Windows 11 26H2 Enables Settings Backup by Default for Eligible Entra PCs

The rule is narrow, and it matters most to admins who never touched this policy. If you already enabled or disabled it, nothing changes for you.

What Microsoft changed​

BleepingComputer reports that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. The publication says Microsoft has enabled the Windows settings backup policy by default for eligible devices after the release of Windows 11, version 26H2 on September 29.

Microsoft's own documentation says the same thing. Its what's-new page for IT pros states that Windows settings backup is now enabled by default for eligible commercial devices. The page lists the feature among capabilities that 26H2 turns on for commercial organizations after they were previously held behind temporary commercial controls. Two other features appear on that list: app-specific taskbar actions and several File Explorer improvements.

In its Windows message center update, Microsoft summed up the case for the change: "If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup."

The rules that decide whether a device is affected:

• The trigger is "Not Configured." "The new default applies only if admins haven't explicitly configured the policy. We honor any existing explicit enable or disable setting."
• Restore is not on by default. Microsoft's overview says this change applies only to backup policies; admins must still configure restore policies.
• Only 26H2 devices are affected. 26H2 shares a servicing branch with 24H2 and 25H2 and reaches those devices as a small enablement package. The new default applies only once a device is actually running 26H2.
• Some regions and clouds are excluded. BleepingComputer reports the default applies only to devices that run Windows 11 26H2 from countries or regions not regulated by the EU Digital Markets Act (DMA), aren't in sovereign or restricted cloud environments. Microsoft's overview separately says the whole feature is not currently available in GCCH or sovereign clouds, or in China. The documentation we reviewed did not spell out the DMA exclusion. French outlet IT-Connect also reports that devices located in the European Union are not affected by automatic backup activation.

In short: 26H2, Entra-joined, policy left at Not Configured, outside the EU and outside sovereign clouds. A device that meets all of those conditions now backs up its settings. Restore still needs an admin to turn it on.

How we got here​

The feature has changed names more than once. It began as Windows Backup for Organizations, and Microsoft now calls it Windows settings backup and restore. Microsoft says older documentation and policy screens may still show the previous name during the transition, so expect to see both in the Intune console for a while.

BleepingComputer dates the feature to the Ignite conference in November 2024 as an opt-in feature (disabled by default), and it reached public preview in May 2025 and general availability in August 2025. The default-on plan came last summer. IT-Connect reports that Microsoft announced on July 6, 2026 that this feature will be enabled by default. In July, BleepingComputer quoted Microsoft product manager Miranda Leschke saying the default would take broad effect for eligible devices at Windows 11, version 26H2 general availability later this year.

Something else changed in July that affects the same settings. Microsoft moved Enterprise State Roaming (ESR) management out of the Entra portal and into Windows settings backup policies, effective July 1, 2026. The user-facing toggles now control both systems. If you used to manage roaming in Entra, that console is no longer where it lives.

What gets backed up, and what doesn't​

This is not a disk image or a replacement for OneDrive, so don't treat it as a full backup. According to Microsoft's overview:

• A scheduled backup task runs every eight days. It saves user settings, preferences and the list of installed Microsoft Store apps.
• Users can also run a backup manually: search for the Windows Backup app and select Back up.
• Under Settings > Accounts > Windows backup, users can turn off Remember my preferences or Remember my apps. Admins can lock those options through policy.

Microsoft's settings catalog lists exactly what is included. Display, Night Light, taskbar, personalization, accessibility (Narrator and Magnifier options) and File Explorer view preferences are covered. Some items are explicitly excluded: Windows Update settings are not backed up or restored, and apps themselves are not backed up. Only the Store app list is saved. User files are not part of it.

