You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Device firmware configuration interface settings for Windows 10/11 in Microsoft Intune
5
+
description: See a list of all the DFCI profile settings and their descriptions on Windows 10/11 client devices. Use these settings in a configuration profile to control UEFI firmware layer features using Microsoft Intune policy. You can manage the CPU, built-in hardware, and boot options on Windows 10/11 client devices using Microsoft Intune.
6
+
keywords:
7
+
author: MandiOhlinger
8
+
ms.author: mandia
9
+
manager: dougeby
10
+
ms.date: 05/02/2022
11
+
ms.topic: conceptual
12
+
ms.service: microsoft-intune
13
+
ms.subservice: configuration
14
+
ms.localizationpriority: medium
15
+
ms.technology:
16
+
17
+
# optional metadata
18
+
19
+
#ROBOTS:
20
+
#audience:
21
+
22
+
ms.reviewer: madakeva
23
+
ms.suite: ems
24
+
search.appverid: MET150
25
+
#ms.tgt_pltfrm:
26
+
ms.custom: intune-azure;
27
+
ms.collection:
28
+
- M365-identity-device-management
29
+
- highpri
30
+
---
31
+
32
+
# Device Firmware Configuration Interface (DFCI) profile settings in Microsoft Intune
This article lists and describes the DFCI profile settings you can control on Windows client devices. As part of your mobile device management (MDM) solution, use these settings to control security features, the built-in hardware, and the boot options in the UEFI layer on Windows.
38
+
39
+
These settings apply to:
40
+
41
+
- Windows 11 on supported UEFI
42
+
- Windows 10 RS5 (1809) and later on supported UEFI
43
+
44
+
These settings are added to a device configuration profile in Intune, and then assigned or deployed to your Windows client devices.
45
+
46
+
## Before you begin
47
+
48
+
-[Create the Windows 10/11 DFCI profile](device-firmware-configuration-interface-windows.md). There are more requirements to creating DFCI profiles. For more specific information, go to [Use DFCI profiles on Windows devices in Microsoft Intune](device-firmware-configuration-interface-windows.md).
49
+
- These settings use the [UEFI CSP](/windows/client-management/mdm/uefi-csp).
50
+
51
+
## Security features
52
+
53
+
-**Allow local user to change UEFI settings**: Your options:
54
+
-**Only not configured settings**: The local user can change any setting *except* those settings explicitly set to **Enable** or **Disable** by Intune.
55
+
-**None**: The local user may not change any UEFI (BIOS) settings, including settings not shown in the DFCI profile.
56
+
57
+
-**CPU and IO virtualization**: Your options:
58
+
-**Not configured**: Intune doesn't change or update this setting.
59
+
-**Enabled**: The BIOS enables the platform's CPU and IO virtualization capabilities for use by the OS. It turns on Windows Virtualization Based Security and Device Guard technologies.
60
+
61
+
-**Windows Platform Binary Table** (WPBT): The WPBT allows vendors and OEMs to run an `.exe` program in the UEFI layer. Every time Windows boots, it looks at the EUFI, and runs the `.exe`. It's used to run programs that aren't included with the Windows media.
62
+
63
+
Your options:
64
+
-**Not configured**: Intune doesn't change or update this setting. By default, the OS might allow vendors and OEMs to run programs using the WPBT.
65
+
-**Enabled**: Enables the WPBT and allows `.exe` programs in the UEFI layer to run.
66
+
-**Disabled**: Disables the WPBT and prevents `.exe` programs in the UEFI layer from running.
67
+
68
+
-**Simultaneous multithreading** (SMT): Also known as hyper-threading. Your options:
69
+
-**Not configured**: Intune doesn't change or update this setting.
70
+
-**Enabled**: Enables SMT in the UEFI layer.
71
+
-**Disabled**: Disables SMT in the UEFI layer.
72
+
73
+
## Built-in Hardware
74
+
75
+
These settings manage the hardware components built into the devices. They don't manage attached peripherals, such as USB webcams.
76
+
77
+
-**Cameras**: Your options:
78
+
-**Not configured**: Intune doesn't change or update this setting.
79
+
-**Enabled**: All built-in cameras directly managed by UEFI (BIOS) are enabled. Peripherals, like USB cameras, aren't affected.
