Windows enrollment attestation

The goal of Windows enrollment attestation is to make devices more secure and trustworthy within the network they join. With this feature, you can check that Windows 10 and 11 devices meet strict security standards during enrollment, using Trusted Platform Module (TPM) technology to enhance their defense against threats. The Windows enrollment attestation feature also confirms and reports on the devices that enroll securely, ensuring the process is reliable.

Here’s how it benefits organizations:

Improved security: TPM attestation helps detect and address security weaknesses or compromised devices and lowers the chance of unauthorized access or security incidents.

Meeting regulatory standards: Windows attestation helps organizations prove they follow strict security measures during device enrollment, which is important for meeting industry regulations and compliance requirements.

The main goal is to establish a more secure and trusted environment for devices within the organizational infrastructure by using Windows attestation during the enrollment process.

Requirements for Windows enrollment attestation

We recommend using the latest updates for a more successful attestation rate.

• Windows 10

  • 10.0.19045.3996+

• Windows 11

  • 10.0.22000.2713+
  • 10.0.22621.2792+
  • 10.0.22631.2792+

• Minimum TPM 2.0 on devices

• Physical devices are supported.

  Note

  Virtual machines can't attest, including the following, even if they use vTPMs:

  • Hyper-V and Azure virtual machines
  • Azure Virtual Desktop session hosts
  • Windows 365 Cloud PCs
  • Microsoft Dev Box

• Attestation with TPM in this feature is during Intune device management enrollment, after the TPM attestation that occurs in Autopilot pre-provision and Shared device mode (SDM).

• List of applicable Configuration Service Providers (CSPs) for Windows attestation:

  • Windows InitiateRecovery CSP
  • Windows RecoveryStatus CSP
  • Windows MDMClientCertAttestation CSP

How Windows enrollment attestation works

Device attestation status report

The report shows information about the device, its TPM, and whether the device successfully attested on enrollment. If a device doesn’t attest, the report explains why in the Status details section. Use this report to see the full list of devices and check which ones successfully attested on enrollment.

To access this report:

1. Sign in to the Microsoft Intune admin center.

2. Select Reports > Device attestation status (preview) under the Device Management section.

3. Filter by Attestation status or Ownership type and select Generate report.

   

After the report is generated, The top-level details that you see include:

• Device name

• Device ID

• UPN

• Device attestation status

• Status detail

• OS

• OS version

• Ownership

• Last check-in

• Enrollment date

• TPM version

• TPM manufacturer

• Model

By selecting an entry, you can find more detailed information about the device. You can also select an entry using the left-hand Select column and re-attest using the Attest device action at the top of the report.

The following table lists status details and their descriptions:

Attest device action

If you see devices in the report that have Not started TPM attestation, you can select a few of those devices at a time and TPM attest them using the new device action Attest device at the top of the report. This device action should take less than a few minutes to attest the device and is reflected in the report when you Refresh.

To attest some Not Started devices:

1. Use the drop-down filters at top of report to filter to Not Started attestation status.

2. Select Generate again. From there, select a few devices and then select Attest device action at the top of the report.

3. Attestation can take up to 15 min depending on activity of device and number of devices selected. Refresh after some time to see the updated status of the selected devices.

If devices are failing attestation, depending on the value in the Status detail column, you can retry attestation using the Attest device action. If any of the following Status details appear, we recommend re-attempting the Attest device action.

• AIK certificate wasn't provided by client

• Attestation is in process

• MDM key is already in TPM

• TPM isn't ready

• Authentication failed

• Client didn't provide all required parameters needed for attestation

• Entra token does not match device identity

Permissions for device action

To use the Attest device device action, you require a role based permission known as Remote tasks: Indicates mobile device management (MDM) attestation if device is capable for it. Set the Permission to yes to enable the action. With the permission set to Yes, IT admins can initiate Attest device action.

Resources

• TPM recommendations - Windows Security | Microsoft Learn

• Intune reports

• How to update Firmware

• Troubleshoot the TPM - Windows Security | How to reset TPM ownership

Additional links:

• TrustedPlatformModule

• Enable TPM 2.0 on your PC