Windows settings backup now on by default for Entra orgs
Microsoft has switched on Windows settings backup by default for enterprise devices that are Microsoft Entra-joined or Microsoft Entra hybrid-joined and have been upgraded to Windows 11 26H2. Microsoft Entra is the company's cloud identity and access management platform.
The change follows the release of Windows 11, version 26H2 on September 29. Microsoft had announced the plan in July.
From opt-in to default
The Windows settings backup tool was previously known as Windows Backup for Organizations. It saves enterprise users' Windows settings and restores them after a device is reset, replaced, upgraded, or reimaged.
Microsoft first presented the feature at its Ignite conference in November 2024. At that point it was opt-in and disabled by default. It went into public preview in May 2025 and became generally available in August 2025.
Turning it on by default is meant to remove uncertainty for IT teams when a machine needs to be recovered.
"If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup. With this feature on by default, users are more likely to have their settings and Microsoft Store app list available to restore after a device reset, replacement, or upgrade," Microsoft said in a message center update published on Wednesday.
Which devices are affected
The new default does not apply everywhere. A device gets the default-on behavior only if it:
- runs Windows 11 26H2
- is located in a country or region not regulated by the EU Digital Markets Act (DMA), the European Union law that places obligations on large "gatekeeper" tech platforms
- is not in a sovereign or restricted cloud environment
- has the backup policy left unconfigured
Existing configurations are respected. "The new default applies only if admins haven't explicitly configured the policy. We honor any existing explicit enable or disable setting. Restore behavior is unchanged and remains admin-controlled," Microsoft explained.
That last point matters. Only the backup side is switched on by default. Restoring settings to Windows devices still requires explicit configuration by an administrator.
Admins keep control
On devices where backup is now active by default, IT administrators still have full control through mobile device management (MDM) solutions.
Admins who do not want the feature can turn off the backup policy in Microsoft Intune or through Group Policy. Settings applied this way take precedence over the new default.
The rollout comes alongside other Windows 11 changes this month, including the KB5124010 preview update with 46 changes and fixes.
Our Take
For most organizations, this is a practical change. Device resets and replacements are routine after hardware failures, reimaging, and incident response. Having user settings and the Microsoft Store app list already backed up should shorten recovery and cut down on help desk work.
There is a governance side to it, though. Any feature that becomes active without an explicit decision deserves a look from security and compliance teams. Admins who have not set the policy should check whether settings backup fits their data handling rules and either confirm it or disable it through Intune or Group Policy. Waiting until after an audit is not ideal.
The exclusions are also telling. Leaving out DMA-regulated regions and sovereign or restricted cloud environments suggests Microsoft is cautious about default-on data features where regulatory or contractual requirements are stricter. Multinational organizations may therefore end up with different behavior across their fleet, depending on where devices are located. That is worth documenting.
The move fits a wider pattern of Microsoft tightening and automating enterprise defaults around Entra, as seen in plans to block script injection on Entra ID sign-in pages. It is worth watching whether Microsoft later extends default-on behavior to restore as well, or brings the feature to currently excluded regions. Either step would change the calculation for admins again.