Microsoft Enables Windows Settings Backup by Default on Entra‑Joined Windows 11 Devices
What Happened — Starting with Windows 11 version 26H2, Microsoft will enable the Windows Settings Backup tool by default on devices that are Microsoft Entra‑joined or hybrid‑joined, unless an administrator explicitly disables the policy via Intune or Group Policy. The feature backs up user‑level settings after a reset, replacement, upgrade, or re‑image.
Why It Matters for Compliance & Audit Readiness
- The default‑on change alters the configuration baseline that auditors will examine under SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations).
- Organizations must capture the new policy state as continuous evidence to demonstrate control over configuration and backup processes.
- If the backup is unintentionally left enabled in regulated regions (EU DMA, sovereign clouds), it could create a gap in data‑handling policies that must be documented and mitigated.
Who Is Affected — Enterprises that deploy Windows 11 26H2 on Entra‑joined devices across all industries, especially those subject to strict change‑management and data‑protection requirements (e.g., finance, healthcare, government).
Recommended Actions
- Review the Windows Settings Backup policy in Microsoft Intune or Group Policy and explicitly set it to Disabled if the backup does not align with your data‑retention or privacy controls.
- Record the policy configuration in your change‑management system and map it to the relevant SOC 2 controls (CC6.1, CC7.1).
- Automate collection of policy‑state snapshots (e.g., via PowerShell or endpoint management logs) to maintain a defensible audit trail.
Technical Notes
- The default‑on behavior applies only to devices not subject to the EU Digital Markets Act, not in sovereign or restricted cloud environments, and only when the backup policy is unset.
- Restore functionality remains disabled by default; administrators must still configure restore settings explicitly.
Source: BleepingComputer