Microsoft makes Windows settings backup the default in 26H2, sparking admin concerns

The shift from opt-in to opt-out could send IT administrators scrambling to disable the feature in environments where cloud backups are not permitted.

By LineZotpaper
Published
Read Time2 min
Microsoft has released Windows 11 26H2 with a notable change: Windows backup and restore, previously off by default, is now enabled automatically for eligible devices. The move has raised concerns among administrators who may need to opt out to prevent settings and app data from being sent to the cloud, particularly in privacy-sensitive regions.

The latest feature update for Windows 11, version 26H2, is now available. While users on the previous 25H2 release will notice little change — 26H2 shares the same code base, delivered via an enablement package, and the same set of known issues (all now listed as 'mitigated') — administrators face important alterations. Chief among them is the default enablement of Windows backup and restore (formerly Windows Backup for Organizations).

The service backs up a device's settings and a list of Microsoft Store apps, with the goal of allowing seamless restoration when a user moves to a new device. Microsoft has described the objective as helping 'organizations to transition to a cloud-first approach for managing devices and user settings.' However, many organizations are prohibited from sending this data to the cloud due to internal policies or regulatory requirements. The default-on setting will not apply in regions covered by the EU Digital Markets Act or in sovereign and restricted environments, but for other eligible devices — those that are Entra joined or Entra Hybrid joined — the backup will begin upon installing the update unless an administrator has explicitly opted out.

Administrators are rightfully wary of any switch from opt-in to opt-out, even for seemingly useful functionality. The issue is that backing up settings and app lists does not include actual user data files; that remains a separate task. Nonetheless, the automatic start of cloud backups may conflict with data governance policies, forcing IT departments to take proactive steps to disable the feature.

§

Analysis

Why This Matters

  • IT administrators now face an additional configuration burden: they must actively disable a feature that was previously optional, increasing management overhead.
  • Organizations with strict data sovereignty or compliance rules may inadvertently start sending settings data to Microsoft’s cloud, potentially violating internal policies.
  • The change signals Microsoft’s push toward a cloud-first device management model, which may accelerate enterprise adoption of cloud-based backups — or trigger resistance.

Background

Microsoft has long offered Windows backup capabilities, but the service was traditionally opt-in. With Windows 11 26H2, the company flips the default, aligning with broader industry trends toward cloud-based device management and zero-touch provisioning. The feature stores settings and app lists, not user files, but the principle of automatically sending organizational data to the cloud is a significant policy shift. Previous Windows releases often introduced similar defaults gradually, sometimes drawing pushback from enterprise customers.

Key Perspectives

Microsoft: The company promotes the feature as part of a 'cloud-first approach' that simplifies device transitions and reduces IT workload when provisioning new machines. IT Administrators: Many view the default-on change as an unwelcome surprise that forces manual intervention to ensure compliance with data residency and privacy rules, especially in sectors like government, finance, and healthcare. Critics/Skeptics: Privacy advocates and security professionals caution that any automatic cloud data transmission can expand the attack surface, even if limited to settings. They urge organizations to review group policies immediately.

What to Watch

  • Whether Microsoft provides a straightforward opt-out pathway via Group Policy or Intune, and how quickly administrators can respond.
  • Possible announcements from Microsoft addressing enterprise concerns or offering additional controls.
  • Reports of unintended data leakage or compliance incidents in organizations that miss the default change.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.