Require might be too strong a word, because they do have the built-in OS policy controls plus all the 3rd party security tools, but TPM-based security enables a

Require might be too strong a word, because they do have the built-in OS policy controls plus all the 3rd party security tools, but TPM-based security enables a lot when you manage PC fleets. https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/how-windows-uses-the-tpm https://learn.microsoft.com/en-us/windows/security/hardware-... https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... Up until recent releases, fleets of PCs were shockingly vulnerable to off-the-shelf toolkits to dump credentials, escalating to root privileges, lateral movement, installation of remote access toolkits, and of course ransomware is the end game du jour recently, but data exfiltration happens as well. That's just one example of a glaringly vulnerable OS that's probably a rough explanation of most ransomware news stories. Ops groups are by and large happy to see Windows gaining hardening features we've been seeing in iOS/Android, which helps both reduce compromise but also authenticate employees easier when there's a chain of trust around identity involving the device the employee's authing from. A benefit is that official Microsoft features like these reduce user friction and security risk in tandem, but the TPM has ended up as the answer when you assume your adversary will get into your kernel without one.