Windows Backup for Organizations GA Enables Intune Managed OOBE Restore for Windows 11

Microsoft has moved a long-promised enterprise feature out of preview: Windows Backup for Organizations is now generally available as an opt‑in, Intune‑managed service that saves Windows settings, personalization and Microsoft Store app manifests to the customer’s tenant and restores them during device enrollment (OOBE), speeding device refreshes and Windows 11 migrations.

Background / Overview​

Microsoft first announced the enterprise-focused backup capability at Ignite in 2024 and opened a limited public preview in mid‑2025 before promoting the feature to general availability as part of the August/September 2025 servicing wave. The GA announcement and supporting release notes are published by Microsoft and bundled into preview/servicing KBs that shipped with the August 2025 update.
The product is explicitly targeted at organizations using Microsoft Entra (Azure AD) identity and Intune device management. It is positioned not as a full disaster‑recovery or file‑level backup but as a settings and app‑manifest recovery tool that reduces user downtime after a reset, reprovision, or device replacement—particularly valuable for organizations conducting mass Windows 11 migrations before Windows 10 reaches end of servicing.

---

What Windows Backup for Organizations actually does​

Core scope: intentional, narrow design​

Windows Backup for Organizations focuses on restoring the user experience, not performing block‑level or comprehensive file backups. The feature captures:

• User and system settings (personalization, accessibility, File Explorer preferences and other configured Windows settings).
• Microsoft Store app manifest (a list of installed Store apps and placement intent for the Start menu; manifests—not Win32 binaries).
• Select personalization assets where applicable (for example, saved desktop/lock screen images and certain stateful preferences).

It does not capture user documents, non‑Store (Win32/MSI/EXE) application binaries, or perform full disk imaging. For file continuity and long‑term retention organizations must continue to rely on OneDrive Known Folder Move, server backups, or third‑party endpoint backup and archival solutions.

How backups are created and restored​

• Backups are scheduled automatically in the background approximately every eight days, and users can also trigger manual backups through the Windows Backup app.
• Restores occur during Out‑Of‑Box Experience (OOBE) when a user signs into a freshly provisioned or reset Windows 11 device using the same Microsoft Entra account that owns the backup. The restore option must be enabled tenant‑wide by an Intune administrator to appear during OOBE.

---

System requirements, prerequisites and availability​

OS and build minimums​

Microsoft documents explicit minimum OS builds for backup and for the restore experience:

• Backup is available for:
• Windows 10, version 22H2 — build 19045.6216 or later.
• Windows 11, versions 22H2 / 23H2 / 24H2 on specified builds.
• Restore (OOBE) is available only on Windows 11 and requires particular cumulative update builds (examples documented by Microsoft). If devices are on older builds, enabling the Install Windows quality updates policy during enrollment can deliver the necessary updates at OOBE to enable the restore experience.

Exact build numbers and the date‑gated KBs are published in Microsoft Learn and in the Windows servicing KBs; administrators must verify builds in their environment before relying on OOBE restores.

Identity and management prerequisites​

• Devices must be Microsoft Entra joined (or Entra hybrid‑joined for backups). Restores require a device to be Entra‑joined at OOBE.
• Management configuration is Intune‑centric: admins enable backup via the Settings catalog (Enable Windows Backup) and turn the tenant‑wide Show restore page toggle under Devices → Enrollment → Windows in the Intune admin center. Tenant admin roles (Intune Service Administrator or Global Administrator) are required for the restore toggle.
• The feature is opt‑in and disabled by default. It is also rolled out in a staged fashion and may not immediately appear in every tenant.

Regional and cloud availability caveats​

• The feature is not currently available in Government Community Cloud High (GCCH), some sovereign clouds, or China (21Vianet) at GA. Multi‑Geo Exchange Online tenants are respected for data residency where configured.

---

Where backups are stored, and the data residency model​

Microsoft stores the Windows Backup for Organizations artifacts in Exchange Online within the tenant’s geographic mapping. That means:

• Backups are persisted in the customer’s tenant in Exchange Online and follow organizational data geography and Multi‑Geo mapping if configured. Administrators can see tenant data location in the admin center.
• Because the storage is within the Microsoft 365 tenancy, Exchange Online controls and, where applicable, Customer Key (customer‑managed keys) configurations for Exchange may affect how backups are encrypted and governed—enterprises with strict key‑custody needs should validate coverage for the Windows Backup payload specifically with Microsoft.

