Every snapshot Windows Recall takes is a photograph of your digital life, and photographs pile up fast.
Windows Recall is an AI-powered feature that periodically captures screenshots of user activity to build a searchable timeline of everything that happened on a device.
Without a ceiling on how much disk space these snapshots can consume, the local store grows silently, turning the device into an ever-expanding archive of sensitive on-screen content that an attacker could mine long after the original activity took place.
The SetMaximumStorageSpaceForRecallSnapshots setting lets administrators cap the amount of disk space Windows allocates for Recall snapshots, forcing older captures to be purged once the limit is reached.
Enforcing this cap through Microsoft Intune guarantees that every managed device, regardless of storage size or user behavior, follows the same retention boundary.
The result is an environment where Recall remains useful for productivity while the volume of sensitive on-device data available to an attacker stays predictable and bounded.
Why This Policy Matters
Attackers who gain local or remote access to an endpoint increasingly look for artifacts that reconstruct user activity, and a Recall snapshot store is exactly that kind of artifact.
An unbounded snapshot store extends the window of exposure well beyond the original session, since old captures simply accumulate instead of aging out.
Without this policy:
- Recall snapshots can consume unlimited disk space, degrading device performance over time
- Sensitive on-screen content from months earlier can still be sitting on disk when a device is compromised
- Storage allocation is decided inconsistently by device capacity or end users, with no organizational control
- Data retention obligations become harder to demonstrate during audits or incident response
With this setting enforced through Intune:
- Snapshot storage is capped at a known, organization-defined value across all managed devices
- Older snapshots are automatically purged once the limit is reached, shrinking the exposure window
- Storage behavior becomes predictable, supporting capacity planning and compliance reporting
- Recall remains available for legitimate productivity scenarios without becoming an unmanaged data hoard
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, settings such as this one can drift across devices, leaving blind spots that attackers can exploit.
Managing the Set maximum storage for snapshots used by Recall setting through Microsoft Intune brings several governance benefits:
- Centralized enforcement of the control across all managed Windows endpoints
- Consistent configuration aligned with corporate security baselines
- Clear visibility into deployment status and configuration compliance
- Defined ownership and accountability through scope tags and role-based administration
- An auditable policy lifecycle from creation to enforcement and validation
This level of governance ensures that the control is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the setting is exposed at the operating system level and how Microsoft Intune interacts with it. The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the WindowsAI area.
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User | ❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later |
This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall.
You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB.
When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity unless the current user specifies a different value.
25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
If both maximum storage duration and maximum storage space are set for Recall, then snapshots are deleted when the first maximum is reached.
This setting applies to Enterprise and Education client SKUs only.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework.
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed Values
This section defines the valid configuration values supported by the setting. It accepts the following options:
| Value | Description |
|---|---|
| 0 (Default) (Default) | Let the OS define the maximum storage amount based on hard drive storage size. |
| 10240 | 10GB. |
| 25600 | 25GB. |
| 51200 | 50GB. |
| 76800 | 75GB. |
| 102400 | 100GB. |
| 153600 | 150GB. |
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
| Name | Value |
|---|---|
| Name | SetMaximumStorageSpaceForRecallSnapshots |
| Friendly Name | Set maximum storage for snapshots used by Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetMaximumStorageSpaceForRecallSnapshots |
| ADMX File Name | WindowsCopilot.admx |
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
- The cap only applies once Recall itself is enabled on supported Copilot+ hardware; on devices without Recall, the setting has no effect
- When the storage limit is reached, Windows deletes the oldest snapshots first, so a very small cap can shorten the useful search window for end users
- The setting requires Windows 11, version 24H2 with KB5055627 or later, and only applies to Enterprise and Education SKUs
- Coordinate the storage cap with any data retention or eDiscovery requirements before rolling it out broadly
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Recall Snapshot Storage Limits Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that Recall snapshot storage never exceeds an approved limit across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshots.
