Windows Recall Security: Decide Whether to Allow Recall on Copilot+ PCs

Recall saves searchable snapshots of a user's screen on Copilot+ PCs, so any organisation that allows it creates a new local store holding whatever its people looked at, from customer records to HR cases. Microsoft designed Recall to be off on managed devices until an administrator allows it, and to encrypt snapshots inside a virtualisation-based security (VBS) enclave unlocked by Windows Hello. This guide helps security, privacy and endpoint leads decide whether to allow Recall, for whom, and with which filters, retention and monitoring, and covers the data protection questions a privacy officer will ask. The wider set of Windows AI features (Click to Do, agent workspace, MCP on Windows) is covered in the Windows AI Features Security guide; this page goes deeper on Recall alone.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Managed devices start with Recall removed. Microsoft Learn states Recall is disabled and removed on managed devices until the "Allow Recall to be enabled" policy (AllowRecallEnablement) is turned on; unmanaged Copilot+ PCs offer it to users by default.
• Administrators allow, users opt in. An administrator cannot start snapshot saving for a user; each user decides, and can turn it off at any time.
• The enclave protects data at rest and from other users, not from the signed-in user's own session. Anyone who passes the user's Windows Hello check can search everything that user saw, so phishing-resistant sign-in and session hygiene still matter.
• Filters and retention are Enterprise and Education controls. App and URI deny lists, storage caps and retention days are listed for those editions only, which shapes the decision for Pro fleets.
• Treat allowing Recall as a privacy decision as well as a security one. Under GDPR it is processing of personal data on work devices; run a DPIA, document the lawful basis and set retention before any pilot.

How identity and access work in Windows Recall

Recall's protection model is built around the user's Windows Hello identity and hardware isolation. Microsoft's Windows Experience Blog post of 27 September 2024 and the Manage Recall page describe it as follows.

See the Windows Hello for Business Guide, the Credential Guard and VBS guide and the BitLocker guide for the platform controls Recall relies on.

Admin roles and privileged access

Recall policies live under Computer Configuration (or User Configuration) > Administrative Templates > Windows Components > Windows AI, and in the Policy CSP at ./Device/Vendor/MSFT/Policy/Config/WindowsAI/. Whoever can edit those policies in Intune or Group Policy decides whether Recall exists on the fleet.

• Separate the decision from the setting: the policy owner in Intune or Group Policy should apply a decision approved by security and the data protection officer, not make it. Restrict the Intune roles and Group Policy Objects that carry WindowsAI settings, and alert on changes to AllowRecallEnablement.
• Local administrators: can add the Recall optional feature (Enable-WindowsOptionalFeature -Online -FeatureName "Recall") in environments where the package is not deployed automatically. Removing standing local admin rights keeps the policy decision intact.
• What administrators cannot do: Microsoft states IT admins and other signed-in users cannot view a user's snapshots, and cannot start exports for other users. Recall is not an employee monitoring tool, and should not be described to staff as one.

Integrations, API tokens and service accounts

• Data loss prevention: the "Set Data Loss Prevention Provider" policy (SetDataLossPreventionProvider) lets an endpoint DLP agent tell Recall which windows hold sensitive content; Recall then drops only those windows from a snapshot. Microsoft Learn lists Microsoft Purview endpoint DLP as the supported provider as of November 2026 and describes a public provider API for others. Removing the policy stops future checks but does not change snapshots already saved. See the Endpoint DLP Guide.
• Sensitivity labels: applications can pass labels to Recall through the UserActivity.ContentInfo API.
• Your own applications: developers can keep a window out of all screen capture, including Recall, with SetWindowDisplayAffinity and WDA_EXCLUDEFROMCAPTURE. Ask internal teams that build password vaults, admin consoles or case management tools to use it.
• Remote and virtual desktops: Remote Desktop Connection (mstsc.exe), VMConnect, Azure Virtual Desktop and RemoteApp sessions are filtered by default unless the client implements screen capture protection. Confirm your virtual desktop clients honour screen capture protection policies.
• Export (EEA only): "Allow export of Recall and snapshot information" (AllowRecallExport) is disabled by default. When allowed, a user can export past or ongoing snapshots, protected by Windows Hello and an export code that grants third-party apps access. An export code is effectively a credential to that user's history; keep export off unless a documented need exists.

Logging and detection

• Configuration state: report the applied WindowsAI policies per device from Intune configuration reports or Group Policy results, and alert when a device in a no-Recall group shows the Recall feature installed.
• Feature presence: inventory the Recall optional feature state on Copilot+ PCs so you can see installs that bypassed policy.
• Threat behaviour: an attacker in a user's session aims at the richest local data. Map Recall to MITRE ATT&CK T1113 Screen Capture and T1005 Data from Local System, and alert through EDR on unexpected processes accessing Recall storage or prompting repeated Windows Hello requests.
• Identity signals: because Hello ESS gates access, watch for new Hello enrolments, biometric resets and PIN fallbacks on Recall-enabled devices.

