Microsoft Protection Plans now deliver more coverage
Modern organizations rely on their Surface devices every day, across offices, job sites, classrooms, and hybrid work environments. Microsoft Protection Plans help reduce unexpected repair-related costs in accordance with the plan terms. While every Microsoft Surface device comes with a minimum of 1-year Microsoft's Limited Hardware Warranty 1 , you can protect your investment further with a Microsoft Protection Plan. Microsoft has recently updated its Protection Plans to provide broader coverage and reduce uncertainties in claim boundaries for customers. These enhancements are designed to better reflect how devices are used over time and to reduce uncertainty around repairs and long‑term ownership. 2026 Protection Plan Enhancements Unlimited Mechanical Breakdown Coverage Microsoft Protection Plans now include unlimited mechanical breakdown coverage 2 for the full duration of the plan. Previously, mechanical breakdowns and accidental damage claims were combined under a two‑claim limit. With this change, hardware failures caused by defects in materials or workmanship are no longer subject to a fixed claim count limit. Devices may be repaired or replaced as needed for mechanical issues throughout the coverage term. 3 Accidental Damage Claims Are Now Separate The existing two‑claim limit now applies only to Accidental Damage from Handling (ADH) 4 , such as drops, spills, or cracked screens. By separating accidental damage from mechanical breakdown coverage, customers can more clearly understand how claims are applied and avoid using accidental damage claims for issues related to normal hardware failure. New Battery Degradation Coverage Microsoft Protection Plans 5 now include battery degradation coverage. Customers can file one dedicated battery claim 6 if a device’s battery capacity drops below 70% of its original capacity during the plan term. This marks the first time Protection Plans address battery wear over time, not just battery failures caused by manufacturing defects. Battery eligibility can be validated using tools such as the Surface Diagnostic Toolkit. Battery degradation claims are separate from accidental damage claims, so ADH limits remain unaffected. Together, these updates help organizations extend device life, reduce unexpected repair costs, and plan more confidently for device ownership. Customers can add a Microsoft Protection Plan when purchasing a new device, or within the eligible post-purchase window. 7 To purchase, contact your authorized partner or reseller, or engage the Microsoft Store virtual assistant. [Consumer customers can purchase through the Surface app or your Microsoft account.] These updates apply only to Microsoft Complete and Extended Hardware Service plans purchased on or after the applicable effective date (April 01, 2026) and are not retroactively modified. Coverage, whether for new or existing customers, is determined solely by the relevant Terms & Conditions for the specific plan purchased. To learn more about Microsoft Protection Plans, visit Microsoft Surface Warranty & Protection Plans. To see Warranty and Protection Plan Terms & Conditions, visit Support.microsoft.com. Disclaimers Without prejudice to any legal (statutory) rights to which you may be entitled under your local law, Microsoft Limited Hardware Warranty covers your device for one year from the date of original purchase from Microsoft or an authorized reseller. Restrictions apply. Please refer to Microsoft Limited Hardware Warranty & Agreement. Additional extended coverage for mechanical breakdown and accidental damage from handling is available through the purchase of Microsoft protection plans. If the plan provides additional Mechanical Breakdown coverage, that coverage begins upon expiration of the manufacturer’s original warranty and continues for the remainder of the term shown on the Holder’s Proof of Purchase. Accidental damage from handling begins immediately upon purchase. Restrictions apply, for all Protection Plans, please reference the Terms and Conditions for the limit of liability and the applicable exclusions of the Protection Plan. Subject to plan terms, conditions, and limit of liability. Accidental damage from handling is included in the following plans: Commercial: Complete for Business, Complete for Business Plus, Accidental Damage Protection (EU), Accidental Damage Protection Plus (EU), and Consumer: Microsoft Complete. Extended Hardware Service (EHS) plans provide coverage for mechanical breakdown only and do not include Accidental Damage from Handling or battery degradation coverage. Battery degradation is included in the following plans: Commercial: Complete for Business, Complete for Business Plus, Accidental Damage Protection (EU), Accidental Damage Protection Plus (EU), and Consumer: Microsoft Complete. Extended Hardware Service (EHS) plans provide coverage for mechanical breakdown only and do not include Accidental Damage from Handling or battery degradation coverage. Customers with eligible plans are limited to one (1) battery degradation/replacement claim as set out in plan Terms and Conditions. Availability and timing vary by market and plan type.Meeting Control, Now Within Reach: Surface Hub 3 + MAXHUB Universal Console
Modern meeting spaces require flexibility, simplicity, and consistency for IT teams managing collaboration environments. Announced at Microsoft Ignite 2024, center-of-table console support for Surface Hub 3 extends Microsoft Teams Rooms on Windows by enabling certified third-party touch consoles for in-room meeting control. Center-of-Table Console Support Surface Hub 3 now supports Teams Rooms Certified Universal Consoles, introducing an additional option to control meetings beyond the interactive display. This includes the MAXHUB TCP33T Universal Console, a certified hardware solution in this ecosystem. By connecting a touch console directly to Surface Hub 3, users can join meetings, manage controls, and share wired content from their PCs while seated at the table. Benefits of Certified Universal Consoles Teams Rooms Certified Universal Consoles can help provide IT admins with: Microsoft Teams Rooms integration through certified accessories Flexible room design options including front-of-room deployments Consistent user experience across meeting spaces Simplified meeting controls for table-based interaction MAXHUB TCP33T Universal Console Overview The MAXHUB TCP33T is a Teams Rooms Certified Universal Console designed to work with Windows-based touch board devices such as Surface Hub 3. It delivers touchscreen control for Microsoft Teams Rooms meetings and serves as a dedicated entry point for wired content sharing. Common Deployment Scenarios Large conference rooms requiring table-based control Standardized Teams Rooms deployments across buildings Collaborative meetings requiring easy content sharing Requirements Deployments require Surface Hub 3 running Microsoft Teams Rooms on Windows and a Teams Rooms Certified Universal Console such as the MAXHUB TCP33T. Looking Ahead This new Universal Console ecosystem reflects Microsoft's commitment to flexible, scalable collaboration experiences. By pairing Surface Hub 3 with certified accessories like the MAXHUB TCP33T, organizations can design meeting spaces that meet modern collaboration needs. Live Webinar Wednesday the 14th of January... Sign up now! Join us for an exclusive webinar with Microsoft and MAXHUB as we explore how the MAXHUB Universal Console enhances the Microsoft Surface Hub experience. Hear from industry experts and learn how to: ✔ Reduce friction in the room ✔ Streamline collaboration workflows ✔ Centralize meeting controls — without leaving your seat! Featured Speakers: • Frank Buchholz, Director, Product Marketing — Microsoft • Jean Barrett, Technology Solutions Professional — Microsoft • Alan Nicholls, Microsoft Teams Professional — MAXHUB Register for a session and secure your spot👇 January 14 @9AM PST session: Register here January 14 @5PM PST session: Register here Resources Center-of-table console support Teams Rooms app version needed Center-of-table console support announcement during Microsoft Ignite 2024Close the Year Strong with Surface for Business Deals
As organizations look to maximize their remaining budget and prepare for 2026, now is the moment to modernize device fleets with Surface for Business. These limited-time Surface promotions make it easier to accelerate refresh cycles, strengthen endpoint security, and equip employees with devices that are AI-ready from day one. Surface for Business devices combine productivity-forward design, leading AI capabilities, and Microsoft security at multiple layers. Whether refreshing a subset of users or upgrading entire departments, organizations can close the year with hardware that helps reduce risk, assists in lowering management overhead, and positions teams for the next wave of AI-driven productivity. Secure by Design Surface for Business devices deliver hardware-based protections aligned with Secured-core PC standards. Hardware-based security, advanced firmware protections, and a growing number of memory-safe drivers help reduce exposure across the stack, providing peace of mind that clears the way for AI innovation. AI-Ready With advanced processors including powerful AI chips on supported models, Surface for Business devices are ready to help employees maximize their skills using AI to drive business forward. From a dedicated Copilot key 1 to Foundry on Windows 2 for developing local agents, these devices provide the foundation for people to achieve their best. Learn more about unlocking AI innovation in our new eBook. Ready to Deploy Surface for Business devices support Windows Autopilot 3 , enabling IT teams to deploy devices directly to employees, preconfigured with corporate profiles and security baselines, without imaging or desk-side setup. Combined with centralized management through Microsoft Intune 4 , organizations can reduce deployment time and help keep endpoints consistent from day one. Make the Most of Year-End Purchasing Opportunities Maximize remaining 2025 budget by exploring end-of-year savings on select Surface for Business devices. Work with your preferred reseller to capitalize on year-end spend, or purchase directly through Microsoft Store in the US 5 to take advantage of available offers that make modernizing your device fleet easier as you prepare for 2026. Resellers can help organizations align device selection, deployment plans, and support needs while optimizing budget utilization. Businesses purchasing through Microsoft Store benefit from fast, free shipping and a 60-day return window on most physical products. 