"If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup. With this feature on by default, users are more likely to have their settings and Microsoft Store app list available to restore after a device reset, replacement, or upgrade," Microsoft said in a Wednesday message center update.
Default backup for Microsoft Entra-joined and hybrid-joined devices
Microsoft has turned on Windows settings backup by default for enterprise devices that are Microsoft Entra-joined or Microsoft Entra hybrid-joined and that have been upgraded to Windows 11, version 26H2. The Windows settings backup tool — formerly called Windows Backup for Organizations — captures and restores enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged. The company said the new default-on behavior applies only when administrators have not explicitly configured the policy.
Rollout timeline: Ignite 2024 to Windows 11 26H2 on September 29
The feature's path to default status spans nearly two years. Microsoft unveiled the tool at the Ignite conference in November 2024 as an opt-in feature (disabled by default). It reached public preview in May 2025 and general availability in August 2025. As announced in July, Microsoft enabled the Windows settings backup policy by default for eligible devices following the release of Windows 11, version 26H2 on September 29.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRules, exceptions, and regional limits
The default-on setting is not universal. Microsoft limited the behavior to devices that meet several conditions: they must run Windows 11 26H2; they must come from countries or regions not regulated by the EU Digital Markets Act (DMA); they must not be in sovereign or restricted cloud environments; and the backup policy must not already be configured. In other words, devices in DMA-regulated jurisdictions, in sovereign or restricted cloud environments, or with an existing explicit policy configuration are excluded from the automatic enablement.
Admin control: Intune, Group Policy, and MDM retain precedence
Microsoft emphasized that the company will honor any existing explicit enable or disable setting, and that restore behavior remains unchanged and admin-controlled. On systems where backup is enabled by default, administrators still retain full control through mobile device management (MDM) solutions. Admins can disable the backup policy using Microsoft Intune or Group Policy; those explicit management paths take precedence over the default setting. Importantly, Microsoft noted that the tool's restore capability is not enabled by default — administrators must explicitly configure restores.
How technologists, enterprises, and end users are affected
- Technologists and security teams: Expect default backups to appear for eligible Entra-joined devices on 26H2 unless an admin has already set policy. They will use MDM, Intune, or Group Policy to enforce an organization’s desired backup and restore posture because those controls override the new default.
- Enterprises and procurement leaders: Organizations with devices in EU DMA-regulated regions or in sovereign/restricted cloud environments should note the default will not apply there; procurement and deployment plans that assume uniform behavior across all corporate devices may need adjustment.
- End users: On eligible devices, settings and the Microsoft Store app list are more likely to be available after a device reset, replacement, or upgrade — but restores will not activate unless an administrator has explicitly enabled that behavior.
Microsoft's change clears a key friction point for backups by making them the default for eligible enterprise devices, while leaving final decision-making power with administrators. The result is a selective, policy-respecting default: backups more likely available by default for Entra-joined systems on Windows 11 26H2, but restores and exclusions remain under administrative and regional control.
