Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Cloud Backup for All
Transcript
- Lucas: If today's tech conversation gave you something usable, we're glad. And we deliberately don't run ads on these shows. If you want to support that choice, the link is buy me a coffee dot com slash fexingo. Luna: It's a small thing that keeps this ad-free and focused on what matters. Lucas: So, episode 100. We've done 99 episodes on Windows 11 quietly mandating various enterprise features — Wi-Fi 7, TPM 2.0, BitLocker, credential guard, you name it. But there's one mandate coming in the 2026 H2 update that I think is the biggest yet: cloud backup. Luna: Cloud backup? Isn't that something most enterprises already do? Lucas: Many do, but Microsoft is making it mandatory for Windows 11 Enterprise — and I mean mandatory in a way that's different from previous features. With TPM 2.0, you could disable it in BIOS if you really needed to. With BitLocker, you could configure it with on-premises key escrow. But cloud backup is being tied to the operating system's core identity and compliance framework. Luna: So IT admins can't just say no? Lucas: Not without breaking Microsoft's security baseline. Starting with the 2026 H2 feature update, Windows 11 Enterprise will require that every device is enrolled in Windows Backup — which, by default, backs up to OneDrive for Business and can also push to Azure Backup. The Group Policy settings are changing so that administrators cannot disable the backup service via traditional means. They can configure it, but they can't turn it off. Luna: That's aggressive. What's the rationale? Lucas: Microsoft's official line is data resilience — ransomware recovery, accidental deletion, device loss. And to be fair, they have a point. A lot of enterprises still rely on on-premises backup that doesn't sync to the cloud, and when a crypto-locker hits, they're stuck. But the timing is interesting because Microsoft is also retiring several legacy backup APIs in Windows 11. Luna: Which APIs? Lucas: The Windows Server Backup feature is being deprecated, and the Volume Shadow Copy Service — VSS — is being restricted for third-party backup tools. So if you're a Veeam or Commvault customer, your agent software may not be able to perform system-state backups after the 2026 H2 update without going through the Windows Backup API, which Microsoft controls. Luna: That sounds like a direct shot at third-party backup vendors. Lucas: It is. And the vendors are already pushing back. Veeam published a blog post last month urging customers to test their Windows 11 2026 H2 compatibility early. But the bigger question is cost. Microsoft is effectively forcing enterprises to adopt its cloud backup, which means per-seat licensing for OneDrive for Business or Azure Backup. For a company with 10,000 devices, that could add fifty to a hundred thousand dollars a year in new licensing costs. Luna: And that's on top of existing Microsoft 365 subscriptions. Lucas: Exactly. Microsoft 365 E3 already includes OneDrive for Business with 1 TB per user, but the backup mandate requires additional backup storage for system images and app data, which goes beyond the standard quota. So enterprises will need to either buy more storage or upgrade to Azure Backup, which has its own pricing model. Luna: What about companies that have strict data residency requirements? They might not want their backups in Microsoft's cloud. Lucas: That's a real concern. Microsoft does offer Azure regions for data residency, but the default is us based. IT admins can configure backup to a specific region via policy, but it requires careful planning. And if you're in a country with strict data sovereignty laws — like Germany or China — you may need to set up a dedicated Azure region, which adds complexity and cost. Luna: So the mandate is really about increasing adoption of Microsoft's cloud services, not just security. Lucas: That's my read. But let's look at the technical side for a moment. The new backup system is built on the same engine as Windows 11's 'Windows Backup' app, which first shipped in 2022. It backs up files, settings, credentials, and app list — but not full app data unless the app supports it. For enterprise, Microsoft is extending that to include system state, BitLocker recovery keys, and even Wi-Fi profiles. Luna: So if a device is lost or compromised, you can restore the entire configuration to a new device? Lucas: That's the idea. And it integrates with Autopilot, so a replacement device can be provisioned with the user's full profile and policies automatically. That's genuinely useful for IT. But the lock-in is that the restore only works if the new device is running Windows 11 and enrolled in the same tenant. Luna: What about hybrid environments where some devices are on-premises domain-joined and not Azure AD? Lucas: Microsoft is pushing all enterprises to Azure AD — now called Entra ID — and the backup mandate is another lever. Devices that are not enrolled in Entra ID will still need to be backed up, but the backup data won't be accessible from the cloud unless the device is properly registered. It's a classic Microsoft integration play: each new feature makes the standalone on-premises option a little less viable. Luna: I wonder how this affects smaller enterprises with limited IT staff. Lucas: That's a good point. A small business with 50 employees might not have a dedicated backup administrator. The mandate could actually help them — Windows Backup will just work out of the box, backing up to OneDrive automatically. But the cost and complexity of managing that at scale, especially with compliance requirements, could be a burden. Luna: So what should IT admins do right now? Lucas: First, audit your current backup solution and see if it's compatible with Windows 11 2026 H2. Contact your backup vendor and ask for their roadmap. Second, review your Microsoft licensing and estimate the additional backup storage costs. Third, test the new Windows Backup features in a pilot group — especially the restore process. And fourth, engage with Microsoft's enterprise support to clarify any data residency concerns. Luna: Any chance Microsoft backs down if there's enough pushback? Lucas: Historically, Microsoft has been willing to delay mandates but not cancel them. They delayed the TPM 2.0 requirement for Windows 11 by a year for enterprises. So we might see an extended timeline for non-cloud backup solutions. But the direction is clear: cloud backup is becoming a non-negotiable part of the Windows 11 enterprise experience. Luna: It's a big shift from the days when Windows Server Backup was a free feature you could install on any server. Lucas: Right. And it's emblematic of Microsoft's broader strategy: every enterprise feature is now a cloud service. That's good for Microsoft's recurring revenue, but it forces IT departments to rethink their infrastructure. For episode 100, I think this is the most consequential mandate we've covered. Luna: Agreed. It's not just a security feature — it's a business model change. Lucas: Exactly. And that's worth keeping an eye on as the 2026 H2 update approaches later this year.