Microsoft enables Windows settings backup by default for orgs
Microsoft now enables Windows settings backup by default on eligible Entra-joined Windows 11 26H2 devices.
Microsoft enabled Windows settings backup by default on Microsoft Entra-joined and hybrid-joined devices upgraded to Windows 11 26H2, following that release on September 29. The default applies only where administrators have not already configured the policy, and it excludes EU Digital Markets Act countries and sovereign or restricted cloud environments. Restore behavior is unchanged and still requires explicit admin configuration. Intune and Group Policy can disable backup and take precedence over the default.
- The default applies only if administrators have not already set the policy.
- EU Digital Markets Act regions and sovereign or restricted clouds are excluded.
- Restore stays disabled until an administrator explicitly enables it.
- Intune and Group Policy settings override the new default.
Full article360 words · extracted from bleepingcomputer.com · click to collapse
Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2.
The Windows settings backup tool (formerly known as Windows Backup for Organizations) backs up and restores enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged.
Microsoft unveiled it two years ago at the Ignite conference in November 2024 as an opt-in feature (disabled by default), and it reached public preview in May 2025 and general availability in August 2025.
As announced in July, Microsoft has enabled the Windows settings backup policy by default for eligible devices after the release of Windows 11, version 26H2 on September 29.
"If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup. With this feature on by default, users are more likely to have their settings and Microsoft Store app list available to restore after a device reset, replacement, or upgrade," Microsoft said in a Wednesday message center update.
"The new default applies only if admins haven't explicitly configured the policy. We honor any existing explicit enable or disable setting. Restore behavior is unchanged and remains admin-controlled."
The Windows backup default-on behavior also applies only to devices that run Windows 11 26H2 from countries or regions not regulated by the EU Digital Markets Act (DMA), aren't in sovereign or restricted cloud environments, and have the backup policy not configured.
Additionally, the tool's restore behavior will not be enabled by default, and users will still need explicit admin configuration to restore Windows devices.
On devices where the tool is enabled by default, IT administrators will still retain full control via mobile device management (MDM) solutions.
Admins can disable the backup policy through Microsoft Intune or Group Policy, as these will take precedence over the default.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.