How to Configure Surface 3 UEFI/BIOS Settings

Microsoft uses standard BIOS firmware on some early devices, including the Microsoft Surface 3. The BIOS was optimized to support Surface hardware features, security, and touch as input. The company, however, later used UEFI as firmware on newer Surface devices, starting with the launching of Surface Pro 4 in 2015.

This article will walk you through how to enter the Surface 3 BIOS settings. You will also learn how to configure the BIOS settings to check device identity information, improve device security, and more.

Access Surface 3 BIOS settings

You can only enter the Surface 3 BIOS setup screen while your Surface is starting. Here is how you do that:

  1. Shut down your Surface.
  2. Press and hold the Volume Up button on your Surface, then press and release the Power button.
  3. When you see the Surface logo screen appear, release the Volume Up button. The BIOS settings menu will appear in a few seconds.
    How to Enter Surface 3 UEFI Settings

After you have made any changes to the BIOS settings, you can save or delete those changes by:

Save Configuration and Restart Your Surface

  • In the BIOS settings menu, choose Exit Setup, and you will see the following screen:
    Surface 3 UEFI - Exit
  • Now you have two options:
    • Yes – Save your changes and restart your Surface.
    • No – turn back to the BIOS settings.

Restart Your Surface without Saving Your Configuration

  • In the BIOS settings menu, press the ESC key as in the picture below or press the ESC key if you have a Surface Type Cover connected.
    Surface 3 UEFI - Exit without Saving
  • Now you have two options:
    • Yes – Delete your changes and restart your Surface.
    • No – turn back to the BIOS settings.

What is a Trusted Platform Module (TPM)?

The Trusted Platform Module (TPM) technology significantly advances BIOS in hardware-based security features. It is a specialized chip that stores RSA encryption keys specific to each Surface device for hardware authentication.

The TPM technology is a requirement of BitLocker disk encryption. The TPM helps you encrypt/decrypt the entire disk without requiring complex long passphrases. It means the encryption and decryption keys are stored within the TPM chip. So, your encrypted disks can’t be accessed on other devices.

What is Secure Boot Control?

The Secure Boot is a technology that blocks the loading of uncertified bootloaders and drives. It helps to prevent your Surface from being loaded with unauthorized operating systems and malicious software applications.

If you desire to install other operating systems like Ubuntu or other Linux distributions, you may need to turn off this feature in the BIOS settings above.

Device information

Through BIOS settings, you can find out more information about your device identities, such as System UUID, Serial Number, and Asset Tag. To check that information:

  • Enter Surface BIOS settings as per the instructions above.
  • In the BIOS settings menu, choose Device Information, and you will see the following information:Surface 3 UEFI - PC Information

See also: How to manage asset tag on Surface 3.

System Boot Order

To change the alternate system boot order on your Surface 3:

  • Enter Surface BIOS settings as per the instructions above.
  • In the BIOS settings menu, you will see Configure Alternate System Boot Order as below:Surface 3 UEFI - Boot Configuration
  • Select the option and choose one of the following options:
    • SSD only
    • Network -> USB -> SSD

Device Security

Surface 3 allows you to deactivate some of your surface device components and features to meet your Security requirements. You can turn those security options on or off by:

  • Enter Surface BIOS settings as per the instructions above.
  • In the BIOS settings menu, choose Advanced Device Security, and you will see the following options:
    Surface 3 UEFI - Advanced Device Security
  • In my Surface 3 with BIOS Version 2.17.1246, there are the following advanced security options:
    • Side USB – turn on/off the ability to boot from a USB device. However, the side USB port remains enabled in Windows.
    • Front Camera – turn the front-facing camera on/off.
    • Rear Camera – turn the primary rear camera on/off.
    • On-Board Audio – turn internal audio or speakers on/off.
    • SD Port – turn the microSD port on/off.
    • WiFi – turn WiFi on/off. It will also disable Bluetooth if you turn off the WiFi option.
    • Bluetooth – turn the internal Bluetooth on/off.

Protect BIOS settings with a password

You can prevent others from changing your BIOS settings by setting an Administrator Password in BIOS settings. To do that:

  • Enter Surface BIOS settings as per the instructions above.
  • In the BIOS settings menu, choose Administrator Pass, and you will see the following requirements:
    Surface 3 UEFI - Administrator Pass
  • You will need to enter a password in the box with your keyboard or the on-screen keyboard with the following criteria:
    • Minimum Length: 4 characters
    • Maximum Length: 20 characters
    • Alphanumeric values only
Note If you enter the administrator password incorrectly three times, you’ll be locked out of the BIOS. Restart your Surface to enter the password again.

Important If you set a password for the BIOS, record it in a safe place. If you forget the password, you won’t be able to access the BIOS settings. You can only reset the administrator password from within the BIOS.

Other Surface BIOS Settings

We have also covered this topic for other Surface PCs as well. To learn more about other Surface’s BIOS settings, check the link below: