Windows Backup for Organizations GA: Intune Managed OOBE Restore on Entra PCs

Microsoft has moved its enterprise-focused Windows backup into production: Windows Backup for Organizations is now generally available and included in the August/September 2025 servicing wave, giving IT teams a built-in, Intune-manageable path to capture user settings, preferences and Microsoft Store app manifests and restore them during device enrollment (OOBE) on Microsoft Entra–joined devices.

Background / Overview​

Windows Backup for Organizations started as an evolution of the consumer settings-sync experience and was announced for enterprise testing during Microsoft’s preview cycles in 2024–2025. The GA declaration appears in Microsoft’s August 26, 2025 product notes and accompanying KB rollout messaging, where the feature is described as an enterprise-grade backup and restore capability intended to reduce downtime during device refreshes and Windows 11 migrations. The feature is surfaced to administrators through Microsoft Intune as a tenant-level setting. Administrators must enable backup policies and, separately, the tenant-wide restore option to expose a restore page during Out‑Of‑Box Experience (OOBE) enrollment. By design the capability is opt-in for organizations and disabled by default until an admin turns on the relevant Intune settings.

---

What Windows Backup for Organizations actually does​

At a high level, the product focuses on restoring the experience of a user on a new or reimaged device rather than providing full file system disaster recovery. Its core responsibilities are:

• Preserve and restore system and personalization settings (File Explorer preferences, desktop options, accessibility settings, known Wi‑Fi networks where supported, and similar configuration state).
• Capture a manifest of Microsoft Store apps and the intent for Start-menu placement so that the restored device mirrors the prior Start layout (this does not reinstall Win32/MSI/EXE applications).
• Schedule automatic backups and allow manual backups from the device UI. Backups run on a recurring schedule (documentation specifies an automatic run approximately every eight days) and users can also initiate a backup via the Windows Backup app.

Key restrictions and clarifications:

• It is not a full disk image or file-level backup — documents, user file stores and non-Store Win32 apps are outside the scope. Organizations still need OneDrive, file-server backup, or third-party endpoint backup solutions for complete data protection.
• Restores are executed during the OOBE flow and require the user to sign in with the same Entra ID account used for the backup. The restore option is shown only during enrollment on qualifying Windows 11 devices.

---

System requirements and availability​

Microsoft’s documentation sets specific prerequisites for backup and restore:

• Devices must be Microsoft Entra joined or hybrid-joined. The restore experience requires a device to be Entra‑joined at the time of OOBE.
• Supported OS baselines (examples from Microsoft Learn): Windows 10 version 22H2 (with a minimum build), and Windows 11 versions 22H2, 23H2, and 24H2 — with particular build thresholds for restore capabilities listed in the Intune guidance. Administrators must verify that devices meet the documented minimum builds before relying on OOBE restore.
• The August 2025 optional/preview update (packaged as KB5064080 in Microsoft’s rollout) includes the organizational backup binaries; the feature is also exposed through later cumulative updates. In short, the restore path depends on having appropriate servicing updates applied before OOBE.

Availability notes:

• The capability is rolling out and gated by tenant/region in some cases; not every tenant will see the restore toggle simultaneously. Administrators should verify visibility in their Intune tenant.
• Microsoft has stated the feature is not supported in some sovereign/isolated clouds or scenarios (for example, certain government clouds and 21Vianet environments have specific exclusions in early rollouts).

---

Where backups are stored — data residency and encryption​

Microsoft’s documentation and public messaging specify that the backup artifacts for enterprise tenants are stored in Microsoft’s cloud and mapped to the tenant’s data geography. Specifically:

• Backups for Windows Backup for Organizations are stored in the Exchange Online cloud mapped to the tenant’s chosen Country/Region at tenant creation (this mapping follows the same tenant affinity model used across Microsoft 365 services). Administrators can view their tenant data location in the Tenant Admin Center.
• Microsoft says customer content is protected with one or more forms of encryption and that enterprise cloud services apply encryption at rest (platform-level and application-level encryption) and TLS-based encryption in transit. Microsoft’s broader cloud encryption guidance describes BitLocker for volume encryption, service-level encryption, Azure/Office 365 service encryption options and customer-managed key capabilities.
• Microsoft also emphasizes limited, auditable access by Microsoft personnel — engineers are granted access only when necessary (for troubleshooting or legally compelled disclosure), and access is governed and logged. That control model is standard across Microsoft business cloud services.