80
+
-**Disabled**: All built-in camera directly managed by UEFI (BIOS) are disabled. Peripherals, like USB cameras, aren't affected.
81
+
82
+
-**Microphones and speakers**: Your options:
83
+
-**Not configured**: Intune doesn't change or update this setting.
84
+
-**Enabled**: All built-in microphones and speakers directly managed by UEFI (BIOS) are enabled. Peripherals, like USB devices, aren't affected.
85
+
-**Disabled**: All built-in microphones and speakers directly managed by UEFI (BIOS) are disabled. Peripherals, like USB devices, aren't affected.
86
+
87
+
-**Radios (Bluetooth, Wi-Fi, NFC, etc.)**: Your options:
88
+
-**Not configured**: Intune doesn't change or update this setting.
89
+
-**Enabled**: All built-in radios directly managed by UEFI (BIOS) are enabled. Peripherals, like USB devices, aren't affected.
90
+
-**Disabled**: All built-in radios directly managed by UEFI (BIOS) are disabled. Peripherals, like USB devices, aren't affected.
91
+
92
+
> [!WARNING]
93
+
> If you disable the **Radios** setting, the device requires a wired network connection. Otherwise, the device may be unmanageable.
94
+
95
+
## Boot Options
96
+
97
+
-**Boot from external media (USB, SD)**: Your options:
98
+
-**Not configured**: Intune doesn't change or update this setting.
99
+
-**Enabled**: UEFI (BIOS) allows booting from non-hard drive storage.
100
+
-**Disabled**: UEFI (BIOS) doesn't allow booting from non-hard drive storage, which also disables booting from network adapters.
101
+
102
+
When set to **Disabled**, don't set the **Boot from network adapters** setting to **Enabled**. It causes the **Boot from external media (USB, SD)** setting or **Boot from network adapters** setting to become not compliant.
103
+
104
+
-**Boot from network adapters**: Your options:
105
+
-**Not configured**: Intune doesn't change or update this setting.
106
+
-**Enabled**: UEFI (BIOS) allows booting from built-in network interfaces.
For other technical details on each setting and what editions of Windows are supported, see [Windows 10/11 Policy CSP Reference](/windows/client-management/mdm/policy-configuration-service-provider)
112
+
113
+
[Use DFCI profiles on Windows devices in Microsoft Intune](device-firmware-configuration-interface-windows.md).
114
+
115
+
[Assign the profile](device-profile-assign.md), and [monitor its status](device-profile-monitor.md).
Copy file name to clipboardExpand all lines: memdocs/intune/configuration/device-firmware-configuration-interface-windows.md
+8-41Lines changed: 8 additions & 41 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,12 +2,12 @@
2
2
# required metadata
3
3
4
4
title: Update Windows BIOS features using MDM policies in Microsoft Intune
5
-
description: Add a Device Firmware Configuration Interface (DFCI) profile to manage UEFI settings, such as the CPU, built-in hardware, and boot options on Windows 10/11 client devices in Microsoft Intune.
5
+
description: Learn more about the Device Firmware Configuration Interface (DFCI) profile to manage UEFI settings in Microsoft Intune. To use DFCI profiles, create Azure AD security groups, the Windows Autopilot deployment profile, and the Enrollment State Page profile.
When you use Intune to manage Autopilot devices, you can manage UEFI (BIOS) settings after they're enrolled, using the Device Firmware Configuration Interface (DFCI). For an overview of benefits, scenarios, and prerequisites, see [Overview of DFCI](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Dfci_Feature/).
33
33
34
-
DFCI [enables Windows](/windows/client-management/mdm/uefi-csp) to pass management commands from Intune to UEFI (Unified Extensible Firmware Interface).
34
+
DFCI enables Windows to pass management commands from Intune to UEFI (Unified Extensible Firmware Interface).
35
35
36
36
In Intune, use this feature to control BIOS settings. Typically, firmware is more resilient to malicious attacks. It limits end users control over the BIOS, which is good in a compromised situation.
