Microsoft did not release a normal Windows cumulative security update today, but it did publish an important Windows admin/support notice on July 9, 2026: Windows settings backup policy is becoming a new default starting with Windows 11, version 26H2.
This is not a zero-day alert, not a Patch Tuesday release, and not a macOS security update. It is still worth attention for small businesses because it changes the default backup behavior for eligible Windows 11 devices when an administrator has not already made an explicit policy choice.
In plain English: Microsoft is moving Windows settings backup from something that is off by default to something that is on by default for eligible Windows 11 version 26H2 devices. If your business already set the policy to enabled or disabled, Microsoft says that explicit setting will continue to be honored. Restore remains admin-controlled and is not automatically enabled by this change.
What Microsoft Announced Today
Microsoft’s Windows Message Center posted the July 9, 2026 announcement under “Windows settings backup policy is becoming a new default.” Microsoft says that starting with Windows 11, version 26H2, the default behavior of the Windows settings backup policy shifts from disabled to enabled for eligible devices, but only when admins have not explicitly configured the policy.
Microsoft’s Windows Backup for Organizations overview gives the operational details behind the feature. It explains that Windows Backup for Organizations is now being renamed to “Windows settings backup and restore,” and says the backup feature preserves user settings and Microsoft Store app configurations to help with device transitions, upgrades, resets, and PC refresh projects.
The key details for business owners and office managers:
- Backup policy default changes in Windows 11 version 26H2. Eligible devices can have Windows settings backup enabled by default if no admin policy says otherwise.
- Admin choices still win. If your IT provider, internal admin, Intune policy, Group Policy, or MDM policy already enabled or disabled Windows Backup, Microsoft says that setting remains honored.
- Restore is separate. Microsoft says this change applies only to backup policies. Restore behavior is still controlled by administrators and is not automatically enabled.
- This is mainly about resilience. The benefit is smoother recovery of settings and Microsoft Store app lists when a user moves to a replacement PC, resets a device, or upgrades.
- This is not a full backup solution. It does not replace OneDrive Known Folder Move, image backups, endpoint management, server backups, accounting data backups, or line-of-business application backup plans.
Who Is Affected
This matters most to organizations with Windows devices joined to Microsoft Entra ID or hybrid joined to Entra ID, especially if they use Microsoft Intune, Group Policy, Windows Autopilot, or another mobile device management tool.
Based on Microsoft’s current documentation, backup eligibility includes users signed in with Microsoft Entra ID on supported Windows builds. Microsoft lists backup support for Windows 10 version 22H2 build 19045.6216 or later, Windows 11 version 22H2 build 22621.5768 or later, Windows 11 version 23H2 build 22631.5768 or later, and Windows 11 version 24H2 build 26100.4946 or later. Restore support has its own requirements, and Microsoft separates restore during device setup from restore during first sign-in.
For a home PC, this change may simply feel like Windows doing a better job remembering settings between devices. For a business, it is a policy and compliance question: do you want Windows settings backup enabled, do you want restore enabled, who can control it, and do your existing privacy, retention, and device replacement procedures match what Windows will do?
Why It Matters For Small Businesses
PC replacement is one of those jobs that looks simple until a user loses a day to missing browser preferences, app lists, Start menu layout, accessibility settings, or small workflow details. Windows settings backup can reduce that friction. If it works as intended, a replacement PC or reset PC may feel less like starting over.
The benefit is strongest when the business already uses modern device management. For example:
- A laptop fails and the employee receives a replacement device.
- A Windows 10 machine is replaced during a Windows 11 refresh.
- A user moves from an older PC to a newer AI-capable PC.
- A device is reset after malware cleanup or performance problems.
- A business uses Windows Autopilot and wants first-run setup to be less disruptive.
The caution is that “settings backup” can be misunderstood. It is not the same thing as a complete file backup, and it is not a guarantee that every desktop program, printer, scanner, VPN, mapped drive, accounting tool, or browser extension will be restored. A business still needs a real backup strategy for files, cloud data, server data, databases, photos, QuickBooks files, and application-specific data.
