Update Microsoft Surface Firmware using SCCM

Jonathan LefebvreApplication, SCCM, WINDOWS 109 Comments

Usually, when it comes to driver management, for computer already deployed, we say ‘If it ain’t broken don’t fix it’. Once in a while, a driver or firmware could require an update because of a bug reported by multiple users but that would usually be an exception.

Microsoft Surface devices have proven over and over that this statement doesn’t apply to them. Microsoft Surface, since the beginning of the brand, tend to work better with latest firmware version. Microsoft often releases new firmware revision along major Windows 10 releases.

For home users, the update will be applied with the standard Windows Update process and delivered in stages. For businesses, firmware update management by WSUS or SCCM is not yet available. (Feature is included in the latest SCCM Technical Preview 1706 but not yet in the latest 1702 production version)

This blog post will detail how to update the Microsoft Surface firmware using SCCM.

SCCM Update Microsoft Surface Firmware Prerequisites

  • Download the latest MSI version of the needed firmware
  • Surface 3 and newer model
    • Older models don’t have an available MSI version for Firmware management
[su_box title=”Important Note” style=”glass” title_color=”#F0F0F0″]Microsoft has started to release firmware updates based on Windows 10 builds. Vigilance is key here.
As an example, the Surface Pro 4 has a release specifically for the Creators Update (build ID 15063).

This would mean that older Windows 10 version should use the other release of the firmware, which as no build ID in the name.

SCCM Update Microsoft Surface Firmware



Why use the MSI to Update Microsoft Surface Firmware?

Microsoft Surface firmware contains multiple drivers, software, and UEFI updates. Most releases do not upgrade all drivers, firmware and UEFI at once. Some releases only update one or two component, while others will update pretty much everything. Having an inventory of each of those components would be huge to maintain and managed throughout releases.

SCCM Update Microsoft Surface Firmware

Using the provided MSI file provides an easy way to inventory of all those components since it has an entry in Programs and Features once installed.

SCCM Update Microsoft Surface Firmware

Update Microsoft Surface Firmware History

The update history for all Microsoft Surface models is available here.

As an example, the update for a Surface Pro 4 on May 25th had many components updated:

SCCM Update Microsoft Surface Firmware

Microsoft also provides a preview of what to expect from the update:

SCCM Update Microsoft Surface Firmware

Microsoft has inconsistency with firmware version. In this example, the MSI version which will eventually display in Program and Features, is not on the history page.

The only thing matching “approximately” is the Date Published. Word of advice, keep track of version and release dates for future debugging.

   SCCM Update Microsoft Surface Firmware

Create application for SCCM Microsoft Surface Firmware Update

We will now shows how to deploy the Firmware MSI files using SCCM:

  • Under Software Library \ Application Management \ Applications, select Create application

SCCM Update Microsoft Surface Firmware

  • Provide the path to the downloaded MSI file

SCCM Update Microsoft Surface Firmware

  • On the Import Information pane, click Next 

SCCM Update Microsoft Surface Firmware

  • Add additional information if desired, click Next

SCCM Update Microsoft Surface Firmware

  • On the Summary pane, click Next 

SCCM Update Microsoft Surface Firmware

  • Click Close to close the wizard

SCCM Update Microsoft Surface Firmware

  • Select your new application and on the top ribbon, click Distribute Content to send your content to your distribution points

SCCM Update Microsoft Surface Firmware

  • Looking at the Detection Method under the Deployment Type, we see that it looks for an MSI Product Code

SCCM Update Microsoft Surface Firmware

SCCM Update Microsoft Surface Firmware

The deployment can be done just like any other deployment.

[su_box title=”Important consideration” style=”glass” title_color=”#F0F0F0″]Microsoft Surface firmware update require a reboot. If the deployment is mandatory, the client computer will reboot to complete the installation. Plan accordingly. Target deployment date and time outside of working hours. Use Maintenance Windows if necessary.[/su_box]
  • The user will see the following happen on the Microsoft Surface after the installation as been triggered by SCCM
  • Restarting

SCCM Update Microsoft Surface Firmware

  • Getting Windows Ready

SCCM Update Microsoft Surface Firmware

  • Please wait while we install a system Update

SCCM Update Microsoft Surface Firmware

  • After the reboot, Working on updates

SCCM Update Microsoft Surface Firmware

  • Under the hood, the .BIN files under C:\Windows\Firmware will be updated:

SCCM Update Microsoft Surface Firmware

  • After the installation, the SurfacePro4 Update is visible in the Programs and Features

SCCM Update Microsoft Surface Firmware

Monitor Microsoft Surface Firmware Versions

  1. You can use a built-in report (Computers with specific software registered in Add Remove Programs) to check the which devices have the Firmware installed using hardware inventory. Just use the exact name that is displayed in Program and Feature to target your search.
  2. You can use our new Asset – Surface devices report to get detailed information about every Microsoft Surface in your environment, including UEFI versions and Firmware versions when deployed with this method.

SCCM Update Microsoft Surface Firmware

9 Comments on “Update Microsoft Surface Firmware using SCCM”

  1. In regards to the Recovery Key prompt I assume the option to Suspend Bitlocker using SCCM wasn’t selected, but my bigger question is in regards to updating the Docking Stations, has that been remedied with the latest version of SCCM 1810 – 5.00.8740.1042?

  2. Hey Jonathan,

    SInce i have read your comment from feb 2018 that there is command line to update surface docks.

    Do you know if MS found any way to do it from SCCM as we have around 200 users who are given with Surface pro that needs a Surface dock as well and updating them manually will be a laborious job and we can not give the users with LA rights as well for this thing only.

    if you can suggest an option since microsoft is recommending this only for updating the docks:



  3. When I distribute the .msi file it shows the size is 91292448kb which is 91GB in distmgr.log. The msi file is only 226mbs. Do you know why this happens. We have SCCM Version 1710 on Windows Server 2012 R2.

    1. Figured out that it was including some other drivers which were in that folder. Made a new folder for Surface Drivers. It works!!!

    1. Hi Jamie,

      when I wrote this blog I looked to find a way to do so. I remember that there was no command line to do so at that time.

      maybe the tool as been updated with command line, but I haven’t looked 🙁

  4. I have noticed you don’t monetize your page, don’t waste your
    traffic, you can earn extra bucks every month because you’ve got high quality content.
    If you want to know how to make extra money, search for: Mrdalekjd methods for $$$

  5. Hi Nice Blog,

    How do you handle bitlocker in this case? When enabled users get that bitlocker thinks there is a change in hardware or something and aks for the recovery key.



    1. Hi ErwinG,
      I had BitLocker enabled for my test and never had prompt for recovery key.

      Can you provide more details?
      SCCM version, OS version, BitLocker configuration


Leave a Reply