This tenant‑scoped storage model simplifies geo‑compliance for many customers, but it also ties the restore path to tenant‑level services (Exchange Online availability and the tenant’s identity controls).

---

Security, encryption and personnel access​

Microsoft states that backup data benefits from the layered encryption model used across Microsoft 365 and Azure: encryption in transit (TLS) and encryption at rest using platform and service‑level encryption. Access to customer data is governed by role‑based controls and audited processes; Microsoft personnel access is limited and logged for troubleshooting and legal compliance.
Caveats for security teams:

• The public product documentation describes the encryption posture at a high level but does not publish full internal key management topology for this product’s artifacts. Organizations with stringent sovereign or key‑custody requirements should confirm contractually whether Customer Key or other tenant‑managed protections cover Windows Backup artifacts. This is a recommended pre‑deployment validation step.

---

Management and operational workflow​

How to enable (concise admin steps)​

• In Intune, create or edit a Settings catalog profile (Platform: Windows 10 and later → Profile type: Settings catalog).
• Search for Sync your settings and enable Enable Windows Backup (this makes the Windows Backup app and functionality available).
• To expose the OOBE restore UI, as an Intune Service Admin go to Devices → Enrollment → Windows → Enrollment options and set Show restore page to On (tenant‑wide).

Remember: the restore toggle applies only at enrollment time; changing it does not retroactively add the restore option to already enrolled devices. Pilot and plan enrollments accordingly.

Known incompatibilities and unsupported scenarios​

• Restore is not available for:
• Hybrid Azure AD join in some configurations.
• Self‑deploying Autopilot mode, Autopilot pre‑provisioned devices and certain reset flows.
• Manual enrollment via Settings, Group Policy enrollment, or Configuration Manager co‑managed enrollments.
• Shared or userless devices and certain Windows SKUs (e.g., IoT/Holographic/SE variants).
• Phishing‑resistant MFA can cause authentication friction during OOBE in VM or Hyper‑V scenarios (PRMFA prompts that VM hosts can’t pass through), so plan for Temporary Access Pass (TAP) or alternate authentication if required.

---

Strengths — where this helps IT the most​

• Reduced provisioning friction: Restoring personalization and Store app manifests during OOBE reduces manual configuration and helpdesk tickets after reimaging or device replacement.
• Faster Windows 11 migrations: Teams migrating many users from Windows 10 to Windows 11 regain user familiarity and Start‑menu layouts with less disruption.
• Tenant‑scoped governance: Intune tenant‑level controls centralize enablement and policy, which makes it easier to pilot and control rollout.
• Data residency alignment: Storing artifacts in Exchange Online within the tenant region simplifies geo‑compliance for multinational organizations that already use Microsoft 365 Multi‑Geo.

Independent press coverage and product summaries emphasize the practical benefit for large fleets where reconfiguration overhead is a real cost; however, industry writers consistently note that the product is not a full backup replacement.

---

Risks, limitations and sensible mitigations​

Risk: Misinterpreting the word “Backup”​

The product name can mislead non‑technical stakeholders into thinking it replaces endpoint backup or disaster recovery. It does not back up documents, non‑Store apps, or provide point‑in‑time file restores. Relying on it alone for compliance or legal holds would be a mistake. Mitigation: keep OneDrive or third‑party file backups and traditional image/DR tooling in your estate.

Risk: Identity dependency and attack surface​

Because restores are tied to Entra sign‑in at OOBE, identity compromise or misconfiguration (Conditional Access policies that block the Activity Feed Service) can prevent restores. Mitigation:

• Enforce strong identity protections (MFA, Conditional Access, Privileged Identity Management).
• Validate Conditional Access allow lists for the Activity Feed and Intune endpoints used by OOBE.

Risk: Tenant‑level storage coupling​

Backups live in Exchange Online; an Exchange outage, tenant misconfiguration, or litigation hold/retention policy interactions could affect availability or retention assumptions. Mitigation:

• Review tenant retention, Customer Key coverage, and DPA contract terms.
• Keep operational runbooks and alternate recovery workflows that do not assume immediate Exchange access.

Risk: Provisioning load and bandwidth​

Restores during OOBE can increase network demand (Store app re‑installation and quality updates at OOBE). Mitigation:

• Pilot to measure OOBE time and bandwidth.
• Use Delivery Optimization, WSUS, or pre‑stage updates in images where possible.
• Stagger enrollments to avoid peak load.