What Can Go Wrong
Most issues here are policy and expectation issues, not emergency patch issues.
- Backup is enabled when the business expected it to stay off. If no explicit policy was set, eligible Windows 11 version 26H2 devices may follow Microsoft’s new default.
- Restore is expected but not configured. Microsoft says restore remains admin-controlled. If restore policies are not configured, a user may have backups available but not get the restore experience the business expected.
- Conditional Access blocks the restore flow. Microsoft’s documentation notes that Conditional Access can interfere with the restore experience in some environments unless the right Microsoft service is allowed.
- Group Policy and CSP policy sources conflict. Microsoft warns against mixing GPO and CSP policy settings for Windows Backup for Organizations because it can produce unexpected results.
- Users think this backs up everything. It does not. Important business files and app data still need normal backup coverage.
- Older builds miss required support. Microsoft’s restore and backup requirements depend on Windows version and build level, so stale devices may not behave the same way as fully updated devices.
What Business Customers Should Do Now
If you manage only a few PCs, the practical step is simple: decide whether Windows settings backup is something you want and make sure your actual file backups are still healthy. If you manage a fleet, treat this as a policy review before Windows 11 version 26H2 is broadly deployed.
- Inventory which devices are eligible. Check Windows version, build level, Entra join status, and whether devices are managed by Intune, Group Policy, or another MDM platform.
- Decide your backup policy intentionally. If you want Windows settings backup on, configure it. If you want it off, configure that explicitly rather than relying on the old default.
- Review restore separately. If you want users to restore settings during out-of-box setup or first sign-in, confirm the restore policies are enabled and tested.
- Check Conditional Access rules. If you use strict MFA, device compliance, or authentication strength policies, test a restore scenario before a real emergency.
- Do not confuse this with file backup. Confirm OneDrive, SharePoint, server backup, NAS backup, external backup, and line-of-business application backups are still working.
- Run a pilot before a broad rollout. Test with one or two representative users before assuming it will work smoothly for everyone.
How To Check The Setting
For individual Windows users, Microsoft says users can manage backup settings from Settings > Accounts > Windows backup, depending on whether IT policy allows those controls. Users may see options such as remembering preferences or remembering apps.
For managed business devices, Microsoft documents several admin paths, including Intune, Policy CSP, and Group Policy. In Intune, Microsoft’s documentation points to Settings catalog policy settings under Administrative Templates\Windows Components\Sync your settings. For Group Policy, the documented path is Computer Configuration\Administrative Templates\Windows Components\Sync your settings.
That said, policy work should be handled carefully. If a business already has Intune baselines, security baselines, device compliance rules, or older Group Policy objects, changing one setting without checking the surrounding management structure can create confusion.
Was There A New Mac Security Update Today?
I also checked Apple’s official Apple security releases page and Apple’s macOS support pages. At the time of this check on July 9, 2026, I did not find a same-day macOS security release, Rapid Security Response, or new macOS advisory posted for July 9, 2026. Apple’s security release page remains the official place to verify new macOS security advisories.
Bottom Line
This is not an emergency patch, but it is a meaningful Windows support change. If your business runs managed Windows PCs, especially with Microsoft 365, Entra ID, Intune, Group Policy, Windows Autopilot, or planned Windows 11 version 26H2 deployments, now is a good time to make the Windows settings backup policy explicit.
The safest approach is to avoid accidental defaults. Decide what your company wants, document it, test restore behavior, and keep normal file backups separate and verified.
When To Call The IT Guys
Call The IT Guys if you are replacing several PCs, preparing for Windows 11 version 26H2, unsure whether your devices are Entra joined, or not sure whether Intune and Group Policy are fighting each other. This is also a good time to review whether your business can restore files, settings, Microsoft 365 data, and line-of-business applications after a device failure.
We can help check your Windows backup policy, test a replacement-device workflow, review Conditional Access issues, confirm whether restore is enabled, and make sure this new Windows behavior supports your business instead of surprising it.