Applies ToSurface Pro (1st Gen) Surface Pro 2 Surface Pro 3 Surface 3

Early Surface devices use a standard basic input/output system (BIOS) instead of the Surface Unified Extensible Firmware Interface (UEFI) found on newer devices. You can use the BIOS to manage the firmware features on your Surface.

For Surface Pro, Surface Pro 2, Surface Pro 3, and Surface 3

Under normal circumstances, there’s no need for you to change BIOS settings. If you change these settings, you risk the security of your Surface. But if you ever need access to the firmware features of your Surface, here's the basic info:

What firmware features can I use?

You can access the following firmware features on any Surface Pro model or Surface 3:

  • Secure Boot Control. Secure Boot technology blocks the loading of uncertified bootloaders and drives.

  • Trusted Platform Module (TPM). TPM technology provides a major advancement over BIOS in hardware-based security features.

How do I get to the BIOS settings?

Video: Get to BIOS settings on a Surface

Your browser does not support video. Install Microsoft Silverlight, Adobe Flash Player, or Internet Explorer 9.

This video is available in English only.

The BIOS settings can be adjusted only during system startup. To load the BIOS firmware settings menu:

  1. Shut down your Surface.

  2. Press and hold the volume-up button on your Surface and at the same time, press and release the power button.

  3. When you see the Surface logo, release the volume-up button. The BIOS menu will display within a few seconds.

BIOS menu options

Which BIOS settings you can modify depends on which Surface model you have.

Surface Pro or Surface Pro 2

  • Trusted Platform Module (TPM) The currently configured state of TPM (Enabled or Disabled) is highlighted. To change the state, select the other one. When you’re finished, select Exit Setup > Yes.

  • Secure Boot Control The currently configured state of Secure Boot (Enabled or Disabled) is highlighted. To change the state, select the other one. When you’re finished, select Exit Setup > Yes.

  • Delete All Secure Boot keys To delete all of the installed Secure Boot keys, including the default ones that were installed with Windows, select Yes. When you’re finished, select Exit Setup > Yes.

    When Secure Boot keys are deleted, Windows displays a red screen during startup.

  • Install Default Secure Boot Keys To reinstall all of the Secure Boot keys that were originally installed with Windows (and only those), select Yes. When you’re finished, select Exit Setup > Yes.

Surface Pro 3

If you enter the administrator password incorrectly three times, you’ll be locked out of the BIOS. Restart your Surface to enter the password again.

  • Trusted Platform Module (TPM) The currently configured state of TPM (Enabled or Disabled) is highlighted. To change the state, select the other one. When you’re finished, select Exit Setup > Yes.

  • Secure Boot Control Select Secure Boot Control to enable or disable this feature. When Secure Boot Control is enabled, you have two additional options:

    • If Secure Boot keys are installed, you can delete them by selecting Delete All Secure Boot Keys.

    • If Secure Boot keys aren't installed, you can select Install All Factory Default Keys and select either Windows & 3rd-party UEFI CA (Default) or Windows only.

  • Configure Alternate System Boot Order To choose the order in which your Surface boots, select Configure Alternate System Boot Order and select one of the following options:

    • SSD only

    • Network > USB > SSD

    • USB > Network > SSD

    • USB > SSD

    • Network > SSD

  • Advanced Device Security This option lets you disable ports and features you don’t want anyone to use. For example, you can disable the microSD card reader so no one can use a microSD card to copy data.

    The current setting appears in bold. Select Advanced Device Security and select the option you want:

    Selecting Side USB disables the ability to boot from a USB device. The USB port remains enabled in Windows.

    Disabling Wi-Fi also disables the Bluetooth®.

    • Network Boot

    • Side USB

    • Docking Port

    • Front Camera

    • Rear Camera

    • OnBoard Audio

    • microSD

    • WiFi

    • Bluetooth

  • Device Information This option displays your Surface’s universally unique identifier (UUID) and serial number.

  • Administrator Password This option lets you create a password to prevent others from changing the BIOS settings. Organizations that need to protect sensitive information typically use an administrator password.

  • Exit Setup

    • Save and exit. To save your changes and exit, select Exit Setup > Yes.

    • Exit without saving. To exit without saving your changes when you’re using a Surface Typing Cover, press Esc and select Yes. If you aren’t using a Cover, press the power button.

Surface 3

  • Trusted Platform Module (TPM) The currently configured state of TPM (Enabled or Disabled) is highlighted. To change the state, select the other one. When you’re finished, select Exit Setup.

  • Secure Boot Control Select Secure Boot Control to enable or disable this feature. While Secure Boot Control is enabled, you have the following additional option:

    • If Secure Boot keys are installed, you can delete them by selecting Delete All Secure Boot Keys.

  • Configure Alternate System Boot Order To select the order in which your Surface boots, select Configure Alternate System Boot Order and select one of the following options:

    • SSD Only

    • Network > USB > SSD

    • USB > Network > SSD

    • USB > SSD

    • Network > SSD

  • Administrator Password

    This option lets you create a password to prevent others from changing the BIOS settings. Organizations that need to protect sensitive information typically use an administrator password.

  • Exit Setup

    • Save and exit. To save your changes and exit, select Exit Setup > Yes.

    • Exit without saving. To exit without saving your changes when you’re using a Surface Typing Cover, press Esc and select Yes.

Related topics

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Find solutions to common problems or get help from a support agent.