"Starting with Windows 11, version 26H2, the default behavior of the Windows settings backup policy will shift from disabled to enabled," Microsoft said in a message center update on Monday.
What Microsoft is changing and why it matters to enterprises
Microsoft will switch the Windows settings backup and restore tool from opt-in to default-on for eligible enterprise devices after those systems upgrade to Windows 11, version 26H2. The capability—formerly called Windows Backup for Organizations—backs up enterprise users' Windows settings so those settings can be restored after a device is reset, replaced, upgraded, or reimaged. The company framed the change as a shift in default policy behavior for Microsoft Entra-joined and Microsoft Entra hybrid-joined devices, while emphasizing that explicit administrative choices will still be honored.
Product history and rollout timeline
The tool was unveiled at the Microsoft Ignite conference in November 2024 as an opt-in feature (disabled by default). It reached public preview in May 2025 and entered general availability in August 2025. Microsoft said the feature became available after installing the September 2025 Windows Monthly Cumulative Update on Entra-joined devices, though administrators initially had to enable it by configuring backup and restore policy settings.
Microsoft product manager Miranda Leschke said the default-on behavior is already available in the Windows Insider Program Experimental channel starting July 2026 and "takes broad effect for eligible devices at Windows 11, version 26H2 general availability later this year." Devices originally running Windows 11, version 26H1 will receive the same default-on treatment beginning with the following feature update.
Eligibility limits: Entra join status, DMA regions, and cloud environments
The new default applies only to eligible devices. Microsoft specified three constraints: eligible devices must be Microsoft Entra-joined or Entra hybrid-joined; they must not be located in countries or regions regulated by the EU Digital Markets Act (DMA); and they must not reside in sovereign or restricted cloud environments. In addition, the default-on behavior only takes effect when administrators have not already configured the backup policy.
Administrative control: Intune, Group Policy and MDM take precedence
Microsoft stressed administrators retain control. The company said explicit enablement or disablement of the backup policy is "always honored." On systems where the tool is enabled by default, IT administrators can still manage the feature through mobile device management (MDM) solutions. Administrators who want to explicitly disable the backup policy can do so using Microsoft Intune or Group Policy, and those explicit settings will take precedence over the default behavior.
Microsoft also clarified that while backup may be enabled by default for eligible devices, restore behavior will not: "the restore behavior will not be enabled by default, and users will still need explicit admin configuration to restore Windows devices." That distinction separates passive capture of settings from the active ability to apply them.
How technologists and security teams, enterprise IT administrators, and end users should respond
- Technologists and security teams: Watch for the policy flip when devices move to Windows 11, version 26H2 and verify that backup data storage and access controls meet internal security requirements—especially in environments subject to regulatory or cloud restrictions named by Microsoft.
- Enterprise IT administrators: If you want a different baseline than Microsoft’s new default, explicitly configure the backup policy now via Intune or Group Policy; those settings will override the default-on behavior for eligible devices.
- End users and device recovery teams: Understand that while settings may be backed up automatically on eligible devices, the ability to restore them requires explicit administrative configuration—restore functionality will not turn on by default.
The change is a pragmatic one: Microsoft moves a recovery-focused setting from opt-in to default-on for many Entra-joined enterprise systems, while preserving explicit administrative control and leaving restore capability behind an additional configuration step. The questions left in plain view are operational: when organizations will update to Windows 11, version 26H2; whether they will accept Microsoft’s default or set explicit policies; and how environments governed by the EU DMA or running in sovereign or restricted clouds will manage comparable protection. Microsoft’s message makes clear the company will honor administrator intent—now it is up to IT teams to declare what that intent should be.