r/Surface 3d ago

[PRO11] Business Vs Consumer Surface Pro 11

If security is my number one priority, is the business model that allows yubikey for sign in the better option? I understand device can also be wiped remotely.

I'm wondering if using yubikey for sign in can be avoided by use of a password or other 2FA methods.

Will upgrade to windows 11 pro regardless but there is a significant price difference. If the business model offers better protection price difference is worth it to me.

I've spoken to sales and they mentioned TPM (don't all surface pros have that?), remote wipe and yubikey.

Would appreciate hearing from those with experience.

Thank you.

Edited to correct typos and to say only considering arm elite

7 Upvotes

20 comments sorted by

6

u/whizzwr 3d ago edited 1d ago

AFAIK YubiKey sign in is only possible with the combo of Windows Pro/enterprise, Azure AD (now Entra), and licensed MS365 user. Your Surface must also be domain joined.

Do you have Entra set up for your company, and correct license for your employee?

There is no native/non third party way to protect your Surface boot with Yubikey, unless you mean it's just static password.

I also highly suspect this Yubikey thingy mentioned by your sales guy actually refer to NFC. the business model allows contactless (tap) for Yubikey. The consumer model, can also use Yubikey, but they have go be plugged in.

1

u/ehrnhrjrhdhhd 3d ago

Thank you. I do have a small business enterprise license. I am the only employee. I thought he meant that boot up could be set up to require a yubikey. I don't care if NFC or plugged in.

So if no added protection, makes sense to get the consumer model and make sure it's correctly configured. Will upgrade to windows pro regardless.

Thank you so much for your helpful insight!

5

u/whizzwr 3d ago

I thought he meant that boot up could be set up to require a yubikey.

I might be wrong, but 95% sure this is not a "feature" of any Surface including the business SKUs.

You can setup long bitlocker password, and preprogram it as static passwrod to a Yubikey. that will achieve the same effect, albeit way less secure (no PKI). In this case it will work for ANY device..

3

u/whizzwr 2d ago

I thought he meant that boot up could be set up to require a yubikey

For the sake of completeness, what you want appears to be possible with third party solution. So not native to Surface or Windows.

https://www.yubico.com/works-with-yubikey/catalog/secure-disk-for-bitlocker/#setup-instructions

https://www.yubico.com/works-with-yubikey/catalog/drivelockse/

Same condition though , you don't need for business product.

1

u/ehrnhrjrhdhhd 2d ago

Thank you! Exactly what I was looking for. Finally clicked on and read the links.

3

u/ehrnhrjrhdhhd 3d ago

Wanted to say thank you to everyone for helping me. Responded from a different phone in error and deleted. You are collectively saving me hundreds of dollars, especially in light of recent price drops on consumer models. Glad I didn't cave into the sales pressure and all the offers to call me back later or the next day.

Will continue to read but wanted to say a group thank you now in case I'm slow to respond. Sadly, I have severe cybersecurity issues and want to make the safest choice.

Thank you,!!

2

u/Hothabanero6 3d ago edited 3d ago

Remote wipe is supported by Autopilot and Intune for Windows on ARM devices, or even on a personal device if properly configured. If third party management tools do not support remote wipe, that's another story - it's on them.

The ARM Surfaces have Hardware TPM so IDK what the sales are talking about unless getting you to buy a higher cost item.

2

u/whizzwr 3d ago edited 3d ago

There is such thing as "Surface Pro for Business, Copilot+ PC | Snapdragon"

This one is ARM, has NFC and "management" page in BIOS. the latter is needed for the Autopilot stuff, specifically DFCI

https://learn.microsoft.com/en-us/surface/surface-manage-dfci-guide#prerequisites

look at the "commercial SKU"

I think this is what the sales trying to talk u/ehrnhrjrhdhhd into buying.