37
37
@@ -61,7 +61,7 @@ When you reinstall an older Windows version, install a separate OS, or format th
61
61
Autopilot deployment profiles are assigned to Azure AD security groups. Be sure to create groups that include your DFCI-supported devices. For DFCI devices, most organization may create device groups, instead of user groups. Consider the following scenarios:
62
62
63
63
- Human Resources (HR) has different Windows devices. For security reasons, you don't want anyone in this group to use the camera on the devices. In this scenario, you can create an HR security users group so the policy applies to users in the HR group, whatever the device type.
64
-
- On the manufacturing floor, you have ten devices. On all devices, you want to prevent booting the devices from a USB device. In this scenario, you can create a security devices group, and add these ten devices to the group.
64
+
- On the manufacturing floor, you have 10 devices. On all devices, you want to prevent booting the devices from a USB device. In this scenario, you can create a security devices group, and add these 10 devices to the group.
65
65
66
66
For more information on creating groups in Intune, see [Add groups to organize users and devices](../fundamentals/groups-add.md).
67
67
@@ -95,42 +95,9 @@ This profile includes the DFCI settings you configure.
95
95
-**Description**: Enter a description for the profile. This setting is optional, but recommended.
96
96
97
97
6. Select **Next**.
98
-
7. In **Configuration settings**, configure the following settings:
99
-
100
-
-**Allow local user to change UEFI (BIOS) settings**: Your options:
101
-
-**Only not configured settings**: The local user may change any setting *except* those settings explicitly set to **Enable** or **Disable** by Intune.
102
-
-**None**: The local user may not change any UEFI (BIOS) settings, including settings not shown in the DFCI profile.
103
-
104
-
-**CPU and IO virtualization**: Your options:
105
-
-**Not configured**: Intune doesn't change or update this setting.
106
-
-**Enabled**: The BIOS enables the platform's CPU and IO virtualization capabilities for use by the OS. It turns on Windows Virtualization Based Security and Device Guard technologies.
107
-
-**Cameras**: Your options:
108
-
-**Not configured**: Intune doesn't change or update this setting.
109
-
-**Enabled**: All built-in cameras directly managed by UEFI (BIOS) are enabled. Peripherals, like USB cameras, aren't affected.
110
-
-**Disabled**: All built-in camera directly managed by UEFI (BIOS) are disabled. Peripherals, like USB cameras, aren't affected.
111
-
-**Microphones and speakers**: Your options:
112
-
-**Not configured**: Intune doesn't change or update this setting.
113
-
-**Enabled**: All built-in microphones and speakers directly managed by UEFI (BIOS) are enabled. Peripherals, like USB devices, aren't affected.
114
-
-**Disabled**: All built-in microphones and speakers directly managed by UEFI (BIOS) are disabled. Peripherals, like USB devices, aren't affected.
115
-
-**Radios (Bluetooth, Wi-Fi, NFC, etc.)**: Your options:
116
-
-**Not configured**: Intune doesn't change or update this setting.
117
-
-**Enabled**: All built-in radios directly managed by UEFI (BIOS) are enabled. Peripherals, like USB devices, aren't affected.
118
-
-**Disabled**: All built-in radios directly managed by UEFI (BIOS) are disabled. Peripherals, like USB devices, aren't affected.
119
-
120
-
> [!WARNING]
121
-
> If you disable the **Radios** setting, the device requires a wired network connection. Otherwise, the device may be unmanageable.
122
-
123
-
-**Boot from external media (USB, SD)**: Your options:
124
-
-**Not configured**: Intune doesn't change or update this setting.
125
-
-**Enabled**: UEFI (BIOS) allows booting from non-hard drive storage.
126
-
-**Disabled**: UEFI (BIOS) doesn't allow booting from non-hard drive storage, which also disables booting from network adapters.
127
-
128
-
When set to **Disabled**, don't set the **Boot from network adapters** setting to **Enabled**. It causes the **Boot from external media (USB, SD)** setting or **Boot from network adapters** setting to become not compliant.
129
-
130
-
-**Boot from network adapters**: Your options:
131
-
-**Not configured**: Intune doesn't change or update this setting.
132
-
-**Enabled**: UEFI (BIOS) allows booting from built-in network interfaces.
7. In **Configuration settings**, configure the settings you want to control in the UEFI firmware layer. For a list of all the settings, and what they do, see:
0 commit comments