles, you can add a preboot PIN. Windows Hello stores private keys in the TPM and uses a local PIN or biometric to approve use. Secure Boot checks signatures, and the TPM records what loaded. Measured Boot writes a log that management tools can read.
The TPM is not a vault for files. It has tiny nonvolatile storage for keys and counters. It does not stop an attacker already logged in with admin rights. Its job is to protect keys at rest, bind credentials to a device, and give management systems a trusted report about boot state. TPM attestation lets Intune or another MDM check that a device booted with the expected firmware and security settings.
Why it matters for a business
Without a TPM, full disk encryption becomes a logistics problem. BitLocker can use a startup password or a USB key, but staff lose keys and forget passwords. A TPM lets the laptop boot normally while the disk stays encrypted. If the laptop is stolen and the attacker does not know the PIN or account password, the data stays locked.
A TPM also makes passwordless sign-in practical. Windows Hello for Business issues a key pair protected by the TPM. The private key does not leave the device. A phishing page can capture a password, but it cannot use that key without the local PIN or biometric. You can require TPM-backed sign-in for admins and finance staff, then keep passwords for legacy systems that need them.
For IT, the TPM gives you a device identity you can check. Compliance policies in Intune can require TPM 2.0, Secure Boot, and BitLocker before a laptop reaches email or line-of-business apps. Certificate enrollment can bind to the TPM so a copied certificate file is less useful. During disposal, clearing the TPM and wiping the disk removes the keys that protected the old data.
Common mistakes
The most common mistake is assuming a TPM is active because the laptop spec sheet lists one. Many machines ship with the TPM disabled in UEFI, or with a firmware TPM turned off after a board replacement. Check tpm.msc in Windows, or run Get-Tpm in PowerShell. Look for TPM 2.0 and a status of Ready.
The second mistake is clearing a TPM without a recovery plan. Clearing destroys sealed keys, so BitLocker volumes can lock and Windows Hello credentials stop working. Keep BitLocker recovery keys in Entra ID, Active Directory, or a controlled vault. Suspend BitLocker before firmware updates or TPM changes, then confirm the key escrow record before you reboot.
Teams also treat the TPM as malware protection. It does not clean an infected system or block a bad driver. It protects keys and reports boot state. A stolen laptop with a TPM and no PIN still depends on the OS account security and the encryption key escrow process. Used laptops need a TPM clear and a fresh Windows install.
How to get started
Start with an inventory. For each Windows laptop, record TPM version and status, Secure Boot state, BitLocker status, and recovery key escrow. Run Get-Tpm, Confirm-SecureBootUEFI, and manage-bde -status at the desk, or pull the same fields from Intune. Add the results to your asset register so you can see old TPM 1.2 machines before a Windows 11 refresh.
Set a BIOS and UEFI standard. Enable TPM 2.0 and Secure Boot, set an admin password, and disable boot from external media unless a role needs it. Put those settings in your build image and in the handover checklist for every new laptop. Test one model end to end: enable BitLocker, escrow the key, clear the TPM, and recover the disk. That test tells you more than a spec sheet.
Make TPM 2.0 and Secure Boot part of the laptop standard you buy. Ask the supplier to confirm the settings and provide recovery media. For a mixed fleet, you can run this review in house, ask your supplier for a configuration report, or use the Hardware and endpoint review from Cloudverg at $4,500/month; it inventories endpoints and produces a device standard and refresh plan. Keep the TPM and recovery records current as devices move between staff.
Frequently asked questions
Does a laptop need a TPM chip to run Windows 11?
Windows 11 requires TPM 2.0. Most business laptops have a TPM 2.0 device built in, but it may be disabled in the UEFI settings. Check tpm.msc or Get-Tpm before you buy or rebuild a machine.
Is a firmware TPM as good as a discrete TPM chip?
Both meet the TPM 2.0 specification and support BitLocker, Windows Hello, and device attestation. A firmware TPM runs in the CPU and platform firmware; a discrete TPM is a separate chip. Choose based on your threat model, vendor support, and firmware update history.
What happens if I clear the TPM?
Clearing the TPM destroys sealed keys, so BitLocker volumes may lock until you enter the recovery key. Windows Hello credentials tied to the TPM stop working and must be enrolled again. Save the recovery key and suspend BitLocker before any firmware change.