Hardware Azure attestation failure (400 Bad Request) - Intel Core Ultra 7 265KF / MSI Z890

Question

Hardware Azure attestation failure (400 Bad Request) - Intel Core Ultra 7 265KF / MSI Z890

Cooper 0

My system fails remote health attestation checks. Local TPM 2.0 and Secure Boot are confirmed healthy and active via running tpm.msc. The cloud server is rejecting the system, indicating an un-onboarded platform certificate batch. Hardware specs are; MSI Pro z890-p wifi (lga 1851) motherboard, with an Intel Core Ultra 7 265kf cpu with Intel PTT 2.0/CSME.

See TPM endorsement key info in attached screenshot. Administrator_ Windows PowerShell 8_24_2026 1_24_20 PM

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Allan Solomon Mejia 6,240

Hello @Cooper

It seems the TPM is present and set up correctly; the screenshot shows IsPresent is True and that there is an Intel PTT/CSME endorsement certificate, which means a 400 Bad Request doesn't necessarily indicate that TPM 2.0 or Secure Boot is misconfigured.

Windows remote health attestation goes beyond verifying the local TPM state; the Microsoft service also checks the EK/AIK certificate chain and whether the certificate is issued by a recognized/trusted CA.

There have also recently been reports of Intel PTT/CSME systems receiving an HTTP 400 error during AIK enrollment with the message 'No valid TPM EK/Platform certificate provided', even though the TPM and EK certificates are present locally.

I would recommend:

Install the latest MSI BIOS and Intel ME/CSME firmware, then retest.
Make sure outbound access isn't blocking Intel's EK certificate service or Microsoft's AIK service. Microsoft specifically documents ekop.intel.com for Intel firmware TPM certificate provisioning and *.microsoftaik.azure.net for AIK provisioning.
Run TpmTool GetDeviceInformation and confirm Ready For Attestation and Is Capable For Attestation are both True.
Avoid clearing the TPM as the first troubleshooting step, particularly if BitLocker is enabled. Microsoft warns that TPM reset/troubleshooting operations can result in data loss.
If the 400 persists with current firmware and unrestricted access to those endpoints, this may require escalation to Microsoft and/or MSI/Intel, since the EK/platform certificate chain may not yet be accepted by the Microsoft attestation service, rather than indicating a local Windows configuration problem.

Sharing these references with you:

Microsoft - Control the health of Windows devices ·

Microsoft - TPM attestation overview ·

Microsoft - HealthAttestation CSP

Please "Accept the Answer" if this information helped you. This will help us and others in the community.

Cooper 0 Reputation points

2026-08-26T22:19:16.48+00:00

You mentioned reports of the same error with the messege "No valid TPM EK/Platform certificate provided". That seems to be the issue I am facing;
Allan Solomon Mejia 6,240 Reputation points

2026-08-27T01:52:50.9033333+00:00
Hi @Cooper

Thanks for running that test. This confirms the issue much more clearly.

Your certreq -enrollaik output is reaching Microsoft's AIK service, but Microsoft is rejecting the TPM identity request with:

HTTP/1.1 400 Bad Request

"No valid TPM EK/Platform certificate provided in the TPM identity request message."

This means the problem isn't simply that TPM 2.0 or Secure Boot is disabled. Your TPM is present and the earlier output shows an Intel PTT/CSME endorsement certificate, but Microsoft's attestation/AIK service isn't accepting the EK/platform certificate supplied with the request.

This is consistent with the other Intel CSME/PTT cases reporting the same error.

At this point I would:

Make sure the MSI BIOS and Intel ME/CSME firmware are fully updated.

Run: tpmtool getdeviceinformation and verify that the device reports it is capable and ready for attestation.

Verify that there is no SSL inspection/proxy/security product modifying communication with Microsoft's AIK endpoint.

Do not repeatedly clear the TPM, particularly if BitLocker is enabled. This error is coming from Microsoft's remote validation of the identity request, so clearing a healthy TPM isn't necessarily going to correct an EK certificate-chain acceptance issue.

Most importantly, your latest output now provides something Microsoft can trace:

x-ms-client-request-id: 82853a00-db32-4194-a947-04ab059c7284

x-ms-request-id: db9d3786-a15f-46aa-8a03-32dc1c052485

Date: Wed, 26 Aug 2026 22:13:28 GMT

I recommend opening a Microsoft support case and providing those IDs together with the complete certreq -enrollaik output and the TPM EK certificate information.

The key question for Microsoft is whether this particular Intel CSME/PTT EK certificate chain is currently recognized by the Microsoft AIK/attestation service.

Since the request successfully reaches Microsoft's service and receives a specific HTTP 400 response, I wouldn't spend much more time troubleshooting basic network connectivity or reinstalling Windows. This now looks like an EK/platform certificate validation issue that Microsoft and potentially Intel/MSI need to investigate.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.