Fix TPM_E_MA_AUTHORITY 0X8028005F Error

When You See This Error

You just moved a BitLocker-encrypted hard drive from an old Dell Latitude 7480 running Windows 10 Pro to a new HP EliteBook 840 G9 with Windows 11 Pro. You power on the new machine, type in your BitLocker recovery key (or the TPM is supposed to unlock it automatically), and instead of booting to Windows, you get a black screen with the error: TPM_E_MA_AUTHORITY (0X8028005F) — "Incorrect migration authority."

Maybe you saw it while trying to run a manage-bde command to change the TPM protector on the old drive. Either way, the TPM on the new machine is saying "I don't trust the migration authorization you provided." This is a security guard that just won't let you in without the right ID.

What's Going On

The core issue: TPM-backed BitLocker encryption ties the encryption key to the original computer's TPM. When you move that drive to a new PC, you need to either disable TPM protection temporarily or provide the correct migration authority — a special credential that proves you have the right to move the key.

In your case, the migration authority is wrong. Most people hit this because they:

Used manage-bde -protectors -add with the wrong -tpm parameter.
Ran a recovery process that didn't cleanly remove the old TPM binding.
Tried to skip the proper BitLocker suspension step before moving the drive.

The error code 0X8028005F specifically means the TPM firmware rejected the migration blob you supplied. It's not a hardware failure — it's a permissions mismatch.

The Fix: Two Options

You have two paths. Path A is quick if you have the recovery key. Path B is for when you don't have the key but still have the original machine.

Path A: Use BitLocker Recovery Key (Fastest)

Boot the PC with the error. You'll eventually get to a recovery screen asking for the BitLocker recovery key. Type it in. If you don't have it, check your Microsoft account at account.microsoft.com/devices/recoverykey or look for a printed copy from when you set up BitLocker.
After entering the key, Windows should boot normally. The drive is now unlocked by the recovery key, not the TPM.
Now suspend BitLocker protection: Open Command Prompt as Administrator and run:
```
manage-bde -protectors -disable C:
```
After hitting Enter, you'll see: "BitLocker protection has been suspended." This clears the old TPM protector tied to the old machine.
Now re-enable TPM protection for the new machine: Run:
```
manage-bde -protectors -enable C:
```
You should see: "BitLocker protection has been enabled." The TPM on the new PC now stores a fresh protector.
Verify the new protector took: Run:
```
manage-bde -status C:
```
Look for "TPM" under the Protection Status section. It should say "On" and list a numerical TPM protector ID.

After these steps, reboot. The drive should unlock automatically via the new TPM. If you still see error 0X8028005F, you likely have a corrupted TPM migration blob. Move to Path B.

Path B: Clear TPM & Re-Encrypt (When Recovery Key Is Missing or Path A Fails)

This is more drastic but works every time. It assumes you still have the old PC with the original TPM.

On the old machine, boot into Windows. Open Command Prompt as Admin.
Decrypt the drive entirely: Run:
```
manage-bde -off C:
```
This can take hours depending on drive size. Wait until manage-bde -status shows "Decryption: 100%" under Conversion Status.
Remove the drive from the old machine and install it in the new machine.
On the new machine, boot into Windows (the drive is now unencrypted). Then encrypt it fresh with the new TPM:
Open Command Prompt as Admin and run:
```
manage-bde -on C: -tpm
```
After a moment, you should see: "BitLocker encryption has started." The TPM on this new machine becomes the sole authority.
Wait for encryption to finish. Check status with manage-bde -status C: until Conversion Status shows "Encryption: 100%".

This completely sidesteps the migration authority problem because you're starting fresh. No leftover migration blob to reject.

What to Check If It Still Fails

If after both paths you still get 0X8028005F, here's the most common hidden cause:

TPM firmware version mismatch — Some older TPM 2.0 chips (like in Dell systems from 2017) are picky about migration blobs. Update the TPM firmware via your motherboard manufacturer's support site. On HP, that's the HP TPM Configuration Utility. On Dell, it's the Dell TPM 2.0 Firmware Update.
BitLocker group policy — Group Policy can enforce that TPM protectors require a specific migration authority file. Check gpedit.msc under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > "Require additional authentication at startup." If it's set to "Configure TPM startup key" or "Configure TPM startup PIN," set it to "Not Configured" or "Allow TPM." Then run gpupdate /force.
Corrupt TPM itself — Rare, but clear the TPM (from BIOS or via tpm.msc). Warning: this clears all TPM-based keys, including Windows Hello and some enterprise certs. Only do this as a last resort.

The bottom line: TPM migration authority errors are almost always caused by skipping the suspension step or using the wrong migration credentials. Path A fixes 90% of cases. Path B gets the stubborn ones. Don't waste time on random registry edits or third-party tools — they'll just add more variables.