Metrics: percentage of Copilot+ PCs whose Recall state matches the approved decision; number of Recall-enabled users against the approved pilot list; percentage of Recall-enabled devices with deny lists, retention and the DLP provider applied; count of WindowsAI policy changes per month with change tickets; export policy enabled count (target zero unless approved).

Hardening baseline

Start from a decision, then apply the matching profile. All values below are from Microsoft Learn's Manage Recall page, checked 8 November 2026.

Deny list and export changes take effect after a restart. Built-in filtering adds to these: sensitive information filtering is on by default and uses the Microsoft Classification Engine; private browsing is filtered in supported browsers; DRM content is not stored; Recall saves no audio or continuous video. URI filtering applies to the foreground tab only, so background tabs and embedded content can still appear: rely on app deny lists for the most sensitive systems.

Deciding whether to allow Recall

Rollout:

1. Set AllowRecallEnablement to Disabled explicitly for every device group, so the decision does not depend on defaults.
2. Complete the DPIA and staff notice for the pilot group; agree retention and deny lists with the data protection officer.
3. Enable Recall for a small pilot group on Enterprise devices with deny lists, 30-day retention, storage caps and the DLP provider set.
4. Test: confirm denied apps and sites never appear, DLP-flagged windows are dropped, and Hello ESS is enforced.
5. Test rollback: set AllowRecallEnablement to Disabled on a test device and confirm the component is removed and snapshots deleted after restart. Users can also remove the bits with Disable-WindowsOptionalFeature -Online -FeatureName "Recall" -Remove.
6. Review after 60 to 90 days with usage, incidents and privacy feedback before widening.

The legal view

Recall processes personal data of the user and of anyone whose details appear on screen: customers, colleagues, patients. Where GDPR or UK GDPR applies, allowing it on corporate devices is a processing decision by the employer as controller, even though the data stays on the device and administrators cannot view it.

• DPIA: Article 35(1) requires a data protection impact assessment where processing using new technologies is likely to result in a high risk. Large-scale capture of screen content on work devices is a strong candidate; document it. See the DPIA Guide.
• Data protection by design and default: Article 25 supports keeping Recall off by default, using deny lists and short retention, and allowing it only where there is a defined purpose. See the Data Minimisation guide.
• Transparency to staff and third parties: explain to employees what Recall captures and that it is their choice, and consider customers whose data appears on screen. See the Employee Monitoring and Privacy Guide.
• Data subject requests and legal holds: snapshots sit in an encrypted per-user store that the organisation cannot read. Decide in advance how access requests, litigation holds and investigations will treat Recall data, and record that position in the DPIA.

This section summarises data protection considerations and is not legal advice.

Common misconfigurations

• Relying on defaults: leaving AllowRecallEnablement unset works today on managed devices, but an explicit Disabled setting documents the decision and survives changes in how devices are classed as managed.
• Allowing Recall on Pro devices and expecting filters: deny lists, retention and storage caps are listed for Enterprise and Education only.
• Treating URI filtering as complete: filtering covers the foreground tab in supported browsers; use app deny lists for critical systems.
• Allowing privileged users: snapshots of admin consoles and secrets create a high-value local target (T1113, T1005).
• Turning on export without a need: the export code grants third-party access to a user's history.
• Skipping the privacy work: piloting before a DPIA and staff notice leaves the organisation unable to explain the processing if challenged.

Practitioner checklist

• Inventory Copilot+ PCs and their Windows editions.
• Record an approved Recall decision per user population, signed off by security and the data protection officer.
• Set AllowRecallEnablement explicitly for every device group.
• Complete a DPIA and staff notice before any pilot.
• Apply app and URI deny lists, 30-day retention, a storage cap and the DLP provider where Recall is allowed.
• Keep AllowRecallExport disabled unless a documented need exists.
• Exclude privileged users and privileged access workstations.
• Ask internal developers to use WDA_EXCLUDEFROMCAPTURE on sensitive windows.
• Alert on WindowsAI policy changes and on Recall installed where it is not approved.
• Test and document rollback, including snapshot deletion after restart.

Standards and references

• Microsoft Learn: Manage Recall for Windows clients
• Microsoft Windows Experience Blog: Update on Recall security and privacy architecture
• EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
• ICO: Employment practices and data protection, monitoring workers
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: T1113 Screen Capture

Related NHI Mgmt Group resources: Windows AI Features Security · On-Device AI Security Guide · Endpoint DLP Guide · AI and GDPR Guide · Microsoft Intune Guide