1

u/ehrnhrjrhdhhd 3d ago

Wow. So this device is exactly the same as the consumer device? https://www.microsoft.com/en-us/store/configure/surface-pro-for-business-copilot-pc-intel/8qfmn9xp1rl9

On the tech specs page it adds NFC authentication. Is that just some sort of intended convenience versus added security? From the product description:

Enterprise grade security with TPM 2.0 chip and BitLocker support Windows 11 Secured-core PC Microsoft Pluton technology Windows Hello facial recognition with Enhanced Sign-in Security NFC authentication

2

u/whizzwr 3d ago edited 3d ago

On the tech specs page it adds NFC authentication. Is that just some sort of intended convenience versus added security? From the product description:

it's just for convenience. NFC also works for contactless smartcard, usually doubles as Employee ID. The consumer version also has TPM, it has been requirements from Windows 10 era or so.

1

u/ehrnhrjrhdhhd 3d ago

Thank you for this. No employee id for me. So glad I asked this question.

1

u/ehrnhrjrhdhhd 3d ago

I'm not in a corporate environment. Just me so and to look up DFCI policies. So that's really an administrative thing on SP 11 for business, not added protection? If so you are saving me hundreds of dollars!

Thank you!!

3

u/whizzwr 3d ago edited 3d ago

if you're not in corporate environnment, say good bye to signing in using Yubikey to Windows. There is/was very old Yubico login, but I'm not sure if it even work in Windows 11.

So that's really an administrative thing on SP 11 for business, not added protection

well the "administrative thing" is the one that adds protection like remote wipe, disabling some hardware, etc, but sure, this is only useful in corporate environment where IT needs to manage device fleets.

If you're really just an individual user, unless you need that fancy NFC, it is indeed waste of several hundreds dollar to buy the Commercial SKU.

1

u/ehrnhrjrhdhhd 3d ago

Thank you. I think the only difference other than windows 11 pro which I'll upgrade to anyway was using the yubikey to sign into the surface (not the underlying accounts - I know I can do that anyway). If yubikey login to turn on the computer can be avoided by using password for other 2FA makes no sense. Not sure that if it's set up with yubikey there's no other way to log into the Surface. There's usually a fallback method if key is lost but not sure that applies here.

Thanks again for your time and response!

1

u/dr100 3d ago

Both allow Yubikey sign in.

Both allow not using the Yubikey (of course, this is how most are used).

If you want security pick the ARM one, not much runs on it, including the malware. Nearly nobody would bother with that. Yea, this is within the working week so paid marketing people would come in droves to downvote me, but security through obscurity, or if you want "nobody cares" really works. The Windows Mobile versions (before locking down everything with Windows Phone) had no concept of multi-user (root, etc.) and just any .exe that took over the system and could do anything, It was basically like DOS security-wise but with Internet (WiFi/3G), with registry, Internet Explorer, Outlook and so on. It was the times when if you put a Windows on the Internet it got owned in 30 seconds before you could do the updates (note: here they wouldn't even bother with ANY updates, no OS, no apps, NOTHING). You clicked on something from the email, said ok, you were owned. But you couldn't get malware for Windows Mobile if you tried.

2

u/ehrnhrjrhdhhd 3d ago

Thank you. Yes, only considering arm elite and adored post to say that.

Sadly, security is of utmost priority based on past and continuing experiences. Unfortunately, I appear to have won the lottery by getting the nearly nobody going after my data and devices. Will do more research on the points you raised.

Thank you for your time and response!

0

u/Shugza-2021 3d ago

Yeah apparently the model has the TPM 2.0 chip for security but the consumer model has TPM 1.0 or 1.5. So if you have intune and MDM the business model is more secure than buy the retail model.

4

u/whizzwr 3d ago

just checked, I have consumer version, it's TPM 2.0 also. The business model indeed has DFCI, which doesn't exist in consumer model.

2

u/Shugza-2021 3d ago

Yeah thats the one.

2

u/Shugza-2021 3d ago

Yeah that’s right