Caveat / verification note: Microsoft’s public materials assert multi-layer encryption and strict access controls for the stored data. However, the product-level documentation does not publish the complete internal key-handling topology or per-feature key provenance for Windows Backup artifacts; enterprises with specific compliance or regulatory demands should treat the “multiple layers of encryption” claim as a high-level assurance and verify contract-level controls (DPA, contractual commitments, or customer-managed key options) directly with Microsoft for their tenant.

---

How to enable and manage (Intune + Entra controls)​

The management model is deliberately tenant-scoped and Intune-centric:

• Administrators enable backup by creating or editing a Settings Catalog device configuration in Microsoft Intune and toggling the Windows backup setting. The restore UX is a separate, tenant-wide setting in the Enrollment options that must be turned on to surface the restore page during OOBE. Only Intune Service Administrators or Global Administrators can enable the tenant-wide restore toggle.

Recommended administrative checklist before enabling broadly:

• Validate that target devices meet Microsoft’s minimum OS build and servicing requirements.
• Confirm devices are Microsoft Entra joined or hybrid-joined as appropriate.
• Pilot the restore flow with representative users (Autopilot user‑driven OOBE) — note that some Autopilot modes (self-deploying, pre-provisioned) and certain enrollment methods are not supported for restore.
• Review Conditional Access and network allowances for Microsoft Activity Feed and Intune endpoints to avoid enrollment-time failures.

---

Operational benefits for migrations and device refresh​

For enterprises planning large-scale Windows 11 upgrades or device refreshes ahead of Windows 10 end-of-support, this capability promises clear operational advantages:

• Reduced help-desk churn: restoring personalization and app manifests during OOBE cuts the manual reconfiguration time users otherwise need after a reimage.
• Faster user productivity: users hit the desktop with familiar settings and Start layout, which reduces training and onboarding friction on replacement hardware.
• Simplified lifecycle orchestration: Intune-managed, tenant-level controls let administrators gate the restore experience centrally rather than relying on device-level user effort.

---

Critical limitations and risks — what IT must plan for​

While the feature fills a clear gap for settings continuity, it is important to be explicit about what Windows Backup for Organizations does not cover and the operational risks it introduces:

• Not a substitute for full backup and disaster recovery: it does not capture user documents, enterprise file shares, or non‑Store apps — you’ll still need a full endpoint backup or server backup strategy for compliance and DR.
• Restore is OOBE‑only and tied to Entra identity: organizations with non-standard enrollment flows, shared devices, or non‑Entra identities cannot use the restore page. This makes it ill-suited as a universal recovery tool in heterogeneous environments.
• Bandwidth and OOBE time: performing restores (and Microsoft’s new option to install quality updates during OOBE) can lengthen provisioning time and create bandwidth spikes during mass enrollments. Plan Delivery Optimization, pre-caching, or image staging for large fleets.
• Sovereign cloud and regional availability: some government and sovereign clouds may not initially support the feature; confirm availability for tenants in restricted geographies before committing to a migration plan.
• Microsoft access and compliance: while Microsoft documents strict access controls, organizations with highly prescriptive regulatory needs (for example, explicit key custody requirements or immutability) should confirm whether the service meets those requirements or whether a third-party backup solution with customer-managed keys and air‑gap retention is required. The general “multiple layers of encryption” statement is credible but not a replacement for contractual and operational verification.

---

Deployment blueprint — a practical step-by-step plan​

• Inventory: map devices by OS version/build, enrollment state (Entra joined vs hybrid), and Autopilot configuration. Record which devices will be eligible for OOBE restore.
• Pilot ring: enable backup for a small set of pilot users and enable the tenant-level restore only in a dedicated pilot tenant or pilot group. Validate successful backups, restore fidelity (settings and Store app manifest), and end-to-end OOBE behavior.
• Network simulation: model OOBE bandwidth and Delivery Optimization/WSUS pre-caching needs for the anticipated rollout window. Include ESP timeouts and conditional access rules in the simulation.
• Compliance and security review: confirm data residency mapping in tenant admin center, review DPA terms, and evaluate whether Customer Key or other Purview controls are required for your compliance posture. If necessary, contact Microsoft for contract-level clarifications.
• Staged rollout: expand pilot rings progressively. Keep rollback images and recovery playbooks current; combined SSU+LCU packages can complicate rollback, so maintain tested offline images.
• Operationalize support: update helpdesk scripts to explain what is restored, what isn’t, and the expected user actions during OOBE. Provide fallback paths for users with complex Win32 app requirements.

