Windows Settings Backup Is On by Default From 26H2 — What You Need to Do Before It Hits Your Fleet

What Just Changed

Starting with Windows 11, version 26H2, eligible devices will have Windows settings backup turned on by default. If your backup policy is currently set to Not Configured — which is the case for most environments that have never explicitly touched this feature — backup will start running automatically when 26H2 lands on those devices.

This is a change to the default state, not a forced policy override. Explicit policy always wins. The default-on only applies to devices where the backup policy has never been touched by Intune, Group Policy, or any MDM solution.

The feature has also been renamed. Windows Backup for Organizations is now called Windows settings backup and restore. If you have been searching for it in Intune Settings Catalog or Group Policy under the old name, start looking under the new one — documentation is being updated progressively.

Available now in the Windows Insider Program Experimental channel. General availability ships with Windows 11, version 26H2 in the second half of 2026.

Why Microsoft Made Backup a Baseline

The framing from Microsoft is deliberate: settings backup is now positioned as a resilience baseline — in the same category as BitLocker or secure boot. Not something IT opts into during a project, but something that is simply on, because devices get lost, reset, and replaced as a normal operational event.

The operational case is straightforward. When a laptop is lost, stolen, or goes through a hardware refresh, the device needs to be reset or reimaged. Without backup, that user loses their Windows settings and their Microsoft Store app list — everything that made the device feel familiar and configured correctly. With backup on by default, that configuration is already captured before the incident happens, and restore can bring it back automatically.

Microsoft validated this internally at scale. Brian Fielder, VP at Microsoft Digital, put it plainly: settings and Store apps now move seamlessly with employees across device replacements, removing the heavy lifting of manual reconfiguration. The goal is that a device replacement feels like picking up where you left off, not starting from scratch.

Exactly Which Devices Are In Scope

The default-on behaviour applies only to devices that meet all four of the following conditions simultaneously. Missing any single condition means the device stays on its current behaviour.

Devices That Stay Off by Default

What Gets Backed Up

This is not a full system backup. It is not OneDrive file sync. It is not a Windows restore point. Windows settings backup captures two specific categories of data:

• User settings — accessibility preferences, language and region settings, taskbar layout, Start menu pins, wallpaper, display preferences, and a range of system preferences that define how Windows looks and behaves for that user.
• Microsoft Store app list — the catalogue of Store apps the user has installed. On a restored device, these can be reinstalled automatically from the list.

This distinction matters when communicating upward and to end users. Documents, browser data, and desktop files are not in scope — that is OneDrive's job. Settings and Store apps are the gap that this feature fills: the configuration layer between a clean Windows image and a device that feels like the user's own.

How to Check Your Current Policy State

Before 26H2 ships to your fleet, you should know exactly what state your backup policy is in. Devices with Not Configured policy are the ones where the default-on will take effect at upgrade time.

In Intune, go to Devices › Configuration › Policies and filter for any policies targeting Windows Backup settings. If you have no policy covering this feature, your non-EU, non-sovereign devices will get backup turned on automatically when they upgrade to 26H2.

To check the current policy state on a device directly, the script below looks for the Windows Backup policy registry key. If the key does not exist, the device is in the Not Configured state and will follow the default-on behaviour after upgrading to 26H2.

# Determine whether Windows Backup policy has been explicitly configured
# Run as Administrator on each device, or deploy via Intune script

$gpPath  = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsBackup"
$mdmPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsBackup"

$gpExists  = Test-Path $gpPath
$mdmExists = Test-Path $mdmPath

if (-not $gpExists -and -not $mdmExists) {
    Write-Host "[NOT CONFIGURED] No backup policy found." -ForegroundColor Yellow
    Write-Host "This device will have backup ENABLED by default when upgraded to Windows 11 26H2."
    Write-Host "Action: Decide your desired state and set the policy explicitly before 26H2 arrives."
} else {
    Write-Host "[CONFIGURED] Explicit policy exists — 26H2 default will NOT apply." -ForegroundColor Green
    if ($gpExists)  {
        Write-Host "GP path  : $gpPath"
        Get-ItemProperty $gpPath  | Format-List
    }
    if ($mdmExists) {
        Write-Host "MDM path : $mdmPath"
        Get-ItemProperty $mdmPath | Format-List
    }
}

The Three Admin Decisions

Microsoft gives you three valid postures. Pick one and make it explicit. Relying on the default is not an admin-managed state — it is an audit gap.

Decision 1 — Accept the Default and Make It Explicit

For most commercial environments outside the EU, keeping backup on is the right call. No behavioural change required on eligible devices — backup starts automatically with 26H2. Microsoft's recommendation is to set the policy to Enabled explicitly regardless of whether you want the backup on, because an explicit Enabled policy gives you an audit trail and the ability to scope backup by device group via Intune assignments rather than relying on the blanket default.

Decision 2 — Opt Out

If your organisation needs backup off — data residency requirements, legal holds, a regulatory position on cloud-synced settings, or simply a preference not to send configuration data to Microsoft's cloud — set the backup policy to Disabled explicitly via Intune, Group Policy, or your MDM solution. An explicit Disabled setting takes precedence over the default-on both now and in future Windows releases. You will not need to revisit this for every future version.

Decision 3 — Enable Restore for the Full Replacement Workflow

Backup and restore are separate policies. Having backup on does not automatically enable restore. If you want the full device replacement experience — where a user gets their settings and app list back automatically on a new or reset device — you need to configure the restore policy separately. This is the configuration that actually changes the replacement-day experience for end users. It requires explicit setup and is covered in the Microsoft Intune documentation linked in the References section.

The Device Replacement Workflow Change

Here is what the default-on change means in practice for the device lifecycle workflow your helpdesk runs today.

The 26H1 Exception and Phased Rollout

Devices that were originally running Windows 11, version 26H1 are temporarily exempt from the 26H2 default-on. They will receive the same default-on treatment with the following annual feature update. This is a phased rollout by design, not a permanent exclusion.

Action Checklist Before 26H2

1. Run the policy state check script above against a sample of devices to confirm how many are in the Not Configured state. For fleet-wide visibility, deploy it as an Intune script and review the output report.
2. Decide your posture per device segment — backup on for most, backup off for EU or sovereign cloud devices, or a uniform explicit-on policy for everything. Document the decision.
3. Create or update your Intune policy to set backup (and restore, if desired) explicitly via Settings Catalog. Assign to the appropriate device groups before 26H2 reaches your fleet.
4. Configure restore separately if you want the full replacement workflow — backup on alone is not enough. Restore requires its own policy assignment.
5. Validate on Windows Insider Experimental channel — the feature is available now. Test the end-to-end backup and restore experience on a test device before 26H2 GA.
6. Update your run books and comms — inform the helpdesk of the change, update your device refresh procedure to reference restore, and set user expectations appropriately.

References

• Windows IT Pro Blog — Windows settings backup becoming a new resilience baseline (Miranda Leschke, Microsoft, July 6 2026)
• Microsoft Learn — Policy CSP — WindowsBackup
• Microsoft Learn — Configure backup and restore policies in Microsoft Intune
• Windows Insider Blog — test the feature in the Experimental channel