Microsoft to enable Windows settings backup by default for orgs

Microsoft says the Windows settings backup and restore tool will be enabled by default on Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems after upgrading to Windows 11 26H2.

Formerly known as Windows Backup for Organizations, this backup tool helps back up and restore enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged.

The tool was unveiled at the Microsoft Ignite conference in November 2024 as an opt-in feature (disabled by default), reached public preview in May 2025, and general availability in August 2025. It is available after installing the September 2025 Windows Monthly Cumulative Update on Entra joined devices, but IT administrators must enable it by configuring backup and restore policy settings.

"Starting with Windows 11, version 26H2, the default behavior of the Windows settings backup policy will shift from disabled to enabled," Microsoft said in a message center updated on Monday.

"Default-on applies only to eligible devices and only when admins haven't explicitly set the policy. Explicit enablement and disablement settings are always honored."

Windows backup default-on behavior will only apply to devices that run Windows 11 26H2 from countries or regions not regulated by the EU Digital Markets Act (DMA), that aren't in sovereign or restricted cloud environments, and that have the backup policy not configured.

On systems where the tool is enabled by default, IT admins will still retain full control via mobile device management (MDM) solutions. Admins who want to explicitly disable the backup policy can do so through Microsoft Intune or Group Policy, as these will take precedence over the default.

Additionally, the restore behavior will not be enabled by default, and users will still need explicit admin configuration to restore Windows devices.

"You can validate the experience early. The default-on behavior is available with Windows 11, version 26H2 in Windows Insider Program Experimental channel starting July 2026," added Microsoft product manager Miranda Leschke.

"It takes broad effect for eligible devices at Windows 11, version 26H2 general availability later this year. Devices originally running Windows 11, version 26H1 will receive the same default-on treatment starting with the following feature update."

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper