Pluton TPM attestation fails for Call of Duty RICOCHET (Microsoft Azure Attestation) despite valid endorsement certificate

Claas Code 20 Reputation points
2026-07-30T16:46:16.84+00:00

Hi,

I'm running into a Microsoft Azure Attestation (MAA) failure that's blocking a third-party anti-cheat attestation check (Call of Duty RICOCHET) despite my Pluton TPM being locally healthy and fully provisioned.

Device: ASUS ProArt PX13, AMD Ryzen AI, Microsoft Pluton security processor

OS: Windows 11, fully updated, latest BIOS from ASUS

Local TPM status (Get-Tpm): TpmPresent/Ready/Enabled/Activated/Owned all True, RestartPending was initially True but cleared after reboot. ManufacturerIdTxt: MSFT, ManufacturerVersion: 10.5.0.1.

Endorsement key info (Get-TpmEndorsementKeyInfo):

  • IsPresent: True
  • ManufacturerCertificates contains a valid cert, Issuer "CN=PLUTON Firmware SVN04, OU=FIRMWARE EKICA DFID00B20F40, O=Microsoft Corporation", valid from 15.09.2021 to 16.12.2039.

Secure Boot is enabled (keys reset via BIOS), Core Isolation/Memory Integrity is on, boot is UEFI/GPT (no CSM/Legacy).

Despite all of this, the game's attestation check (which uses MAA under the hood) reports "Failed Attestation Status." The game's own attestation wizard confirms local compliance, so the failure seems to occur specifically at the MAA cloud verification step.

I found similar publicly reported cases on other Pluton devices:

  • One case where the MAA endpoint returns HTTP 404 for a specific Pluton firmware batch (endpoint not registered for that firmware version).
  • Another case where a Pluton firmware SVN update renamed the issuing CA without reissuing the EK certificate, causing local AIK enrollment failure (0x80070490).

Questions:

  1. Is there a known issue with MAA endpoint registration for certain Pluton firmware/SVN batches?
  2. Is there a way to check, as an end user, whether my device's specific Pluton firmware/EK certificate is properly registered with MAA?
  3. Is a firmware update (via OEM) or a server-side fix required to resolve this?

Happy to provide additional diagnostic output if useful.

Thanks!

Azure Virtual Machines
Azure Virtual Machines

An Azure service that is used to provision Windows and Linux virtual machines.

0 comments

Answer accepted by question author

Vinodh247-1375 43,746 Reputation points Volunteer Moderator
2026-07-31T01:03:44.9433333+00:00

Hi ,

Thanks for reaching out to Microsoft Q&A.

This is very likely not a local TPM or Windows configuration issue but a gap between your device’s Pluton EK/firmware lineage and what azure attestation (AA) currently recognises. AA validates TPM identity against a backend registry of trusted endorsement key (EK) certificate chains; if your Pluton firmware SVN/issuer chain is not onboarded (or was changed without corresponding backend updates), attestation will fail even though the TPM is healthy locally. There is no reliable enduser method to verify AA registration status for a specific EK cert, failures like HTTP 404 or “not found” during attestation are the only practical indicators. In this scenario, the fix is almost always server-side (AA trust list update) or an OEM delivered firmware update that aligns the EK chain with what AA expects. Actionably: ensure you are on the absolute latest BIOS/Pluton firmware, then raise this via the game vendor (RICOCHET) and microsoft support with your EK certificate details this requires escalation to get the cert chain registered or corrected; it is not something you can remediate locally.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

Was this answer helpful?

2 people found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.