6 Across both channels, Surface for Business offers provide a cost-effective path to refresh devices now rather than deferring upgrades—helping IT leaders complete their roadmap, meet procurement targets, and deliver new value to end users before the new year. Find a reseller [https://www.microsoft.com/surface/business/where-to-buy-microsoft-surface Buy from Microsoft Store US [https://www.microsoft.com/en-us/store/collections/surface-deals-bundles] References Feature availability varies by device and market. See Key Support for details. Some capabilities may require additional subscriptions not included with Windows or Surface devices. Windows Autopilot device preparation depends on specific capabilities available in Windows client and Microsoft Entra ID. It also requires a mobile device management (MDM) service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs. Additional licenses required, not included with Surface. Offers and promotions vary by market. Terms apply. Microsoft Store only ships to certain countries; see Shipping options, costs, and delivery times - Microsoft Support for details.Improved address management in service orders on Surface Portals
We’ve introduced an important usability improvement to the address selection experience in the service order workflow on both Surface Management Portal and Surface Support Portal. When raising a service order, users can add both the billing and shipping addresses and save them for future use. Previously, all saved addresses were stored together and appeared in both dropdown menus. This caused confusion and made it difficult for users to select the correct one. To improve this experience, we’ve separated saved addresses by type. Shipping addresses now appear only in the Shipping Address dropdown, and billing addresses appear only in the Billing Address dropdown. As part of this update, all previously saved addresses have been moved to the Shipping Address section. Users can now save billing addresses separately as they create new orders. This change makes the selection process simpler, clearer, and more intuitive, allowing users to easily select the right address. To learn more about the Surface Management Portal and Surface Support Portal, see the following Microsoft Learn articles: Surface portals overview Surface Support Portal overview Surface Management Portal overview Assign admin roles for Surface PortalsEndpoints and AI strategy: Lessons of the Microsoft Work Trend Index 2025
AI adoption is accelerating, and PCs are now key to delivering fast, secure, and seamless AI experiences. Surface Copilot+ PCs combine local AI processing, cloud connectivity, and enterprise-grade security—making endpoints central to every AI strategy.
Provisioning does not add to MDM - Surface hub
When using the Windows Configuration Designer to create a provisioning package I'm unsure what to add for the MDM devices. Some devices seem to enter the MDM and some don't. Unsure if it's the build on these devices. I've looked for documentation and can't find any for what credentials to use for the following on the Enrol in device management I need to know what to enter for the following fields please. So that I can insure these devices populate into Intune. I don't know why MS make it so hard for this as the setup of the older 2s devices was much easier. Thanks MichaelSafer Drivers, Stronger Devices
Surface is advancing Windows driver development by adopting Rust, a memory-safe programming language, to improve device security and reliability. Through contributions to the open-source windows-drivers-rs platform, Surface has shipped several Copilot+ PCs with Rust-based drivers, reducing vulnerabilities and enhancing maintainability.Boost mobile productivity with Surface Laptop 5G for Business and Surface Copilot+ PCs
Surface Laptop 5G is here to supercharge mobile productivity. With built-in AI, enterprise-grade 5G, and up to 20 hours of battery life, it’s designed for secure, seamless work—anywhere. We'll explore engineering and design highlights that make these devicines shine. Also available for order starting today, Surface Laptop for Business 13-inch and Surface Pro for Business 12-inch bring the power of Copilot+ PCs to more mobile form factors.On-device AI and security: What really matters for the enterprise