---

Security and privacy analysis​

Strengths:

• Having backups tied to the Entra identity reduces the risk of mis-restores across tenants and simplifies the permission model. Intune tenant-level controls centralize governance.
• Microsoft’s cloud encryption posture (platform and service-side encryption, and options supporting customer-managed keys for broader Microsoft 365 workloads) provides a strong baseline for many enterprises.

Concerns and mitigations:

• The product stores backup artifacts within the tenant’s Exchange Online mapping. Organizations with strict data‑sovereignty or key-custody requirements should validate whether the default storage model and key management options satisfy those requirements; if not, consider third-party backup solutions that offer immutability, air‑gapped storage or customer-held keys.
• Access by Microsoft personnel is limited and audited, but any cloud service where engineers can escalate access introduces a surface that must be considered in high-assurance environments. Mitigation: contractual controls, audit logs, and data residency controls, plus using customer-managed keys where supported.
• Restore during OOBE implies the identity and enrollment flow are critical recovery controls; an attacker who controls or compromises identity paths could affect restore outcomes. Ensure strong identity protections (MFA, Conditional Access, Privileged Identity Management) are in place.

---

Marketplace context — where this fits vs third‑party options​

Windows Backup for Organizations is complementary to existing endpoint and M365 backup solutions rather than a replacement for them. It’s optimized for reducing user friction during provisioning and reimaging, not for long‑retention, point‑in‑time recovery of mailboxes, SharePoint/OneDrive content, or tenant-level identity object preservation. Organizations that require:

• Point-in-time mailbox restores, long retention or immutable backups for compliance; or
• Tenant-level capture of identity objects, role assignments and fine-grained Office 365 artifact retention

should continue to evaluate third‑party enterprise backups alongside this new native capability. Third‑party vendors traditionally offer richer retention, immutability, and cross-workload restore granularity that enterprise compliance programs often demand.

---

Verdict: who should adopt and when​

Windows Backup for Organizations is a practical, low-friction tool for enterprises that need fast, repeatable restore of user personalization and Microsoft Store app layouts during large-scale Windows 11 deployments or device refresh cycles. It is particularly attractive for organizations using Intune, Microsoft Autopilot (user-driven mode), and Entra identity as the enrollment control plane.
Adopt early if:

• You manage large fleets with consistent Intune/Entra practices and need to reduce helpdesk time for provisioning.
• You rely primarily on Microsoft Store apps and value restoring Start layout and personalization over full app reinstalls.

Defer or augment with third‑party solutions if:

• Your compliance profile demands customer‑held keys, long-term immutability, or offline/air-gapped retention.
• Your environment relies heavily on Win32 applications, server images or file-level disaster recovery; Windows Backup for Organizations is not a complete DR replacement.

---

Closing summary​

Microsoft’s general availability of Windows Backup for Organizations is a meaningful operational tool for enterprises migrating users to Windows 11 or refreshing fleets: it reduces reconfiguration time, restores familiar user experiences during OOBE, and centralizes control through Intune and Entra. The feature is tied to Intune-managed, Entra-joined devices and stores backup artifacts in Exchange Online in the tenant’s mapped region, protected by Microsoft’s multi-layer encryption practices and governed by Microsoft’s access controls. Administrators should pilot carefully, verify build and enrollment prerequisites, plan for network/load impacts during OOBE, and complement this capability with comprehensive file- and tenant-level backup strategies where regulatory, retention or immutability requirements exist. For organizations choosing to adopt, the immediate priorities are: validate device build baselines, run pilots with Intune tenant toggles, confirm data residency and compliance posture, and ensure identity/security hygiene to protect the restore path. These steps will let IT teams get the productivity upside without exposing the organization to unanticipated operational or compliance risks.

---

Source: Windows Report Microsoft Announces General Availability of 'Enterprise-grade' Windows Backup

 

[ChatGPT]

Microsoft has moved a long-promised enterprise feature out of preview: Windows Backup for Organizations is now generally available as an opt‑in, Intune‑managed service that saves Windows settings, personalization and Microsoft Store app manifests to the customer’s tenant and restores them during device enrollment (OOBE), speeding device refreshes and Windows 11 migrations.

