Surface Pro 9 Firmware

[Michael Rosiles]

The update is largely just tightening up a couple loose ends under the hood, and you will not experience any noticeable differences between firmware versions, but it is always nice to know you are the most up to date!

@mgd, moving forward firmware releases will be more at the forefront of our announcements, as this firmware update for Surface was a hotfix issue (amplitude inconsistency across hardware revisions, tightening sequencing parameters via CV, etc.) that we notified affected customers about.

How you manage Surface driver and firmware updates may vary depending on your environment and organizational requirements. In larger organizations, IT admins typically stage deployments internally and allocate time to test upgrades before rolling them out to user devices.

This article is intended for IT professionals and technical support agents and applies to Surface devices only. If you're looking for help to install Surface updates or firmware on a home device, see Download drivers and firmware for Surface.

While enterprise-grade software distribution solutions continue to evolve, the business rationale for centrally managing updates remains the same: Maintain the security of Surface devices and keep them updated with the latest operating system and feature improvements. This IT practice is essential for sustaining a stable production environment and making sure that users aren't blocked from being productive.

When Windows 10 reaches end of support (EOS) on October 14, 2025, Microsoft will no longer release security updates, bug fixes, time zone updates, or technical support from Microsoft. To learn more, including transition options for organizations needing more time, see Plan for Windows 10 EOS with Windows 11, Windows 365, and ESU

Microsoft Intune admin center is the recommended solution for large organizations to manage Surface updates. Configuration Manager allows you to synchronize and deploy Surface firmware and driver updates with the Configuration Manager client. Integration with Intune lets you see all your managed, co-managed, and partner-managed devices in one place. The Microsoft Surface Management Portal is a centralized place in the Microsoft Intune admin center where you can self-serve, manage, and monitor your organization's Intune-managed Surface devices at scale.

The Microsoft Deployment Toolkit (MDT) is a free tool for automating Windows deployment. It uses the task sequence engine from Configuration Manager, and can also install drivers and software updates during the deployment.

Configuration Manager and MDT both use the Windows Preinstallation Environment (Windows PE) during the deployment process. Windows PE supports only a limited set of basic drivers such as network adapters and storage controllers. Drivers for Windows components that aren't part of Windows PE might produce errors. You can prevent such errors by configuring the deployment process to use only the required drivers during the Windows PE phase.

By having Device Firmware Configuration Interface (DFCI) profiles built into Intune, Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings (including startup options and built-in peripherals), and lays the groundwork for advanced security scenarios in the future. For more information, see the following resources:

To maintain a stable environment, we strongly recommend that you keep parity with the most recent version of Windows 10. For best practice recommendations, see Prepare servicing strategy for Windows client updates.

We have majority of our workstations are Surfaces devices. When we use the SCCM firmware/driver upgrade service and download all required, it is showing hundreds or less that require the upgrade even though we know there are 1000 - 2500 surface devices in the environment or more.

Thanks for the insight I agree with the point on SCCM using detection rules to determine applicability or compliance of devices when it comes to updates. which is why this is so weird. If no surface devices showed as requiring the updates, I would definitely be looking into the detection method being used, but the fact that some devices are showing a requiring these updates indicates the detection method is sound (or it appears to be).

I tried that seemingly without success. I got the firmware version from UEFI.
I used CSME System Tools v11r46 and fptw64 to get a dump, and got an spi.bin file.
But reading it with MEAnalyzer v1.137 gives me a bunch of errors.

Background.
I wanted to replace the battery, but when I was disassembling the tablet, I accidentally damaged the touch cable. As a result, the touch did not work on the right third of the screen.
Later, I ordered a second-hand display. After the replacement, the touch worked fine. But only for a day.
A week ago, I accidentally noticed on the screen that the tablet was installing new firmware. After that, the touch stopped working altogether.
To check, I put the old display on, but the result is the same. The touch does not work.

I took a firmware dump with ME Tools and opened it with FIT (as described on Badcaps), but touch support (ISH) is enabled. HID-compiliant touch screen (twice) and Intel(r) Precise Touch Device are also present in windows without errors.

After the replacement, the touch worked fine. But only for a day.
A week ago, I accidentally noticed on the screen that the tablet was installing new firmware. After that, the touch stopped working altogether.

I had some thoughts that the display (I mean the touchscreen board on it) may have its own identifier that does not allow replacement, or it must be registered somewhere (like on some phones: iPhones and others).

Can there please be an option to disable the need for the build plate to cool down before the printer allows you to hit "Confirm removal" or do anything else?
-It wastes time because usually I've removed the part already

-It wastes energy because now the build plate has to be re-heated for the next print.
For me, it ends up making me handle hot stuff much more- lots of times it's too frustrating to wait, so I will remove the hot glass build plate and stick a giant chunk of aluminum on there to get the thing to let me keep going.

This actually makes me handle the glass plate more, not less. Because I remove the glass plate and wrap it in a towel. Then I stick my bare hands directly on the aluminum over the sensor to try to speed the cooling up.

The first time it happened I didn't realize it was trying to cool. I had put a towel over the glass to keep it warm while I waited for the core to cool. I had to wait a LONG time. It wasn't clear to me that it was waiting for the bed to cool. This messaging may have been from an older firmware, I'm not sure.

I would certainly agree it would be nice to tell the printer to skip that when you have to stop your print ahead of time and just want to restart it, though I'm not sure how UM would differentiate between those circumstances.

I've been printing smaller single layer things for light diffusion, and because you can print only one at a time in vase mode and they print quickly, this wait time really becomes a big portion of the total cycle time.
It's not a big print where I'm worried about distortion, and they just pop right off the build plate by hand.
I wish there was an option to click once on something that said "Yes, I know I might get burned if I'm dumb about it" and then it would allow you to hit the "confirm removal" button as soon as the print finishes from then on until the option is changed back.

I can't say I was ever a fan of this "feature" (it's supposed to stop you from damaging the print prematurely and yes people have also complained about us allowing you to remove the print too early) but despite my arguments very similar to yours it got in ages ago, it's a bit more visible now but it's been there for quite a while.
We have a new UX person since then though so it's at least up for discussion, I'll point him to this discussion.

When I am printing with PC on a 110C bed and I forgot to apply my adhesion glue/there was a leveling issue/a material blob from the nozzle might ruin my print/with the first layer I notice a slicing mistake/somewhere mid-print I notice something isn't printing like I thought it would and other scenarios...Waiting for a 110C bed to cool down to 60C so I can retry my print, which heats back up to 110C again takes quite a while.

Yes, the bed is very hot while doing this and yes, there is the risk of burning. But even when removing failed prints or first layers I don't touch the bed. I take a metal spatula and remove whatever I have to remove. Sometimes there isn't even the need to remove anything.

The idea to make the printer operation more safe through the warning of a hot surface and to let the printer cool down before starting a new one is a good one in theory.
But it doesn't even line up with the ability to set the bed temperature manually to 120C without a warning on the printer or that I can open the doors while printing and nothing stops or slows down.

I would therefore like to see an option to skip the cool-down as well. Let it have a confirmation question with a big red warning so the user can see what consequences this has and knows what he is about to do. I believe that mostly experienced users would use this function anyway.

I try to make safe suggestions,You should understand the context and ensure you are happy that they are safe before attempting to apply my suggestions, what you do, is YOUR responsibility. Location Halifax UK

It could coincide with when I changed the nozzle. I used a large tool so I probably had too much torque. How can I test that theory? Is the only way to take apart the entire hotend/extruder? Also, if that's the problem can I straighten it somehow? I have access to a new heatbreak at a reasonable price if it's that.

c80f0f1006