AI is evolving, and so is the way businesses run it. Traditionally, most AI workloads have been processed in the cloud. When a user gives an AI tool a prompt, that input is sent over the internet to remote servers, where the model processes it and sends back a result. This model supports large-scale services like Microsoft 365 Copilot, which integrates AI into apps like Word, Excel, and Teams. Now, a new capability is emerging alongside cloud-based AI. AI can also run directly on a PC—no internet connection or remote server required. This is known as on-device processing. It means the data and the model stay on the device itself, and the work is done locally. Modern CPUs and GPUs are beginning to support this kind of processing. But neural processing units (NPUs), now included in enterprise-grade PCs such as Microsoft Surface Copilot+ PCs, are specifically designed to run AI workloads efficiently. NPUs are designed to perform the types of operations AI needs at high speed while using less power. That makes them ideal for features that need to work instantly, in a sustained fashion in the background, or without an internet connection. A flexible approach to AI deployment NPUs can enable power-efficient on-device processing, fast response times with small models, consistent functionality in offline scenarios, and more control over how data is processed and stored. For organizations, it adds flexibility in choosing how and where to run AI—whether to support real-time interactions at the edge or meet specific data governance requirements. At the same time, cloud-based AI remains essential to how organizations deliver intelligent services across teams and workflows. Microsoft 365 Copilot, for example, is powered by cloud infrastructure and integrates deeply across productivity applications using enterprise-grade identity, access, and content protections. Both models serve different but complementary needs. On-device AI adds new options for responsiveness and control. Cloud-based AI enables broad integration and centralized scale. Together, they give businesses flexibility to align AI processing with the demands of the use case, whether for fast local inference or connected collaboration. For business and IT leaders, the question is not which model is better but how to use each effectively within a secure architecture. That starts with understanding where data flows, how it is protected, and what matters most at the endpoint. Understanding AI data flow and its security impact AI systems rely on several types of input such as user prompts, system context, and business content. When AI runs in the cloud, data is transmitted to remote servers for processing. When it runs on the device, processing happens locally. Both approaches have implications for security. With cloud AI, protection depends on the strength of the vendor’s infrastructure, encryption standards, and access controls. Security follows a shared responsibility model where the cloud provider secures the platform while the enterprise defines its policies for data access, classification, and compliance. Microsoft’s approach to data security and privacy in cloud AI services Although the purpose of this blog post is to talk about on-device AI and security, it’s worth a detour to briefly touch on how Microsoft approaches data governance across its cloud-based AI services. Ultimately, the goal is for employees to be able to use whatever tools work best for what they want to get done, and they may not differentiate between local and cloud AI services. That means having a trusted provider for both is important for long-term AI value and security in the organization. Microsoft’s generative AI solutions, including Azure OpenAI Service and Copilot services and capabilities, do not use your organization’s data to train foundation models without your permission. The Azure OpenAI Service is operated by Microsoft as an Azure service; Microsoft hosts the OpenAI models in Microsoft's Azure environment and the Service does not interact with any services operated by OpenAI (e.g. ChatGPT, or the OpenAI API). Microsoft 365 Copilot and other AI tools operate within a secured boundary, pulling from organization-specific content sources like OneDrive and Microsoft Graph while respecting existing access permissions. For more resources on data privacy and security in Microsoft cloud AI services, check out Microsoft Learn. Local AI security depends on a trusted endpoint When AI runs on the device, the data stays closer to its source. This reduces reliance on network connectivity and can help limit exposure in scenarios where data residency or confidentiality is a concern. But it also means the device must be secured at every level. Running AI on the device does not inherently make it more or less secure. It shifts the security perimeter. Now the integrity of the endpoint matters even more. Surface Copilot+ PCs are built with this in mind. As secured-core PCs, they integrate hardware-based protections that help guard against firmware, OS-level, and identity-based threats. TPM 2.0 and Microsoft Pluton security processors provide hardware-based protection for sensitive data Hardware-based root of trust verifies system integrity from boot-up Microsoft-developed firmware can reduce exposure to third-party supply chain risks and helps address emerging threats rapidly via Windows Update Windows Hello and Enhanced Sign-in Security (ESS) offer strong authentication at the hardware level These protections and others work together to create a dependable foundation for local AI workloads. When AI runs on a device like this, the same enterprise-grade security stack that protects the OS and applications also applies to AI processing. Why application design is part of the security equation Protecting the device is foundational—but it’s not the whole story. As organizations begin to adopt generative AI tools that run locally, the