How To Enable Secure Boot On MSI | Step-By-Step Setup

To enable Secure Boot on an MSI motherboard, switch the BIOS to UEFI mode, disable CSM, activate Secure Boot in the Windows OS Configuration menu, and install default Platform Keys.

Secure Boot is the boot-level security standard Windows 11 requires, but finding the right toggle inside an MSI BIOS can be picky if you don’t know exactly where to look. The three things holding up activation are almost always the same: the drive isn’t GPT, the BIOS is still in Legacy/CSM mode, or the Platform Keys haven’t been set. Here is the exact sequence to get Secure Boot running on any modern MSI motherboard.

Prerequisites

Secure Boot will not turn on unless your disk is GPT, your BIOS is set to UEFI, and you are running Windows 10 or 11. Skipping this gate check is the single biggest reason Secure Boot stays grayed out or boots to an error. Run these checks before you touch the BIOS.

Step 1: Check Your BIOS Mode and Disk Partition

Open the Run dialog (Win + R), type diskmgmt.msc, right-click your main drive, and select Properties > Volumes. Confirm the Partition Style is GPT. If it is MBR, back up your data first, then run mbr2gpt /validate /allowFullOS followed by mbr2gpt /convert /allowFullOS from an elevated command prompt.

Next, open System Information by running msinfo32. Find the BIOS Mode entry. If it says UEFI, you are clear. If it says Legacy or CSM, a BIOS change is required.

Step 2: Enter BIOS and Switch to UEFI Mode

Restart the PC and press DEL repeatedly during the initial POST screen to enter the MSI BIOS. Once inside, press F7 to switch from Easy Mode to Advanced Mode. Navigate to Settings > Advanced > Windows OS Configuration. Change CSM/Legacy Mode to UEFI. Press F10 to save and reboot.

Step 3: Enable Secure Boot in the Windows OS Configuration Menu

Re-enter the BIOS (DEL). Go to Settings > Advanced > Windows OS Configuration > Secure Boot. Set Secure Boot to Enabled. If prompted about Platform Keys (PK), select Install Default Keys or Restore Factory Keys. This takes the system out of “Setup Mode” and into “User Mode,” which is required for Secure Boot to lock. Set Secure Boot Mode to Standard. Press F10 to save and exit.

MSI recommends this standard path. For more details on the underlying UEFI implementation, check the official MSI guide on enabling Secure Boot and TPM 2.0.

Step 4: Enable TPM 2.0 or AMD fTPM

Re-enter the BIOS one more time. Navigate to Settings > Security > Trusted Computing. Enable Security Device Support. This activates TPM 2.0 on Intel boards or AMD fTPM on Ryzen systems. Press F10 to save and reboot. Without this step, Windows 11 may still report the system as incompatible even with Secure Boot turned on.

Step 5: Verify Secure Boot Is Active in Windows

Open the Run dialog (Win + R), type msinfo32, and press Enter. Look for Secure Boot State. It must read On. If it reads Off, double-check that CSM is fully disabled and that default Platform Keys were installed. This screen is the final confirmation that the entire chain is working.

Why Is Secure Boot Grayed Out or Unavailable in My MSI BIOS?

If the menu options above are grayed out or simply missing, the issue is almost always one of the three problems below. Each has a clean fix.

Enabling Secure Boot on an MSI board is a one-time setup cost that unlocks Windows 11 compatibility and strengthens your system’s boot-level security. The key is patience: verify the GPT partition, the UEFI mode, and the Platform Keys before you expect the toggle to stick. Once all three are in place, the menu in Windows OS Configuration works as intended.