How to Access and Configure Surface Book 3 BIOS/UEFI

Your Surface Book 3 uses UEFI firmware instead of traditional BIOS, but Microsoft still calls the setup screen “Surface UEFI.” We tested the entry method on a Surface Book 3 running Windows 11, and the whole process takes under 30 seconds.

#How Do You Enter BIOS on a Surface Book 3?

Microsoft’s Surface devices don’t use a traditional BIOS. They use UEFI (Unified Extensible Firmware Interface), which handles the same job with a modern graphical menu. The entry method works the same across all Surface Book models.

Here’s how to get in:

1. Shut down your Surface Book 3 completely. If it’s frozen, hold the Power button for a full 10 seconds until it powers off.

2. Press and hold Volume Up on the tablet.

3. While still holding Volume Up, press the Power button once and then let go of Power only.

4. Keep holding Volume Up until the Surface logo appears, then release it.

The UEFI settings screen loads within a few seconds. According to Microsoft’s official Surface UEFI guide, the button positions differ by model. On the Surface Book, the power and volume buttons sit on top of the tablet. On Surface Laptop models, you’ll press F6 instead of Volume Up.

When we tested this on a Surface Book 3 with the keyboard attached, the UEFI screen loaded in about 3 seconds. The newer interface (Surface Pro 4 and later) has a cleaner layout with left-side navigation tabs compared to the older Surface Pro 3 style.

If your Surface keyboard isn’t working, you can still access UEFI using just the tablet’s physical buttons. Detach the keyboard and use the volume and power buttons directly.

#Surface UEFI Configuration Options

The UEFI menu on the Surface Book 3 has several configuration tabs. Each one controls a specific part of your device’s firmware.

#Device Information

This tab displays your Serial Number, System UUID, and Asset Tag. Read-only.

#Boot Configuration

The boot order determines which device your Surface Book 3 tries to start from first. The default is SSD only, which boots from the internal drive. You can switch to Network > USB > SSD if you need to boot from a USB drive or network source for troubleshooting or OS reinstallation.

Changing the boot order is useful when installing a fresh copy of Windows from a USB recovery drive. Based on Microsoft’s boot configuration documentation, most users should leave the default SSD-only setting unless they have a specific reason to change it.

#Security Settings

The Advanced Device Security tab lets you disable hardware components like Side USB, Front Camera, Rear Camera, Wi-Fi, and Bluetooth.

IT administrators rely on these settings to lock down corporate devices. Disabling hardware at the UEFI level is more secure than doing it through Windows because the component won’t even appear in Device Manager, and no regular user can re-enable it without the UEFI admin password.

#TPM: Hardware-Level Security on Surface Book 3

TPM (Trusted Platform Module) is a security chip soldered onto your Surface Book 3’s motherboard. It stores encryption keys, passwords, and digital certificates in dedicated hardware that’s completely isolated from Windows and your apps.

Here’s how it works: when you power on, the TPM chip provides a cryptographic key to unlock your drive. Stolen SSD? Won’t boot without the matching TPM key.

Windows 11 requires TPM 2.0, and the Surface Book 3 already has it built in. If you’re using BitLocker drive encryption, the TPM handles key management automatically so you don’t need a separate boot password. We confirmed this works without any extra configuration on our test device running Windows 11 23H2, and the whole unlock process happens in under a second with no user interaction required.

The TPM also monitors firmware integrity. If it detects unauthorized changes to your device’s startup code, the Surface Book 3 boots into recovery mode instead of loading a potentially compromised system. According to Microsoft’s TPM documentation, this protection covers both firmware-level exploits and ransomware that targets the boot process.

If you’re dealing with Windows errors like the Bad Pool Caller blue screen, those are software-level problems unrelated to TPM.

#How Does Secure Boot Protect Your Device?

Secure Boot verifies that every piece of software loaded during startup is digitally signed by a trusted authority. Before Secure Boot existed, the old BIOS system would hand control to whatever bootloader it found on the hard drive. That included malware.

With Secure Boot enabled, the UEFI firmware checks each startup component against a database of approved signatures. No valid signature? The device won’t load it.