security conversation must also expand to include how those tools are designed, governed, and managed. The value of AI increases dramatically when it can work with rich, contextual data. But that same access introduces new risks if not handled properly. Local AI tools must be built with clear boundaries around what data they can access, how that access is granted, and how users and IT teams can control it. This includes opt-in mechanisms, permission models, and visibility into what’s being stored and why. Microsoft Recall (preview) on Copilot+ PCs is a case study in how thoughtful application design can make local AI both powerful and privacy conscious. It captures snapshots of the desktop embedded with contextual information, enabling employees to find almost anything that has appeared on their screen by describing it in their own words. This functionality is only possible because Recall has access to a wide range of on-device data—but that access is carefully managed. Recall runs entirely on the device. It is turned off by default—even when enabled by IT—and requires biometric sign-in with Windows Hello Enhanced Sign-in Security to activate. Snapshots are encrypted and stored locally, protected by Secured-core PC features and the Microsoft Pluton security processor. These safeguards ensure that sensitive data stays protected, even as AI becomes more deeply embedded in everyday workflows. IT admins can manage Recall through Microsoft Intune, with policies to enable or disable the feature, control snapshot retention, and apply content filters. Even when Recall is enabled, it remains optional for employees, who can pause snapshot saving, filter specific apps or websites, and delete snapshots at any time. This layered approach—secure hardware, secure OS, and secure app design—reflects Microsoft’s broader strategy for responsible local AI and aligns to the overall Surface security approach. It helps organizations maintain governance and compliance while giving users confidence that they are in control of their data and that the tools are designed to support them, not surveil them. This balance is essential to building trust in AI-powered workflows and ensuring that innovation doesn’t come at the expense of privacy or transparency. For more information, check out the related blog post. Choosing the right AI model for the use case Local AI processing complements cloud AI, offering additional options for how and where workloads run. Each approach supports different needs and use cases. What matters is selecting the right model for the task while maintaining consistent security and governance across the entire environment. On-device AI is especially useful in scenarios where organizations need to reduce data movement or ensure AI works reliably in disconnected environments In regulated industries such as finance, legal, or government, local processing can help support compliance with strict data-handling requirements In the field, mobile workers can use AI features such as document analysis or image recognition without relying on a stable connection For custom enterprise models, on-device execution through the Windows AI Foundry Local lets developers embed AI in apps while maintaining control over how data is used and stored These use cases reflect a broader trend. Businesses want more flexibility in how they deploy and manage AI. On-device processing makes that possible without requiring a tradeoff in security or integration. Security fundamentals matter most Microsoft takes a holistic view of AI security across cloud services, on-device platforms, and everything in between. Whether your AI runs in Azure or on a Surface device, the same principles apply. Protect identity, encrypt data, enforce access controls, and ensure transparency. This approach builds on the enterprise-grade protections already established across Microsoft’s technology stack. From the Secure Development Lifecycle to Zero Trust access policies, Microsoft applies rigorous standards to every layer of AI deployment. For business leaders, AI security extends familiar principles—identity, access, data protection—into new AI-powered workflows, with clear visibility and control over how data is handled across cloud and device environments. Securing AI starts with the right foundations AI is expanding from cloud-only services to include new capable endpoints. This shift gives businesses more ways to match the processing model to the use case without compromising security. Surface Copilot+ PCs support this flexibility by delivering local AI performance on a security-forward enterprise-ready platform. When paired with Microsoft 365 and Azure services, they offer a cohesive ecosystem that respects data boundaries and aligns with organizational policies. AI security is not about choosing between cloud or device. It is about enabling a flexible, secure ecosystem where AI can run where it delivers the most value—on the endpoint, in the cloud, or across both. This adaptability unlocks new ways to work, automate, and innovate, without increasing risk. Surface Copilot+ PCs are part of that broader strategy, helping organizations deploy AI with confidence and control—at scale, at speed, and at the edge of what’s next.
