Microsoft is automatically enabling cloud backup of Windows settings on managed business PCs joined to Microsoft Entra ID. With the upcoming feature update of Windows 11, configuration data will upload to the Microsoft cloud without user or administrator intervention on eligible devices.
The change applies to devices managed through Entra join or hybrid join. Previously, administrators had to actively enable the backup. The new default shifts the behavior from opt-in to opt-out, with control exercised solely through an explicitly set policy.
Scope of the Backup
The Windows Backup feature captures user settings, personalization options, accessibility preferences, and the list of installed Microsoft Store apps. This allows users to restore their configuration after switching devices when signing in with the same Entra account. Classic desktop applications are excluded. Personal files are not part of this backup and continue to rely on OneDrive folder redirection and retention policies.
The process starts automatically every eight days in the background once enabled. Data is stored in the organization's tenant and remains tied to the user's Entra account.
EU Exception and Regulatory Context
Devices located in the European Union are exempt from the automatic activation under the Digital Markets Act. These devices retain the previous opt-in behavior.
Disabling the Feature
Administrators can disable the backup using Group Policy or Intune. The relevant Group Policy path is Computer Configuration -> Administrative Templates -> Windows Components -> Sync your settings, where the setting Enable Windows Backup should be set to Disabled. The equivalent CSP policy is SettingsSync/EnableWindowsbackup with the value disabled.
Intune administrators can achieve the same result through a settings catalog configuration profile. Microsoft warns against mixing Group Policy and CSP controls, as conflicting settings may produce unpredictable results. Existing policies remain in effect after the update; the new default only applies to devices marked as Not configured.
Backup Without Automatic Restore
The policy change affects only the backup direction. Restoration remains disabled by default and requires a separate configuration in Intune under Devices -> Enrollment -> Windows Backup and Restore. Until restoration is explicitly enabled, the automatic backups provide limited operational value.
Organizations outside the EU should evaluate the new default against their internal data protection and compliance requirements before the feature update rolls out.