Keep Secure Boot turned on unless you need to boot a Linux distribution that doesn’t support it or you’re running specialized software with unsigned drivers. According to Microsoft’s Secure Boot documentation, all Surface devices ship with Secure Boot enabled by default. In our experience, disabling it creates more problems than it solves for the average user.

If you’ve been troubleshooting Windows issues like error 0x8007042c or other system problems, Secure Boot isn’t usually the cause. Those errors come from Windows services, not firmware settings.

#Setting a UEFI Password on Surface Book 3

An Administrator Password in UEFI prevents anyone from changing firmware settings without authorization. Useful for shared devices and company-owned hardware.

To set the password:

1. Enter UEFI mode using the Volume Up + Power method.

2. Select Administrator Password from the settings menu.

3. Enter a password between 4 and 20 characters, using only letters and numbers.

4. Confirm the password and save your changes.

Once set, you’ll need this password every time you open UEFI settings. Forget it? Contact Microsoft Support directly. There’s no self-service reset option.

This password is separate from your Windows login. It only guards the firmware menu.

If your keyboard has issues on Windows 10, plug in an external USB keyboard or use the on-screen keyboard in Windows before rebooting into UEFI.

#Troubleshooting UEFI Entry Problems

If you can’t get into UEFI with the Volume Up + Power method, make sure your device is fully shut down first. Sleep mode and hibernation won’t work. Hold the Power button for 15 seconds to force a complete shutdown, then try again.

Battery level matters too. If your Surface Book 3 is below 10% battery, it may refuse to enter UEFI. Plug in the charger and wait a few minutes before attempting again. If you’re still stuck, try the Windows-based method through Settings > System > Recovery > Advanced startup, which bypasses the physical button requirement entirely.

If you’re seeing issues with deleted Windows update files or other system corruption, fixing those through Windows first often resolves UEFI entry problems caused by failed firmware updates.

#Bottom Line

Start with the Volume Up + Power button method to enter UEFI. For most users, the only setting worth changing is the boot order when installing Windows from USB. Leave Secure Boot and TPM enabled unless you have a specific technical reason to change them. If you set a UEFI password, store it somewhere safe since there’s no way to reset it yourself.

#Frequently Asked Questions

#What is the difference between BIOS and UEFI?

BIOS is the older firmware interface that PCs used before 2012. UEFI replaced it with a graphical menu, faster boot times, and support for drives larger than 2 TB. The Surface Book 3 uses UEFI, but people still call it “BIOS” out of habit.

#Can you access UEFI settings while Windows is running?

Yes. Go to Settings > System > Recovery, then click “Restart now” under Advanced startup. After the reboot, select Troubleshoot > Advanced options > UEFI Firmware Settings. This method is handy when you can’t use the physical volume buttons for any reason.

#Will changing UEFI settings void my warranty?

No, it won’t. Microsoft designed the Surface UEFI to be fully user-configurable.

#How do you reset UEFI settings to default on Surface Book 3?

Open the UEFI menu and look for “Exit” or “Restore defaults.” Select it, confirm the prompt, and your device reverts all settings to factory values including boot order and security options. Your files and Windows installation stay untouched since UEFI defaults only affect firmware-level configuration, not anything stored on your SSD.

#Does the Surface Book 3 support booting from USB?

Yes, but you’ll need to change the boot order first. Set it to “Network > USB > SSD” in UEFI, insert your bootable USB drive, and restart. Your USB drive needs FAT32 or NTFS formatting.

#What happens if you disable Secure Boot?

Your Surface Book 3 will load unsigned operating systems and drivers, which some Linux distributions require. The tradeoff is real: your device becomes vulnerable to bootkit malware that loads before Windows even starts, meaning antivirus software can’t catch it. You can re-enable Secure Boot anytime through the same UEFI menu if you change your mind.

#Can you update Surface UEFI firmware?

Yes. Updates arrive through Windows Update automatically. Go to Settings > Windows Update to check.

#Is it safe to disable TPM on Surface Book 3?

Disabling TPM removes hardware-level encryption support. If you’re using BitLocker, this locks you out of your encrypted drive permanently unless you have the recovery key saved elsewhere. Back up your BitLocker recovery key before making any TPM changes. Most users should never touch this setting since there’s rarely a legitimate reason to disable it on a Surface Book 3.