Microsoft Turns On Windows Settings Backup by Default for Entra-Joined PCs
On Windows 11 26H2, Microsoft now enables Windows settings backup by default for eligible Entra-joined devices. For small businesses, it is one more recovery layer—not a full backup strategy.
Here Is How Layered Recovery Defenses Help
Microsoft says Windows settings backup is now on by default for eligible Microsoft Entra-joined or Entra hybrid-joined PCs that have moved to Windows 11 version 26H2. The feature, once branded Windows Backup for Organizations, stores supported Windows settings and the Microsoft Store app list so users can get back to a familiar desktop after a reset, replacement, upgrade, or reimage.
What actually changed
According to a Message Center update covered by BleepingComputer, the new default applies only when admins have not already set the backup policy. Explicit enable or disable choices still win. Restore remains admin-controlled and is not turned on by default. The default-on behavior also skips DMA-regulated regions, sovereign or restricted cloud environments, and devices still on older Windows builds.
Where admins keep the steering wheel
Intune and Group Policy can still disable backup if that is the right call for your tenant. Microsoft’s pitch is simple: when a PC enters recovery, you should not have to guess whether settings were saved.
What this means for your company
Settings sync is helpful, but it is only one layer in a recovery stack. Treat it that way:
- Accept the platform default where it fits. On eligible 26H2 Entra-joined devices, letting settings backup run reduces rebuild time after malware wipe or hardware failure.
- Keep full image and file backups separate. Settings and Store app lists do not replace backups of documents, line-of-business data, or server workloads (tools such as Veeam or Microsoft 365 backup products are examples of layers that sit beside Windows settings backup).
- Decide restore policy on purpose. Microsoft still expects admins to enable restore deliberately—document who can trigger it.
- Pair recovery with prevention. Endpoint protection, least-privilege admin, and tested incident runbooks shrink how often you need any backup at all.
Need help building layered Windows and Microsoft 365 recovery plans? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
Details on the default-on change come from BleepingComputer’s report on Microsoft’s Windows settings backup update.
About The Author
