Windows Recall stays off by default on managed enterprise devices

Windows Recall has been generally available on Copilot+ PCs since late April 2025. I can't think of another recent feature that has caused this much excitement and this much worry in enterprise environments at the same time. The concept is bold and controversial in equal measure: a local, AI-powered timeline that captures snapshots of your desktop every few seconds so users can search their activity history almost instantly. So it's no surprise that Windows Recall in the enterprise has come up in nearly every customer tenant review I've done over the past few weeks. The conversation usually opens with: "Is this even enabled in our organisation, and should we touch it yet?"

Recall is off by default on managed devices and is even removed

The most important thing to know is that Microsoft has taken a cautious route for managed commercial devices. Recall isn't merely inactive by default. It's actually removed from managed Copilot+ PCs. Any device enrolled via Intune or another MDM that runs Windows 11 24H2 (or newer) on Copilot+ hardware keeps Recall hidden unless an admin explicitly enables it. You control this centrally with the Allow Recall to be enabled policy, which you'll find in the Policy CSP – WindowsAI and in the Intune settings catalog. If you don't deliberately allow it, users won't see Recall at all.

And even where policy permits Recall, it remains a user opt-in. Once you enable the setting, users still have to switch Recall on themselves in the UI. That extra step helps a lot when works councils or privacy teams haven't resolved all their concerns yet. In every tenant I've reviewed so far, Recall is either left off in production or, at most, piloted with a small number of hand-picked users.

Recall stores encrypted snapshots only on the local device

I get a lot of questions about what's happening under the hood. Snapshots are taken every few seconds and stored only on the device itself. Two technologies handle encryption: Windows Hello Enhanced Sign-in Security (EISS) and VBS enclaves. Users can only view their Recall timeline after authenticating with biometrics or a PIN, never with just a password. Snapshots don't sync to the cloud or to other users, and other applications or background processes can't access them directly.

Admins, or users themselves, can configure filters to keep specific apps, websites or sensitive content out of the captures. Retention and storage limits also apply, so once disk space runs short, older snapshots get deleted automatically. Microsoft gives guidance on blocking sensitive sites across the board (banking, password managers), but no technology is perfect. A misconfiguration can still lead to confidential data being recorded without anyone intending it.

This diagram shows how the main components and policies fit together for Windows Recall in the enterprise:

flowchart TD
  User["User"] --> OptIn["Recall opt-in"]
  AdminPolicy["Intune policy: Allow Recall"] --> Device["Copilot+ PC"]
  OptIn --> RecallApp["Recall app"]
  RecallApp --> Snapshots["Snapshot storage (local)"]
  Snapshots --> Encrypt["EISS & VBS encryption"]
  RecallApp --> Filter["Filter/blacklist"]
  AdminPolicy --> Filter

Figure: Policy, user opt-in and local Recall storage on managed enterprise PCs.

Privacy teams and works councils should set the pace for Recall

I haven't seen any other recent Windows feature pull in privacy and works council reviews this early in its rollout. Most enterprise tenants I work with follow the same line: Recall stays off until IT, privacy and the works council have worked through the security, retention and exclusion controls together. Local encryption and user authentication are a reasonable foundation, but privacy teams raise fair follow-up questions. What happens if a device is lost or compromised? Can sensitive corporate data still land in the timeline despite filtering? How do you enforce forensically secure deletion? A production rollout only makes sense after a proper risk assessment and with clear policies in place.

Practical tip: For a safe Recall pilot, set up a dedicated Intune group with a few volunteers, enable the policy explicitly for them, and stay in close contact with your privacy and compliance colleagues. Write down the technical settings (filters, storage limits) and collect feedback before you plan anything broader. You'll catch problems early and save yourself a compliance fight later on.

For the official details, see Microsoft's Recall overview and the Policy CSP documentation.

I recommend waiting before you open the gates to Recall

If you're evaluating Windows Recall for your organisation, my advice is to leave Recall off until your privacy, compliance and works council teams have approved it for your specific environment. If you want to pilot it, use the Intune settings catalog to target a test group (set "Allow Recall to be enabled" to Enabled). Keep in mind that Recall only exists on eligible Copilot+ hardware running Windows 11 24H2 or newer. In my experience, a slow rollout with transparent governance earns a lot of trust and heads off unpleasant surprises.

If you're interested in Windows recovery features more broadly, have a look at my post on the Windows Resiliency Initiative and Quick Machine Recovery, where I cover Microsoft's new push for device resiliency beyond Recall.

Recall is fascinating technology, but in an enterprise it only works when governance and privacy are aligned. Until they are, keeping Recall off isn't just the careful choice. It's the only position you can really defend.