When you try to enable Device Guard on Surface Pro 3 i3 (Intel Core i3-4020y), you receive the following error message in the gpreport.html file:
The hypervisor is not protecting DMA because an IOMMU is not present or not enabled in the BIOS.
By design, the Surface Pro 3 i3 (Intel Core i3-4020y) does not support the Intel VT-D (IOMMU) feature, which is required for Device Guard.
Third-party information disclaimer
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.