A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Microsoft Passport for Work. If you disable this policy setting, all devices provision Microsoft Passport for Work using software even if there is a usable TPM. If you do not configure this policy setting, all devices provision Microsoft Passport for Work using software if the TPM is non-functional or unavailable. Countermeasure: Configure this setting depending on your organization's requirements. Potential Impact: Only devices with a usable TPM can provision Microsoft Passport for Work. Fix: (1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsMicrosoft Passport for WorkUse a hardware security device (2) REG: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftPassportForWork!RequireSecurityDevice

[enable/disable]

(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Microsoft Passport for Work\Use a hardware security device (2) REG: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork!RequireSecurityDevice