Backup is not restore​

Turning backup on by default does not mean users will see a restore screen on their next new laptop. Restore stays off until an admin turns it on. Microsoft documents two ways to do that in Intune:

1. Enrollment policy (tenant-wide): Go to Devices > Enrollment > Windows Backup and Restore and set Show restore page to On. This is applied before standard MDM policies, so it is in place for the restore step during setup (OOBE). Changes don't affect devices that are already enrolled. You need the Intune Service Administrator or Global Administrator role.
2. Post-enrollment device policy: Set it through the Settings catalog, the WindowsBackupAndRestore CSP, or Group Policy (Computer Configuration\Administrative Templates\Windows Components\Sync your settings\Enable Windows Restore).

Restore during setup requires Microsoft Entra join. If you use Autopilot, it must run in user-driven mode, not self-deploying mode. Restore at first sign-in requires Windows 11 24H2 build 26100.7922 or 25H2 build 26200.7922 or later, and the device must already be enrolled. Microsoft's 26H2 notes add that first-sign-in restore now supports hybrid-joined devices, Cloud PCs and multi-user setups.

Microsoft also lists three known problems:

• Conditional Access policies can block the restore flow with a "You can't get there from here" error. The fix is a custom policy that allows the Microsoft service with app ID d32c68ad-72d2-4acb-a0c7-46bb2cf93873.
• Organizations that enforce phishing-resistant MFA may see an extra MFA prompt during setup.
• Using both Group Policy and CSP settings for this feature can produce unexpected results. Pick one.

How to turn it off​

Organizations with data-governance concerns or works-council requirements can opt out. Microsoft says any existing administrator-configured policy (enabled or disabled) will continue to be honored. To disable backup:

• Intune Settings catalog: Administrative Templates > Windows Components > Sync your settings > Enable Windows Backup → Disabled.
• Group Policy: Computer Configuration\Administrative Templates\Windows Components\Sync your settings**Enable Windows Backup** → Disabled.
• Custom OMA-URI / other MDM: ./Device/Vendor/MSFT/Policy/Config/SettingsSync/EnableWindowsbackup, data type string, value <disabled/>.

Disabling backup stops future scheduled backups. It does not delete data already stored. You can view, export or delete existing backups in your tenant with the Microsoft Graph beta APIs. Reading and exporting needs the UserWindowsSettings.Read.All permission, and deleting needs UserWindowsSettings.ReadWrite.All. Microsoft has also released PowerShell scripts that wrap those APIs, available on GitHub and the PowerShell Gallery. If 26H2 machines backed up data before you set your policy, you'll need to delete that data yourself.

One more thing to check: Microsoft notes that some related connectivity policies must not be set to Disabled, or backup will not run at all. If you want backup and it isn't working, look there first.

Analysis: a sensible default, if you know it's there​

Is this a good change? For most organizations, yes. Helpdesks regularly rebuild users' desktop setups by hand after a hardware swap. Keeping a settings backup in place by default, without anyone having to remember to switch it on, is a reasonable choice for business continuity. Restore still requires an admin, so nothing gets restored without someone deciding it should be.

The other side deserves equal weight. CyberPress points out that automatic backup collection introduces new considerations around what user data is captured and where it's stored, even though restoration still requires deliberate administrative action. Settings data goes to Microsoft's cloud as soon as a device is eligible, possibly before your privacy team has signed off. The EU exclusion helps European tenants, but a multinational with offices on both sides of the Atlantic should not assume one global policy covers everyone the same way.

Our advice, based on standard change-management practice rather than anything Microsoft requires: don't leave this at Not Configured. Set the policy to Enabled or Disabled on purpose. An explicit setting is easy to audit, survives future changes to Microsoft's defaults, and gives a clear answer when someone asks why laptops are uploading settings. Then decide separately whether to turn on restore. Backups nobody can restore don't help when a laptop dies.

Bottom line: Windows 11 26H2 makes settings backup the default for eligible Entra-joined PCs where the policy is unset. Explicit policies still take precedence, restore remains admin-controlled, EU and sovereign-cloud devices are excluded, and you can reverse it through Intune, Group Policy or any MDM.