LIVE · cybersecurity feed
Live wire
microsoft

Microsoft to enable Windows settings backup by default for orgs

Microsoft will enable its Windows settings backup and restore tool by default for enterprise systems that are joined to Microsoft Entra or are Microsoft Entra hybrid-joined, beginning with the Windows 11 26H2 update. This change will apply to eligible devices where administrators have not explicitly configured the backup and restore policy.

ZeroDay News ·

Source: BleepingComputer

Microsoft will enable its Windows settings backup and restore tool by default for enterprise systems that are joined to Microsoft Entra or are Microsoft Entra hybrid-joined, beginning with the Windows 11 26H2 update. This change will apply to eligible devices where administrators have not explicitly configured the backup and restore policy.

The tool, previously known as Windows Backup for Organizations, is designed to facilitate the backup and restoration of enterprise users' Windows settings following events such as device resets, replacements, upgrades, or reimaging. It was initially introduced as an opt-in feature at the Microsoft Ignite conference in November 2024, entered public preview in May 2025, and achieved general availability in August 2025. Its functionality became accessible after installing the September 2025 Windows Monthly Cumulative Update on Entra-joined devices, though IT administrators were required to manually enable it through policy configurations.

According to a recent update to Microsoft's message center, the default behavior for the Windows settings backup policy will transition from disabled to enabled with Windows 11 version 26H2. This default-on setting is specifically for eligible devices and will only take effect if administrators have not previously set a specific policy. Any explicit configurations for enabling or disabling the backup and restore settings will continue to be honored.

The default-on behavior for Windows backup will be limited to devices running Windows 11 26H2 that are located in countries or regions not subject to the EU Digital Markets Act (DMA). It will also exclude devices operating within sovereign or restricted cloud environments, and those for which the backup policy has not been configured.

Even on systems where the tool is enabled by default, IT administrators will maintain complete control through mobile device management (MDM) solutions. Administrators who wish to disable the backup policy can do so using Microsoft Intune or Group Policy, as these explicit settings will override the default behavior. It is important to note that the restore functionality itself will not be enabled by default; users will still require explicit administrative configuration to restore Windows devices.

Microsoft product manager Miranda Leschke indicated that organizations can test this updated experience early. The default-on behavior is currently available for Windows 11 version 26H2 within the Windows Insider Program's Experimental channel, starting in July 2026. The broader rollout for eligible devices is expected to coincide with the general availability of Windows 11 version 26H2 later this year. Devices that were initially running Windows 11 version 26H1 will receive the same default-on treatment with their subsequent feature update.

microsoftwindowsbackupenterprisesecurity
ShareXLinkedInWhatsAppFacebook

More News

view all →
security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.