Option to add "Trusted Platform Module" to a Virtual Machine is not available.

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to add a Trusted Platform Module (TPM) to a virtual machine (VM) in vSphere, the option to add a vTPM (virtual TPM) is not available or visible in the VM settings.

Environment

VMware vCenter Server 8.x
VMware vSphere ESXi 8.x

Cause

This issue occurs because the virtual machine's boot firmware is set to BIOS. The vTPM feature requires UEFI firmware to function, as BIOS firmware does not support Secure Boot or TPM integration in virtual machines.

Resolution

To enable the TPM option for a VM, you must change the boot firmware from BIOS to UEFI and ensure other prerequisites are met.

Steps to Change Boot Firmware to UEFI:

1. Power off the virtual machine.
2. Right-click the VM and select Edit Settings.
3. Expand the VM Options tab.
4. Under Boot Options, locate Firmware.
5. Change the firmware from BIOS to UEFI.
6. Click OK to save the changes.
7. Now, go back to Edit Settings.
8. Under Add New Device, you should now see the Trusted Platform Module (vTPM) as an option.
9. Add the TPM and power on the VM.

Note: Changing the firmware type from BIOS to UEFI may prevent the VM from booting properly if the guest OS was originally installed using BIOS. Ensure compatibility or plan for OS reinstallation if required.

Additional Requirements for Adding vTPM:

1. VM must be using virtual hardware version 14 or later.
2. Key Provider (like vSphere Native Key Provider or external KMS) must be configured.
3. VM encryption or vTPM encryption policy should be in place.