How to Enable Secure Boot in MSI Click BIOS 5

MSI Click BIOS 5 can make Secure Boot look harder to find than it really is. On many MSI motherboards, the Secure Boot menu does not appear until the system is already configured to boot in UEFI mode.

That means the right order is important:

1. Check how Windows is currently booting.
2. Make sure the Windows system disk is GPT if you are still using Legacy/CSM.
3. Switch MSI Click BIOS 5 to UEFI mode.
4. Enable Secure Boot.
5. Verify the result back in Windows.

Do not skip straight to changing CSM or Secure Boot settings. If Windows was installed in Legacy mode on an MBR disk, switching the firmware to UEFI without preparing the disk can leave the PC unable to boot.

Check Your Current Windows Boot Mode First

Press Windows + R, type:

msinfo32

and press Enter.

In System Summary, find:

• BIOS Mode
• Secure Boot State

A normal Secure Boot configuration should eventually show:

BIOS Mode: UEFI
Secure Boot State: On

What you see now determines how safely you can proceed.

BIOS Mode: UEFI

Good. Windows is already booting through UEFI.

You can normally enter MSI Click BIOS 5 and enable Secure Boot without converting the Windows system disk.

BIOS Mode: Legacy

Stop before changing BIOS UEFI/CSM Mode.

Your Windows installation may still be using an MBR system disk. Check the partition style before changing the firmware to UEFI.

Secure Boot State: Unsupported

This often appears when Windows is still booting in Legacy/CSM mode.

Fix the UEFI boot configuration first rather than treating Secure Boot as a simple on/off switch.

Enter MSI Click BIOS 5

Restart the PC and begin tapping Delete as soon as the MSI logo appears.

On most MSI desktop motherboards, Delete opens BIOS Setup.

If Windows starts before you reach BIOS, restart and begin tapping Delete earlier.

You can also enter UEFI from Windows 11:

Settings > System > Recovery > Advanced startup > Restart now

Then choose:

Troubleshoot > Advanced options > UEFI Firmware Settings > Restart

Once MSI Click BIOS 5 opens, you may land in EZ Mode.

Press F7 to switch between EZ Mode and Advanced Mode when necessary.

If Windows Already Uses UEFI, Enable Secure Boot

When msinfo32 already reports BIOS Mode: UEFI, the process is straightforward.

In MSI Click BIOS 5, go to:

Settings > Advanced > Windows OS Configuration

Look for:

BIOS UEFI/CSM Mode

Make sure it is set to:

UEFI

MSI documents that the Secure Boot submenu appears when BIOS UEFI/CSM Mode is set to UEFI.

You should then see the Secure Boot option in the same Windows OS Configuration area.

Open it and set:

Secure Boot: Enabled

If your BIOS provides a Secure Boot Mode setting, use Standard unless you intentionally manage your own Secure Boot keys.

Press F10, review the changes, and choose Yes to save and restart.

What If Secure Boot Is Missing in MSI Click BIOS 5?

A missing Secure Boot option usually means the motherboard is still using CSM.

Return to:

Settings > Advanced > Windows OS Configuration

Check:

BIOS UEFI/CSM Mode

If it is set to CSM, Secure Boot may remain hidden.

MSI’s own Click BIOS documentation states that the Secure Boot submenu appears when the system is configured for UEFI mode.

Before changing CSM to UEFI, however, confirm that Windows can boot that way.

If msinfo32 already says:

BIOS Mode: UEFI

you can focus on the BIOS setting itself.

If Windows says:

BIOS Mode: Legacy

check the system disk first.

Check Whether the Windows Disk Is GPT or MBR

Right-click Start and open Terminal (Admin).

Run:

Get-Disk | Select-Object Number, FriendlyName, PartitionStyle, IsBoot, IsSystem

Find the Windows system disk and look at PartitionStyle.

If it says:

GPT

the disk format is suitable for UEFI booting.

If it says:

MBR

do not simply switch MSI Click BIOS 5 from CSM to UEFI and hope Windows starts.

Microsoft provides MBR2GPT for converting supported Windows system disks from MBR to GPT without deleting the existing data.

Back up important files first.

Then open Command Prompt as administrator and validate the disk:

mbr2gpt /validate /allowFullOS

If validation succeeds, the conversion command is:

mbr2gpt /convert /allowFullOS

After a successful conversion, restart into MSI Click BIOS 5 and change:

Settings > Advanced > Windows OS Configuration > BIOS UEFI/CSM Mode

to:

UEFI

Save and restart.

Microsoft states that after MBR2GPT converts the system disk, the firmware must be configured to boot in UEFI mode.

You can read the official MBR2GPT documentation before making the conversion.

Secure Boot Enabled but Windows Still Says Off

This is different from a missing Secure Boot option.