Background / Overview​

Microsoft first announced the enterprise-focused backup capability at Ignite in 2024 and opened a limited public preview in mid‑2025 before promoting the feature to general availability as part of the August/September 2025 servicing wave. The GA announcement and supporting release notes are published by Microsoft and bundled into preview/servicing KBs that shipped with the August 2025 update. The product is explicitly targeted at organizations using Microsoft Entra (Azure AD) identity and Intune device management. It is positioned not as a full disaster‑recovery or file‑level backup but as a settings and app‑manifest recovery tool that reduces user downtime after a reset, reprovision, or device replacement—particularly valuable for organizations conducting mass Windows 11 migrations before Windows 10 reaches end of servicing.

---

What Windows Backup for Organizations actually does​

Core scope: intentional, narrow design​

Windows Backup for Organizations focuses on restoring the user experience, not performing block‑level or comprehensive file backups. The feature captures:

• User and system settings (personalization, accessibility, File Explorer preferences and other configured Windows settings).
• Microsoft Store app manifest (a list of installed Store apps and placement intent for the Start menu; manifests—not Win32 binaries).
• Select personalization assets where applicable (for example, saved desktop/lock screen images and certain stateful preferences).

It does not capture user documents, non‑Store (Win32/MSI/EXE) application binaries, or perform full disk imaging. For file continuity and long‑term retention organizations must continue to rely on OneDrive Known Folder Move, server backups, or third‑party endpoint backup and archival solutions.

How backups are created and restored​

• Backups are scheduled automatically in the background approximately every eight days, and users can also trigger manual backups through the Windows Backup app.
• Restores occur during Out‑Of‑Box Experience (OOBE) when a user signs into a freshly provisioned or reset Windows 11 device using the same Microsoft Entra account that owns the backup. The restore option must be enabled tenant‑wide by an Intune administrator to appear during OOBE.

---

System requirements, prerequisites and availability​

OS and build minimums​

Microsoft documents explicit minimum OS builds for backup and for the restore experience:

• Backup is available for:
• Windows 10, version 22H2 — build 19045.6216 or later.
• Windows 11, versions 22H2 / 23H2 / 24H2 on specified builds.
• Restore (OOBE) is available only on Windows 11 and requires particular cumulative update builds (examples documented by Microsoft). If devices are on older builds, enabling the Install Windows quality updates policy during enrollment can deliver the necessary updates at OOBE to enable the restore experience.

Exact build numbers and the date‑gated KBs are published in Microsoft Learn and in the Windows servicing KBs; administrators must verify builds in their environment before relying on OOBE restores.

Identity and management prerequisites​

• Devices must be Microsoft Entra joined (or Entra hybrid‑joined for backups). Restores require a device to be Entra‑joined at OOBE.
• Management configuration is Intune‑centric: admins enable backup via the Settings catalog (Enable Windows Backup) and turn the tenant‑wide Show restore page toggle under Devices → Enrollment → Windows in the Intune admin center. Tenant admin roles (Intune Service Administrator or Global Administrator) are required for the restore toggle.
• The feature is opt‑in and disabled by default. It is also rolled out in a staged fashion and may not immediately appear in every tenant.

Regional and cloud availability caveats​

• The feature is not currently available in Government Community Cloud High (GCCH), some sovereign clouds, or China (21Vianet) at GA. Multi‑Geo Exchange Online tenants are respected for data residency where configured.

---

Where backups are stored, and the data residency model​

Microsoft stores the Windows Backup for Organizations artifacts in Exchange Online within the tenant’s geographic mapping. That means:

• Backups are persisted in the customer’s tenant in Exchange Online and follow organizational data geography and Multi‑Geo mapping if configured. Administrators can see tenant data location in the admin center.
• Because the storage is within the Microsoft 365 tenancy, Exchange Online controls and, where applicable, Customer Key (customer‑managed keys) configurations for Exchange may affect how backups are encrypted and governed—enterprises with strict key‑custody needs should validate coverage for the Windows Backup payload specifically with Microsoft.

This tenant‑scoped storage model simplifies geo‑compliance for many customers, but it also ties the restore path to tenant‑level services (Exchange Online availability and the tenant’s identity controls).

