Windows will start backing up work laptops by default in 2026
Microsoft is flipping its enterprise settings backup tool from opt-in to opt-out for Windows 11 26H2, and IT teams have until later this year to decide if they want it on.
Key points
- Microsoft will enable Windows settings backup by default on Entra-joined business PCs running Windows 11 version 26H2, expected later in 2026.
- The feature, previously called Windows Backup for Organizations, reached general availability in August 2025 as an opt-in tool.
- Devices in the European Union, sovereign clouds, or restricted cloud environments are excluded from the default-on change.
- IT admins keep full control and can switch the backup off through Microsoft Intune or Group Policy.
- Restoring settings to a new device still requires an admin to turn it on manually.
Microsoft is about to change a quiet default on millions of work laptops.
Starting with Windows 11 version 26H2, the operating system will automatically back up a user's Windows settings to the cloud on company-managed PCs. Today that feature is off unless an IT team switches it on. Soon it will be on unless they switch it off.
The news was first reported by BleepingComputer after Microsoft posted the change to its admin message center.
What is actually being backed up?
Windows settings. Not your files, not your emails, but the preferences that make a laptop feel like yours: wallpaper, accessibility options, language choices, app layout, and similar bits of configuration.
The tool is called Windows Backup for Organizations. Microsoft showed it off at its Ignite conference in November 2024, put it into public preview in May 2025, and made it generally available in August 2025. Until now, an IT administrator had to turn it on through a policy.
That is the piece that is changing.
Should ordinary workers care?
Mostly in a good way. If your work laptop dies, gets stolen, or is swapped out, your replacement machine can look and feel like the old one within minutes rather than a painful afternoon of clicking through menus.
There is a catch worth understanding. The backup only runs on devices signed in to a company's Microsoft Entra account, which is Microsoft's cloud identity service (think of it as the corporate login that ties your laptop to your employer). Personal PCs are not affected by this change.
And restoring your settings to a new device still needs an admin to allow it. Backup default-on, restore default-off. Microsoft is being cautious about the direction data flows.
Who is excluded?
Microsoft is carving out several groups. Devices in countries governed by the European Union's Digital Markets Act, a law that limits how big tech firms can bundle their services, will not get the default-on treatment. Neither will devices in sovereign cloud setups (special versions of Microsoft's cloud used by governments) or other restricted cloud environments.
Everywhere else, eligible business PCs are in scope.
When does this happen?
Microsoft product manager Miranda Leschke said the default-on behaviour will appear in the Windows Insider Program Experimental channel starting July 2026, then take broad effect when Windows 11 version 26H2 becomes generally available later that year. Machines still on version 26H1 will get the same treatment at their next feature update.
Admins who want to keep things as they are can pre-empt the change now. Setting the backup policy to "disabled" through Microsoft Intune or Group Policy will override the new default. Microsoft has been explicit that any policy an admin sets, on or off, wins over the default.
Is there a security angle?
Yes, and it cuts two ways.
On one hand, cloud backup of settings makes device replacement quicker after a lost or stolen laptop, which is a genuine incident-response win. On the other hand, any expansion of what a corporate identity account holds is another thing worth protecting. If an attacker takes over an Entra account, they now also inherit a tidy profile of that user's device preferences across machines.
The change is not a vulnerability. It is a default. But defaults are how most security decisions actually get made in the real world, quietly, by the vendor, on behalf of everyone who never opens the settings panel.
IT teams have a few months to decide what they want the answer to be.