Risk: Compliance edge cases​

Enterprises with strict sovereign or customer‑key-only requirements must verify that Windows Backup payloads are covered by configured Customer Key settings for Exchange Online. Mitigation: verify with Microsoft account teams and include coverage clauses in procurement or DPA terms before broad adoption.

---

Practical adoption checklist (recommended sequence)​

• Inventory: List device models, OS versions, and Entra join state across your estate.
• Build verification: Confirm devices meet the documented minimum builds for backup and (separately) for OOBE restore.
• Pilot group: Select representative user personas (knowledge workers that use Store apps and personalized settings).
• Intune configuration:
• Create a Settings catalog profile and enable Enable Windows Backup.
• Toggle Show restore page in Enrollment options during pilot.
• Configure Enrollment Status Page (Install Windows quality updates) as needed.
• Network and update strategy: Prestage updates or use Delivery Optimization to reduce OOBE bandwidth.
• Security review: Validate identity protections, Conditional Access, and Customer Key coverage for Exchange.
• Test and document: Validate backup creation cadence, restore fidelity, failure modes, and user communications.
• Rollout: Expand rings progressively and operationalize helpdesk runbooks for the new OOBE restore flows.

---

How this fits with other enterprise backup tools​

Windows Backup for Organizations is complementary to endpoint and Microsoft 365 backup solutions, not a replacement. Compare by capability:

• Windows Backup for Organizations:
• Strength: restores personalization and Store app manifests during OOBE; tenant‑scoped; Intune‑managed.
• Weakness: no file-level or Win32 app binary restoration; limited retention/restore granularity.
• OneDrive / Server / Third‑party endpoint backup:
• Strength: file‑level retention, long‑term archives, immutability and legal holds.
• Weakness: typically not integrated into OOBE as a seamless restore of settings and Start layout.

Enterprises that require long retention, immutability, or cross‑workload restore (mailboxes, SharePoint, OneDrive, Teams) will continue to rely on third‑party backup vendors or Microsoft 365 backup partners for those needs. Windows Backup for Organizations should be folded into a layered backup and continuity plan where it addresses one specific point problem—rapid restoration of user settings during provisioning—while other tools cover files and full system recovery.

---

Realistic expectations and closing assessment​

Windows Backup for Organizations is a pragmatic addition to the enterprise provisioning toolkit. For Intune‑managed, Entra‑joined estates it removes a repetitive and time‑consuming piece of device refresh work: restoring user preferences, Wi‑Fi networks where supported, accessibility settings and a Start‑menu app manifest on Windows 11 during OOBE. It is especially useful for organizations racing to migrate users from Windows 10 ahead of support end dates and for large fleets where even small per‑device time savings aggregate into significant operational cost reduction.
However, the feature has important caveats: it is not a full backup, it depends on tenant services (Exchange Online and Entra), it is gated by build and enrollment requirements, and it is disabled by default until an admin opts in. Security, compliance and legal teams should verify encryption, retention and customer‑managed key coverage for their tenant payloads before depending on Windows Backup for Organizations for sensitive workloads.
For organizations that plan and pilot carefully—validating builds, auth flows, bandwidth impacts and Customer Key coverage—this capability will streamline reprovisioning, lower helpdesk tickets, and make Windows 11 migrations smoother. For those with strict compliance, sovereign or full‑data recovery needs, the feature is a useful adjunct, not a replacement, and should be integrated into a layered continuity, backup and device management strategy.

---

Quick reference: admin commands and policy hints​

• Intune Settings Catalog path: Platform: Windows 10 and later → Profile type: Settings catalog → search Sync your settings → set Enable Windows Backup to Enabled.
• Tenant restore toggle: Intune Admin Center → Devices → Enrollment → Windows → Enrollment options → Show restore page → On (requires Intune Service Administrator or Global Admin).
• If devices are on older builds, enable Install Windows quality updates (ESP feature) to deliver required servicing updates during OOBE.

---

Windows Backup for Organizations closes a practical gap in the provisioning lifecycle: it returns user familiarity quickly after a reset or replacement, but it must be treated as one tool in a broader backup and migration playbook. Administrators should pilot early, verify residency and key management coverage, and keep layered protections for files and full system recovery firmly in place.

---

Source: Techzine Global Microsoft introduces Windows Backup for Organizations