Back Bleepingcomputer Microsoft enables Windows settings backup by default for orgs
Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2.
The Windows settings backup tool (formerly known as Windows Backup for Organizations) backs up and restores enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged.
Microsoft unveiled it two years ago at the Ignite conference in November 2024 as an opt-in feature (disabled by default), and it reached public preview in May 2025 and general availability in August 2025 .
As announced in July , Microsoft has enabled the Windows settings backup policy by default for eligible devices after the release of Windows 11, version 26H2 on September 29.
"If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup. With this feature on by default, users are more likely to have their settings and Microsoft Store app list available to restore after a device reset, replacement, or upgrade," Microsoft said in a Wednesday message center update.
"The new default applies only if admins haven't explicitly configured the policy. We honor any existing explicit enable or disable setting. Restore behavior is unchanged and remains admin-controlled."
The Windows backup default-on behavior also applies only to devices that run Windows 11 26H2 from countries or regions not regulated by the EU Digital Markets Act (DMA), aren't in sovereign or restricted cloud environments, and have the backup policy not configured.
Additionally, the tool's restore behavior will not be enabled by default, and users will still need explicit admin configuration to restore Windows devices.
On devices where the tool is enabled by default, IT administrators will still retain full control via mobile device management (MDM) solutions.
Admins can disable the backup policy through Microsoft Intune or Group Policy , as these will take precedence over the default.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Windows 11 2026 Update released, here's everything you need to know
Windows 11 2026 Update released, here's everything you need to know
Microsoft is rolling out Linux container support to WSL
Microsoft is rolling out Linux container support to WSL
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA orders feds to patch exploited Citrix flaws by Wednesday
Free Identity Governance for up to 150 Users: Try Our Community Edition
Free Identity Governance for up to 150 Users: Try Our Community Edition
Daily detection, monthly validation, 12-hour clocks. Are you VDR & VER ready?
Daily detection, monthly validation, 12-hour clocks. Are you VDR & VER ready?
80,000+ corporate domains have employee AI logins in stealer logs. Check yours free.
80,000+ corporate domains have employee AI logins in stealer logs. Check yours free.
Your access review passed cleanly, but it never saw the agents swimming under the surface. See how Token Security fishes out every one of them.
Your access review passed cleanly, but it never saw the agents swimming under the surface. See how Token Security fishes out every one of them.
Your access review passed cleanly, but it never saw the agents behind it. See how Token Security finds every one of them. Book a demo.
Your access review passed cleanly, but it never saw the agents behind it. See how Token Security finds every one of them. Book a demo.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