If MSI Click BIOS 5 says:

Secure Boot: Enabled

but Windows still reports:

Secure Boot State: Off

go back into the Secure Boot menu and look at the mode and key configuration.

MSI Click BIOS 5 commonly provides:

• Secure Boot
• Secure Boot Mode
• Enroll all Factory Default keys
• key-management options

For a normal Windows PC that does not intentionally use custom Secure Boot keys, I would use:

Secure Boot: Enabled
Secure Boot Mode: Standard

MSI’s BIOS documentation explains that Standard mode automatically loads the secure keys from BIOS, while Custom mode allows manual key management.

If the system has no enrolled keys, look for an option such as:

Enroll all Factory Default keys

or wording that clearly restores the motherboard’s factory Secure Boot keys.

Do not select Delete all Secure Boot variables just because Secure Boot is not active. That removes the Secure Boot keys and can leave the system in Setup Mode.

After restoring the correct factory keys, save with F10, restart Windows, and check msinfo32 again.

For a deeper explanation of this specific state, see my Secure Boot Enabled but Not Active guide.

Verify Secure Boot After the Restart

Do not assume the BIOS change worked just because the setting was saved.

Press Windows + R, enter:

msinfo32

and confirm:

BIOS Mode: UEFI
Secure Boot State: On

For a second check, open Terminal (Admin) and run:

Confirm-SecureBootUEFI

A working Secure Boot configuration should return:

True

If it returns:

False

Windows can see Secure Boot, but it is not currently active.

If it reports that the cmdlet is not supported on the platform, Windows may not be booting through the expected UEFI environment.

Secure Boot Is Greyed Out in MSI BIOS

A greyed-out control usually means another firmware requirement has not been met.

Check these in order:

• BIOS UEFI/CSM Mode is set to UEFI.
• Secure Boot Mode is not stuck in an unusual custom-key configuration.
• Factory keys are present.
• Windows is actually booting through UEFI.
• The motherboard BIOS is recent enough for the hardware and operating system you are using.

Do not update the BIOS merely because one option is greyed out.

If you want to compare your installed version with MSI’s current release for the board, use my guide to checking the BIOS version in Windows 11 first.

Then go to MSI’s support page for the exact motherboard model and read the BIOS release notes before updating anything.

MSI Secure Boot for VALORANT and Other Anti-Cheat Games

A game that requires Secure Boot does not care only about what the MSI BIOS menu says.

Windows needs to report:

BIOS Mode: UEFI
Secure Boot State: On

If Secure Boot is enabled in Click BIOS 5 but Windows says Off, the anti-cheat system may continue rejecting the PC.

VALORANT is a common example because Riot Vanguard can require Secure Boot and TPM 2.0 on Windows 11.

Use my VALORANT Secure Boot error guide when Windows already reports Secure Boot correctly but Vanguard still refuses to launch.

Do not reinstall the game before checking the firmware state. Reinstalling software cannot make a missing Platform Key or CSM-based boot configuration become Secure Boot compliant.

What About TPM 2.0 in MSI Click BIOS 5?

Secure Boot and TPM 2.0 are related to Windows security, but they are separate settings.

On MSI Click BIOS 5, TPM settings are commonly under:

Settings > Security > Trusted Computing

Look for:

Security Device Support

MSI documents this path for Click BIOS 5.

Intel systems may expose PTT, while AMD systems may use AMD CPU fTPM.

You do not need to change TPM just to turn on Secure Boot unless the game, Windows requirement, or security feature you are configuring also requires TPM 2.0.

That distinction matters because changing several BIOS security settings at once makes troubleshooting much harder.

Save Your BitLocker Recovery Key Before Major Firmware Changes

Changing Secure Boot, TPM, or the boot path can trigger a BitLocker recovery prompt on some PCs.

Before converting MBR to GPT, changing CSM/UEFI mode, resetting Secure Boot keys, or modifying TPM settings, make sure you have access to your BitLocker or Device Encryption recovery key.

This is especially important when the Windows drive is already encrypted.

A simple Secure Boot toggle on a correctly configured UEFI system may not cause any problem, but there is little benefit in taking the risk without first making sure the recovery key is available.

The MSI Click BIOS 5 Path to Remember

For most MSI motherboards using Click BIOS 5, the important route is:

Settings
> Advanced
> Windows OS Configuration
> BIOS UEFI/CSM Mode: UEFI
> Secure Boot: Enabled

Then save with F10 and verify the result inside Windows.

If Secure Boot is missing, check UEFI/CSM mode.

If Windows is still using Legacy BIOS, prepare the disk and boot configuration before switching to UEFI.

If Secure Boot is enabled but Windows still says Off, check Standard mode and the factory Secure Boot keys rather than repeatedly toggling the same switch.

That sequence avoids the most common MSI Secure Boot mistakes and gives you a clear Windows-side result to confirm when the setup is actually complete.