# Windows AIK enrollment fails with HTTP 404 for Microsoft Pluton MSFT-KeyId

**URL:** <https://community.frame.work/t/windows-aik-enrollment-fails-with-http-404-for-microsoft-pluton-msft-keyid/84504>\
**Category:** Framework Desktop\
**Tags:** windows\
**Created:** [August 30, 2026, 10:34pm UTC](https://community.frame.work/t/windows-aik-enrollment-fails-with-http-404-for-microsoft-pluton-msft-keyid/84504 "2026-08-30T22:34:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![no4b](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@no4b](https://community.frame.work/u/no4b)\
**Post date:** [August 30, 2026, 10:34pm UTC](https://community.frame.work/t/windows-aik-enrollment-fails-with-http-404-for-microsoft-pluton-msft-keyid/84504/1 "2026-08-30T22:34:11Z")

</div>

I have a Framework Desktop with Microsoft Pluton TPM 2.0. I’m trying to run the new beta of **Modern Warfare 4** which requires Secure Boot and TPM attestation.

My configuration:

- BIOS: 3.06
- TPM firmware: 10.7.0.2
- TPM revision: 1.59
- Secure Boot: enabled
- Windows is installed on a SATA SSD connected through a USB adapter

I also ran [Activision’s Secure Attestation Wizard](https://storage.googleapis.com/atvi-support-psapi-prod/CODSecureAttestationWizard_1.1.3.zip):

It reports:

- Secure Boot: OK
- TPM 2.0: OK
- TPM attestation: **Failed**
- Firmware upgrade: **Required**

The problem is that I’m already running the latest Framework BIOS (3.06) so there doesn’t appear to be a newer BIOS/firmware update available.

While debugging this I found that Windows cannot successfully enroll the TPM Attestation Identity Key (AIK):

```auto
certreq.exe -enrollaik -f -machine -config ""
MSFT-KeyId-<REDACTED>
https://MSFT-KeyId-<REDACTED>.microsoftaik.azure.net/templates/Aik/scep
GetCACaps
GetCACaps: Not Found
HTTP/1.1 404 Not Found

"The authority msft-keyid-<REDACTED>.microsoftaik.azure.net does not exist."

EnrollStage = 140
Error: 0x80190194 (HTTP_E_STATUS_NOT_FOUND)

```

The failure happens before **`CreateRequest` / `SubmitRequest`**. As a result, Windows TPM attestation never reaches Ready For Attestation.

I’d particularly like to know whether:

1. this is a known issue with the current Pluton firmware (`10.7.0.2`),
2. a newer Pluton firmware is available independently of the Framework BIOS,
3. the Framework Desktop’s Pluton/TPM configuration requires some additional provisioning, or
4. the Microsoft AIK enrollment service needs to recognize/register these TPMs.

I’ve already sent the diagnostic information to Framework Support including the relevant key information, but I’m posting here in case anyone else has encountered this.