Microsoft will begin automatically backing up Windows settings for commercial customers when Windows 11 version 26H2 ships later this year, a change that will affect millions of enterprise devices unless IT administrators take deliberate action to block it.

In a recent update to its Windows IT Pro documentation, the company confirmed that on Microsoft Entra-joined and Entra hybrid-joined devices, the Windows Backup feature will be enabled by default — silently syncing credentials, personalization, and app data to the cloud. Admins who leave the existing policy in a "Not Configured" state will see their users' settings backed up without any explicit user consent.

The switch Microsoft just flipped that IT shops need to know about

The change is effective with Windows 11 version 26H2, the feature update expected in the second half of 2025. In previous releases, Windows Backup was an opt-in service. Users or administrators had to proactively turn it on through the Windows Backup app or via Group Policy / MDM.

Now, Microsoft is reversing that default for Entra-joined machines. If the associated policy — "Turn off Windows Backup" — is left in its default "Not Configured" state, the backup feature will behave as if it's enabled. This covers:

  • Saving settings to the user's Microsoft OneDrive account
  • Backing up credentials for Wi-Fi networks, printers, and other resources
  • Remembering app list and preferences for a smoother device restore

Crucially, this only applies to devices joined directly to Microsoft Entra ID (formerly Azure AD) or in a hybrid join configuration. Standalone workgroup machines, classic domain-joined-only devices (without Entra hybrid), and consumer PCs running Windows 11 Home or Pro without a work/school account are not affected.

Microsoft's documentation frames this as a benefit for end users: a seamless migration experience when switching devices or recovering from a hardware failure. But for IT administrators, it introduces a data sovereignty and compliance consideration that demands a conscious policy decision before 26H2 rolls out.

Who needs to act, and who can wait

The impact falls squarely on three audiences:

Enterprise admins with Entra-joined fleets

These are the primary targets. If your organization uses Microsoft Intune, Group Policy, or any MDM to manage Windows 11 devices, and those devices are Entra-joined or Entra hybrid-joined, Windows Backup will start syncing user data to personal OneDrive accounts unless you set the "Turn off Windows Backup" policy to "Enabled" (i.e., actually turn it off). This is a policy reversal: now, "Enabled" means you're disabling backup, and "Not Configured" means backup is on.

Backup data includes browser settings, accessibility preferences, language and keyboard configurations, and passwords for Wi-Fi networks. For regulated industries, this automatic exfiltration of credentials could raise red flags. Even for non-regulated firms, the prospect of user settings flowing into personal OneDrive accounts — possibly mingling with personal data — is a new governance headache.

Users on managed Entra devices

End users may notice little until they set up a new PC. At that point, Windows Setup will offer to restore from a previous backup, potentially pulling in settings from the old device. This could be a welcome convenience, but it also means users might inadvertently restore corporate configurations onto a personal device if they sign in with the same work account. The restore process doesn't discriminate between managed and unmanaged targets, so a user setting up a personal laptop and signing in with their work account could see enterprise Wi-Fi credentials and app lists appear.

Home users and small businesses without Entra

Nothing changes. Windows Backup remains opt-in for consumer accounts and for businesses running devices that are not Entra-joined. The default policy shift only triggers when a device is associated with an Entra tenant.

The path that led to silent backups

Windows Backup isn't new. It debuted with Windows 10 and gained a more polished front end in Windows 11. Historically, it was positioned as a consumer-friendly feature, competing with Apple's iCloud backup or Android's automatic cloud sync. Microsoft encouraged users to turn it on during initial device setup, but it never forced the issue on business machines.

The pivot began with Windows 11's 2024 updates. Microsoft started prompting Entra-joined users with a post-login notification to "Back up your PC" in the Windows Backup app. That nudge was easily dismissed, and admins could suppress it via Intune. With 26H2, the nudge becomes a default. The timing aligns with Microsoft's broader push to make Windows more cloud-attached, evidenced by the growing integration of OneDrive, Microsoft 365, and Windows settings synchronization.

Last year, Microsoft introduced a "Windows Backup and Restore" experience that leaned heavily on OneDrive. The 26H2 change completes that arc: making backup the norm for managed accounts, not an exception. The company telegraphed this in a January 2025 message center post (MC975689) warning admins about the upcoming default change, but many IT teams missed it amid the flood of Copilot and security advisories.

Three concrete steps to take before 26H2 lands

You don't have to wait. The policy is manageable today with current Windows 11 builds, and you can test it before 26H2 hits general availability.

1. Audit your policy posture now

Open Microsoft Intune (or your Group Policy Management Console) and navigate to:

Computer Configuration \ Administrative Templates \ Windows Components \ Windows Backup

Look for "Turn off Windows Backup". If it's "Not Configured", you're currently allowing backups, but users had to opt in. Under 26H2, that same "Not Configured" means backup will be silently enabled. The safest approach: set it to "Enabled" if you want to block backups outright, or "Disabled" if you explicitly want to allow them (though "Disabled" effectively gives the same result as "Not Configured" post-26H2 — it permits backup). The critical point is to make an intentional choice.

2. Communicate the change to users

If you decide to embrace automatic backup, prepare users for what gets synced. Credential backup, in particular, can surprise people who assumed corporate networks passwords stay on corporate devices. If you block backup, inform users that they won't be able to restore settings when moving to a new PC — and consider offering an alternative, like a company‑sanctioned migration tool.

3. Test the behavior on a pilot ring

Enroll a small set of 26H2 preview devices (via the Windows Insider Program for Business) and observe the backup flow. Check whether settings are indeed saved to OneDrive, and test the restore experience on a clean machine. This gives you a real‑world picture of how much data leaves your environment and what the user sees.

Microsoft's unclear messaging and what comes next

The policy inversion — where "Enabled" now means "Feature is off" — is bound to cause confusion. Microsoft's documentation still references the old behavior in some places, and the change requires admins to read the fine print: "If you leave this policy as Not Configured, Windows Backup will be turned on for your device." It's a double negative that will trip up anyone skimming the setting.

We expect Microsoft to refine the wording before 26H2's public launch. More importantly, there are lingering questions:

  • Will backup data be encrypted in transit and at rest using tenant‑specific keys, or rely solely on the user's personal OneDrive encryption?
  • Can admins control the scope of backup (e.g., exclude passwords, include only display settings)? Currently, it's all or nothing.
  • What happens when a user leaves the organization? The backup remains in their personal OneDrive unless you revoke access, but the data has already walked out the door.

For now, the immediate task is clear: figure out what your organization's stance is on Windows Backup and set the policy accordingly before 26H2 begins its phased rollout, likely in September or October 2025.

What to watch next

Microsoft's cloud‑first play isn't slowing down. The 26H2 backup default is one piece of a larger puzzle that includes Windows known folder move to OneDrive, automatic sign‑in for Microsoft Edge, and the steady erosion of the line between personal and work accounts on Windows. Expect more announcements at Microsoft Ignite later this year, and keep an eye on the Windows IT Pro Blog for a formal policy clarification. In the meantime, that one simple Intune toggle might save you a support‑desk avalanche.