---

Security, encryption and personnel access​

Microsoft states that backup data benefits from the layered encryption model used across Microsoft 365 and Azure: encryption in transit (TLS) and encryption at rest using platform and service‑level encryption. Access to customer data is governed by role‑based controls and audited processes; Microsoft personnel access is limited and logged for troubleshooting and legal compliance. Caveats for security teams:

• The public product documentation describes the encryption posture at a high level but does not publish full internal key management topology for this product’s artifacts. Organizations with stringent sovereign or key‑custody requirements should confirm contractually whether Customer Key or other tenant‑managed protections cover Windows Backup artifacts. This is a recommended pre‑deployment validation step.

---

Management and operational workflow​

How to enable (concise admin steps)​

• In Intune, create or edit a Settings catalog profile (Platform: Windows 10 and later → Profile type: Settings catalog).
• Search for Sync your settings and enable Enable Windows Backup (this makes the Windows Backup app and functionality available).
• To expose the OOBE restore UI, as an Intune Service Admin go to Devices → Enrollment → Windows → Enrollment options and set Show restore page to On (tenant‑wide).

Remember: the restore toggle applies only at enrollment time; changing it does not retroactively add the restore option to already enrolled devices. Pilot and plan enrollments accordingly.

Known incompatibilities and unsupported scenarios​

• Restore is not available for:
• Hybrid Azure AD join in some configurations.
• Self‑deploying Autopilot mode, Autopilot pre‑provisioned devices and certain reset flows.
• Manual enrollment via Settings, Group Policy enrollment, or Configuration Manager co‑managed enrollments.
• Shared or userless devices and certain Windows SKUs (e.g., IoT/Holographic/SE variants).
• Phishing‑resistant MFA can cause authentication friction during OOBE in VM or Hyper‑V scenarios (PRMFA prompts that VM hosts can’t pass through), so plan for Temporary Access Pass (TAP) or alternate authentication if required.

---

Strengths — where this helps IT the most​

• Reduced provisioning friction: Restoring personalization and Store app manifests during OOBE reduces manual configuration and helpdesk tickets after reimaging or device replacement.
• Faster Windows 11 migrations: Teams migrating many users from Windows 10 to Windows 11 regain user familiarity and Start‑menu layouts with less disruption.
• Tenant‑scoped governance: Intune tenant‑level controls centralize enablement and policy, which makes it easier to pilot and control rollout.
• Data residency alignment: Storing artifacts in Exchange Online within the tenant region simplifies geo‑compliance for multinational organizations that already use Microsoft 365 Multi‑Geo.

Independent press coverage and product summaries emphasize the practical benefit for large fleets where reconfiguration overhead is a real cost; however, industry writers consistently note that the product is not a full backup replacement.

---

Risks, limitations and sensible mitigations​

Risk: Misinterpreting the word “Backup”​

The product name can mislead non‑technical stakeholders into thinking it replaces endpoint backup or disaster recovery. It does not back up documents, non‑Store apps, or provide point‑in‑time file restores. Relying on it alone for compliance or legal holds would be a mistake. Mitigation: keep OneDrive or third‑party file backups and traditional image/DR tooling in your estate.

Risk: Identity dependency and attack surface​

Because restores are tied to Entra sign‑in at OOBE, identity compromise or misconfiguration (Conditional Access policies that block the Activity Feed Service) can prevent restores. Mitigation:

• Enforce strong identity protections (MFA, Conditional Access, Privileged Identity Management).
• Validate Conditional Access allow lists for the Activity Feed and Intune endpoints used by OOBE.

Risk: Tenant‑level storage coupling​

Backups live in Exchange Online; an Exchange outage, tenant misconfiguration, or litigation hold/retention policy interactions could affect availability or retention assumptions. Mitigation:

• Review tenant retention, Customer Key coverage, and DPA contract terms.
• Keep operational runbooks and alternate recovery workflows that do not assume immediate Exchange access.

Risk: Provisioning load and bandwidth​

Restores during OOBE can increase network demand (Store app re‑installation and quality updates at OOBE). Mitigation:

• Pilot to measure OOBE time and bandwidth.
• Use Delivery Optimization, WSUS, or pre‑stage updates in images where possible.
• Stagger enrollments to avoid peak load.

