Starting with chips released in 2026, Microsoft’s Pluton security processor won’t act as the Trusted Platform Module (TPM) on AMD and Qualcomm PCs. Windows 11 will instead use the chipmaker’s firmware TPM or a separate TPM chip, and Microsoft also lists Intel PCs under that arrangement. Pluton will be inside these processors for other security work, and PCs already using Pluton as the TPM will keep getting updates.
BitLocker and Windows Hello will work as usual. However, the change is in who fixes your TPM if (or when) an unthinkable security flaw shows up.
Microsoft confirms Pluton won’t be the TPM on 2026 AMD and Qualcomm chips
Microsoft added the change as a note to its Pluton as TPM documentation, which was last updated on September 16.
“Beginning with 2026 silicon, Microsoft Pluton no longer serves as the TPM on AMD and Qualcomm platforms. On these platforms, as well as on Intel, TPM 2.0 functionality is instead delivered through the vendor’s firmware TPM (fTPM) or a discrete TPM.”
Some reports mentioned it as Pluton losing its TPM role on Intel too, but Microsoft names only AMD and Qualcomm for the change. Intel’s Core Ultra 200V and Core Ultra Series 3 chips have Pluton, while Intel PCs typically get TPM 2.0 from Intel’s own firmware TPM, called Platform Trust Technology (PTT), or a discrete chip.
The company hasn’t explained the decision, and it hasn’t listed which chips count as “2026 silicon.” For example, Snapdragon X2 laptops were unveiled at CES 2026, but Qualcomm announced the chips in September 2025.
Ironically, Microsoft’s main Pluton page, updated in May, still says “Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM).”
Windows 11 still requires TPM 2.0, and a firmware TPM can meet it
A TPM is a tamper-resistant security module that stores the keys protecting your PC. When BitLocker encrypts your drive or Windows Hello signs you in with a PIN or your face, the keys are kept in the TPM, so, theoretically, malware can’t easily copy them. The TPM also helps confirm that nobody tampered with the boot process before Windows unlocks your drive.
Windows 11’s minimum requirements still list “Trusted Platform Module (TPM) version 2.0,” and Microsoft called it a non-negotiable standard in late 2024.
According to Microsoft’s TPM recommendations, TPM 2.0 comes in three forms. A discrete TPM is a separate chip on the motherboard, an integrated TPM is built into a chip package but kept logically separate, and a firmware TPM runs in a trusted execution environment on the processor.
Windows doesn’t pick favorites. “Windows uses any compatible TPM in the same way. Microsoft doesn’t take a position on which way a TPM should be implemented,” the company says, while also admitting that “There are variations in the security properties of different TPM implementations.”
To see which TPM your PC uses, press Win + R, type tpm.msc, and look under TPM Manufacturer Information. Microsoft says the Specification Version should show 2.0, and the Manufacturer Name field shows the vendor.
Pluton isn’t going away, and current Pluton PCs keep their TPM
Microsoft’s note confirms that existing laptops aren’t affected:“Devices built on 2025 or earlier AMD and Qualcomm silicon that ship with Pluton configured as the TPM remain fully serviced and supported.”
“The Pluton security processor will continue to be present and supported on existing and future Windows devices to provide a hardware isolated security environment for Windows,” Microsoft added.
Microsoft announced Pluton with AMD, Intel and Qualcomm in November 2020. Microsoft’s David Weston, now Corporate Vice President of AI Security, explained that attackers with physical access can “target the communication channel between the CPU and TPM,” and Pluton’s design “removes the potential for that communication channel to be attacked.” Pluton PCs “will first emulate a TPM,” Weston wrote at the time, and the design borrowed from Microsoft’s work on the Xbox One and Azure Sphere.
By May 2024, Microsoft said Pluton “will be enabled by default on all Copilot+ PCs.”
Losing Pluton as the TPM changes how your PC gets security fixes
Pluton’s big selling point was updates. Microsoft says it “allows for other Pluton firmware and OS features to be delivered over time via Windows Update,” and at startup, Windows loads newer Pluton firmware if it has one.
A firmware TPM is part of the chipmaker’s firmware, so usually, fixes come as a BIOS update from your PC maker. In August, AMD disclosed two high-severity flaws in the TPM 2.0 reference code that affect its firmware TPMs, and told users to “contact your OEM for the BIOS update specific to your product(s).” If your laptop maker is slow with BIOS updates, your TPM could be unpatched for longer.
AMD’s fTPM has a bad reputation, too. In 2022, it caused random stutters on some Ryzen PCs, and the fix came through BIOS updates with AGESA 1207 or later. A year later, TU Berlin researchers broke AMD’s fTPM on Zen 2 and Zen 3 processors with about $200 of hardware and several hours of physical access.
If you install a BIOS update, keep your BitLocker recovery key handy, as firmware changes can trigger the BitLocker recovery screen.
Then again, Pluton came with compatibility baggage. Lenovo shipped its 2022 Ryzen 6000 ThinkPads with Pluton disabled by default, and Linux needed kernel 6.3 to support Pluton’s TPM, after developer Matthew Garrett added support without any documentation.
A firmware TPM also runs inside the processor, so it isn’t exposed to the CPU-to-TPM bus attacks Weston described. However, a discrete TPM chip is vulnerable.
In my opinion, Microsoft gave up a core part of the Pluton pitch in a documentation note, with further explanation. If you’re buying a 2026 AMD or Snapdragon laptop, check how often its maker gives BIOS updates. Who would you trust to patch your TPM: Microsoft or your laptop maker?
