Use virtual Trusted Platform Module (TPM) in Parallels Desktop

164 users found this article helpful

Overview

Virtual Trusted Platform Module (TPM) is a cryptographic component that can be added to Windows 10 and newer virtual machines (VM) with UEFI BIOS. Virtual TPM is an optional layer of security for a virtual machine and allows you to protect data from unauthorized access and use additional Windows security features.

After adding a virtual TPM chip to a VM, Parallels Desktop creates an encrypted file within the virtual machine bundle that acts as a TPM storage. Parallels Desktop encrypts this file using Advanced Encryption Standard (AES) with 128 bits key length and puts the password in Mac System Keychain, which, in turn, is encrypted physical storage, and only Parallels Desktop (or Mac admin) can read the TPM password from Mac Keychain. 

TPM availability in Parallels Desktop 

Starting with Parallels Desktop 17, virtual Trusted Platform Module (TPM) 2.0 support is available for all Parallels Desktop for Mac Editions: Standard, Pro, and Business. Moreover, Parallels Desktop 17 adds support for a virtual TPM on Mac computers with Apple M1 chip.

In Parallels Desktop 15 and 16 for Intel-based Mac computers, a vTPM chip is available for Pro and Business Editions only. Parallels Desktop 16 doesn't support this feature on Mac computers with Apple M1 chip.

Upgrade to Windows 11

On September 16, 2021, Microsoft has announced the change that aligns the enforcement of the Windows 11 system requirements on Virtual Machines (VMs) to be the same as it is for physical PCs.

So, a virtual TPM chip is required for upgrading to Windows 11.


Note: Starting with Parallels Desktop 17.1.0, a virtual TPM chip is added automatically to new Windows 11 virtual machines. For new Windows 10 virtual machines created on Mac computers with the Apple M1 chip, a virtual TPM chip is added automatically too.


Enable TPM

Important: it is not recommended to move, copy or clone a virtual machine with enabled TPM. Always have a backup of important information, especially recovery keys. When TPM is enabled, the virtual machine is restricted from running on other Mac computers, and by default, it cannot be started on another computer if copied or moved. 

Note: if a vTPM ship isn't presented in the list of devices on your Intel-based Mac to add upon clicking Hardware > +, it means your Windows virtual machine is based on Legacy BIOS. TPM chip will work with UEFI/EFI BIOS only. To check a BIOS type, follow the steps from KB 115815.

1. Shut down Windows.

2. Open the virtual machine's configuration > Hardware > click + > select TPM chip > click Add

3. Launch Windows. Windows will automatically detect the TPM chip. You can now use Windows features and applications that require TPM.

Troubleshooting

TPM chip is not on the list 

1) Parallels Desktop 16 doesn't support TPM on Mac computers with Apple M1 chip. Upgrade to Parallels Desktop 17 to use this feature.

2) Parallels Desktop versions older than Parallels Desktop 17 don't support TPM on Mac computers with Intel processors in Standard Edition, only in Pro and Business Editions.

3) If you go to Hardware > on your Mac with an Intel processor, but a TPM chip isn't there, it might be caused by the fact your Windows virtual machine is based on Legacy BIOS. TPM chip will work with UEFI/EFI BIOS only.

     0. Check if your virtual machine has Legacy BIOS by following the steps from KB 115815.

  1. If Legacy is set, create a new Windows virtual machine.
  2. When you get to the Name and Location window when creating a machine, enable Customize settings before installation.

  3. In the automatically opened configuration window go to Hardware, click + > select TPM chip > Add.

  4. Close the configuration window and proceed with Windows installation.

4) Please note that if you have set Parallels Desktop to run Windows from the BootCamp partition, Parallels Desktop doesn't support adding a TPM chip to such virtual machines as it might lead to some issues or even corruption of the BootCamp partition. That's why the option to add a TPM chip to such virtual machines is absent. To upgrade your virtual machine to Windows 11, import your BootCamp virtual machine as described here.

PRL_ERR_TPM_SETUP_KEYCHAIN_FAILED error after trying to add a TPM chip 

This issue has been fixed in Parallels Desktop App Store Edition 1.7.1. Please make sure you have the latest version of Parallels Desktop App Store Edition installed.

Was this article helpful?

Tell us how we can improve it.