Risk: Compliance edge cases​

Enterprises with strict sovereign or customer‑key-only requirements must verify that Windows Backup payloads are covered by configured Customer Key settings for Exchange Online. Mitigation: verify with Microsoft account teams and include coverage clauses in procurement or DPA terms before broad adoption.

---

Practical adoption checklist (recommended sequence)​

• Inventory: List device models, OS versions, and Entra join state across your estate.
• Build verification: Confirm devices meet the documented minimum builds for backup and (separately) for OOBE restore.
• Pilot group: Select representative user personas (knowledge workers that use Store apps and personalized settings).
• Intune configuration:
• Create a Settings catalog profile and enable Enable Windows Backup.
• Toggle Show restore page in Enrollment options during pilot.
• Configure Enrollment Status Page (Install Windows quality updates) as needed.
• Network and update strategy: Prestage updates or use Delivery Optimization to reduce OOBE bandwidth.
• Security review: Validate identity protections, Conditional Access, and Customer Key coverage for Exchange.
• Test and document: Validate backup creation cadence, restore fidelity, failure modes, and user communications.
• Rollout: Expand rings progressively and operationalize helpdesk runbooks for the new OOBE restore flows.

---

How this fits with other enterprise backup tools​

Windows Backup for Organizations is complementary to endpoint and Microsoft 365 backup solutions, not a replacement. Compare by capability:

• Windows Backup for Organizations:
• Strength: restores personalization and Store app manifests during OOBE; tenant‑scoped; Intune‑managed.
• Weakness: no file-level or Win32 app binary restoration; limited retention/restore granularity.
• OneDrive / Server / Third‑party endpoint backup:
• Strength: file‑level retention, long‑term archives, immutability and legal holds.
• Weakness: typically not integrated into OOBE as a seamless restore of settings and Start layout.

Enterprises that require long retention, immutability, or cross‑workload restore (mailboxes, SharePoint, OneDrive, Teams) will continue to rely on third‑party backup vendors or Microsoft 365 backup partners for those needs. Windows Backup for Organizations should be folded into a layered backup and continuity plan where it addresses one specific point problem—rapid restoration of user settings during provisioning—while other tools cover files and full system recovery.

---

Realistic expectations and closing assessment​

Windows Backup for Organizations is a pragmatic addition to the enterprise provisioning toolkit. For Intune‑managed, Entra‑joined estates it removes a repetitive and time‑consuming piece of device refresh work: restoring user preferences, Wi‑Fi networks where supported, accessibility settings and a Start‑menu app manifest on Windows 11 during OOBE. It is especially useful for organizations racing to migrate users from Windows 10 ahead of support end dates and for large fleets where even small per‑device time savings aggregate into significant operational cost reduction. However, the feature has important caveats: it is not a full backup, it depends on tenant services (Exchange Online and Entra), it is gated by build and enrollment requirements, and it is disabled by default until an admin opts in. Security, compliance and legal teams should verify encryption, retention and customer‑managed key coverage for their tenant payloads before depending on Windows Backup for Organizations for sensitive workloads. For organizations that plan and pilot carefully—validating builds, auth flows, bandwidth impacts and Customer Key coverage—this capability will streamline reprovisioning, lower helpdesk tickets, and make Windows 11 migrations smoother. For those with strict compliance, sovereign or full‑data recovery needs, the feature is a useful adjunct, not a replacement, and should be integrated into a layered continuity, backup and device management strategy.

---

Quick reference: admin commands and policy hints​

• Intune Settings Catalog path: Platform: Windows 10 and later → Profile type: Settings catalog → search Sync your settings → set Enable Windows Backup to Enabled.
• Tenant restore toggle: Intune Admin Center → Devices → Enrollment → Windows → Enrollment options → Show restore page → On (requires Intune Service Administrator or Global Admin).
• If devices are on older builds, enable Install Windows quality updates (ESP feature) to deliver required servicing updates during OOBE.

---

Windows Backup for Organizations closes a practical gap in the provisioning lifecycle: it returns user familiarity quickly after a reset or replacement, but it must be treated as one tool in a broader backup and migration playbook. Administrators should pilot early, verify residency and key management coverage, and keep layered protections for files and full system recovery firmly in place.

---

Source: Techzine Global Microsoft introduces Windows Backup for Organizations