When a PC is replaced or reset, users lose the Windows preferences they've built up and spend their first hours putting them back. Windows Backup for Organizations backs up Windows settings and the list of Microsoft Store apps under the user's work account, then offers them back during setup on their next Microsoft Entra joined device. In this post I'll check the requirements, configure backup and restore in Intune, and cover why the restore page sometimes doesn't appear.
Status (October 2026): Microsoft Learn documents Windows Backup for Organizations as a standard Intune feature, without a preview label. It isn't available in government clouds or 21Vianet, and restore works only with some provisioning methods (listed below). Re-check the Learn page before a rollout, as requirements can change.
How it works and what you need#
There are two halves. Backup is a settings catalog policy that lets Windows back up the user's settings to the cloud. Restore is a tenant-wide enrollment setting that shows a restore page during the out-of-box experience (OOBE) when the same user sets up a new or reset device. Files aren't included (that's OneDrive's job), and Win32 and line-of-business apps still arrive through your Intune assignments.
| Requirement | Backup (old device) | Restore (new device) |
|---|---|---|
| Join type | Microsoft Entra joined or hybrid joined | Microsoft Entra joined only |
| Windows | Windows 10 22H2, or Windows 11 22H2, 23H2 or 24H2, with the August 2025 update or later (Windows 11 builds 22621.5768, 22631.5768, 26100.4946) | Windows 11 22H2, 23H2 or 24H2 at builds 22621.3958, 22631.3958 or 26100.1301 or later, or the August 2025 cumulative update |
| Intune | Settings catalog policy assigned | Tenant restore setting turned on by an Intune Service Administrator |
| Other | A user-assigned device; shared and userless devices aren't supported | The user has at least one backup; Autopilot profiles use user-driven mode |
Windows 10 reached end of support on 14 October 2025. Windows 10 22H2 devices can still back up, which helps when you move users to Windows 11, but Microsoft doesn't guarantee features on that version.
Step 1: Turn on backup#
- In the Microsoft Intune admin center, go to Devices › Manage devices › Configuration › Create › New policy.
- Choose Windows 10 and later and Settings catalog.
- In the settings picker, open the Sync your settings category, add Enable Windows backup and enable it.
- Assign the policy to a pilot group first, then widen it.
Turn backup on well before a hardware refresh or Windows 11 migration: restore can only offer what has already been backed up.
Step 2: Turn on the restore page#
- Sign in with an account that holds the Intune Service Administrator role.
- Go to Devices › Enrollment, stay on the Windows tab and open Windows Backup and Restore.
- Set Show restore page to On and select Save.
You can't target this setting at groups: it's on or off for every Windows device in the tenant, and the default, Not configured, means off. It only matters during enrollment, so devices that are already enrolled see no change.
Step 3: Line up your provisioning path#
The restore page appears during OOBE after the user signs in with their work account, so it fits user-driven Microsoft Entra join, including Windows Autopilot in user-driven mode. Microsoft lists these as unsupported for restore:
- Microsoft Entra hybrid join and workplace join
- Autopilot self-deploying mode, the technician flow of pre-provisioning, and Autopilot reset
- Manual enrollment from the Settings app, enrollment through Group Policy, and co-management enrollment through Configuration Manager
Also configure Install Windows quality updates in your enrollment status page profile. If your devices or images are on a build older than July 2025, Microsoft asks you to make sure it's enabled. It adds time to setup, so check your timeouts (see Enrollment Status Page timing out during Autopilot).
What the user sees#
On a new or reset device, the user starts OOBE, signs in with their work account and completes MFA if prompted. The restore page then shows the backups available to them; they pick one or set the device up as new. Their Windows settings and Store app list come back, while Intune keeps delivering policies and apps as usual.
Verify#
Intune reports restore per device. Go to Devices › Windows, select the device, open Enrollment and find the Windows Backup and Restore profile row:
| Status | What to check |
|---|---|
| Succeeded | Restore ran; nothing to do |
| Setup as New PC Selected | The user skipped restore; a communication point, not a fault |
| No Backup Profiles | No backup existed: check the backup policy and Windows build on the old device, and that the user signed in with the same account |
| No policy assigned | Confirm the tenant restore setting is On and the backup policy is assigned |
| Not Applicable | Compare the join type, provisioning method and build with the requirements |
| Failed | Reproduce with a test account and collect the MDM diagnostic logs for a support case |
Before you reset or retire an old device, confirm the backup policy reports Succeeded for it in the policy's device status.
Tips & gotchas#
- Restore page never appears: the usual reasons are a hybrid joined or pre-provisioned device, self-deploying mode, a build below the restore minimum, or the tenant setting still at Not configured.
- Testing in Hyper-V: Microsoft lists a known issue where accounts with phishing-resistant MFA are asked for a security key or smart card that can't pass through to the virtual machine, so sign-in can't finish. Test on physical hardware.
- Unsupported editions: Windows 11 SE, Windows 10 Holographic, Windows 10 IoT Core and Windows 10 Team aren't supported.
- Tell the service desk first. The switch affects every eligible enrollment in the tenant, so users will meet a new page during setup.
- Cover files too. Pair this with OneDrive Known Folder Move so Desktop, Documents and Pictures follow the user.
- Autopilot profile: for building a user-driven profile, see Windows Autopilot from scratch.