Create the Configuration Profile
In the Microsoft Intune admin center:
- Navigate to Devices › Windows › Configuration
- Select + Create policy
In the Create a profile pane:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that caps the maximum disk space allowed for Recall snapshots.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
The Platform field is already pre-selected as Windows, so no changes are required. Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows setting you want to enforce. To open the Settings picker panel, click Add settings.
By default, this setting is not configured, meaning Windows decides the storage allocation automatically based on the device's total disk capacity.
In the search field at the top of the Settings picker, type Maximum Storage Space, and then click Search to filter the results.
From the returned results, select the category Windows AI, and then choose the setting Set Maximum Storage Space For Recall Snapshots. Once selected, the setting is automatically added to the configuration profile. Back on the configuration page, change the value from its default state to 51200 (50 GB).
When enabled, Windows caps the Recall snapshot store at 50 GB and purges the oldest captures once that ceiling is reached. This ensures that:
- Snapshot storage stays within a predictable, organization-approved boundary
- Old, potentially sensitive captures do not linger indefinitely on the local disk
- The exposure window created by Recall data is measurably reduced, even if a device is later compromised
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
- Restrict policy visibility to specific IT roles or teams
- Enforce administrative separation of duties
- Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Recall Storage Limits
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group: GRP – MS365Education – Test Computers.
Once the group is selected, verify the following:
- The group appears under Included groups
- The group status is Active
- No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
- Policy name and description: confirm that the policy clearly reflects its purpose, capping Recall snapshot storage to reduce on-device data exposure
- Configuration settings: verify that Set maximum storage for snapshots used by Recall is set to 51200 (50 GB), under Windows AI
- Scope tags: ensure the correct scope tag is assigned. In this example, the Default scope tag is used
- Assignments: confirm the policy is assigned to the intended group, GRP – MS365Education – Test Computers, and that no unintended exclusions are configured
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Recall Storage Limits configuration profile, the next step is to verify its deployment status. This validation confirms that the policy has been successfully applied and that Recall snapshot storage is now capped at 50 GB on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
- Triggering a manual device sync from the Company Portal
- Initiating a sync directly from the Microsoft Intune admin center
Intune provides clear indicators to evaluate the policy deployment status: Succeeded (devices have applied the policy), In progress (devices are still processing), Error (the policy failed and requires investigation), and Not applicable (the device does not support the configuration).
When devices report Succeeded, it confirms that the Recall snapshot store is now enforced at the 50 GB ceiling, ensuring that older captures are purged automatically and the local exposure surface stays bounded.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the policy was successfully applied. Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
- Open Event Viewer on the target device
- Navigate to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin
- Select Filter Current Log
- Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
- Open the event details and confirm that the WindowsAI setting was applied
For deeper validation, you can confirm the effective setting directly on the device. Open the Registry Editor and browse to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI, where the value SetMaximumStorageSpaceForRecallSnapshots should read 51200, confirming the 50 GB cap is in effect.
Remember that if a maximum storage duration policy is also configured for Recall, snapshots are deleted whichever limit, space or time, is reached first.
Why This Matters for Endpoint Security
AI-driven features that continuously capture on-screen activity represent a new category of risk in modern endpoint security, because they turn ordinary usage into a persistent, searchable record.
Without a storage boundary, that record grows unchecked, and a single compromised device can expose weeks or months of screen history to an attacker instead of just the current session.
By enforcing Set maximum storage for snapshots used by Recall through Microsoft Intune and validating the configuration locally, organizations ensure that:
- Recall snapshot data never grows beyond an approved, auditable limit
- The exposure window for sensitive on-screen content is measurably reduced
- Storage behavior is consistent across the entire managed Windows fleet
- AI productivity features can be adopted without becoming an unmanaged data liability
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
AI features that record user activity must be bounded by policy, not left to default behavior.
Enforcing the Recall storage cap through Microsoft Intune delivers that boundary consistently across every managed device, regardless of local disk size or user preference.
Combined with centralized deployment and client-side validation, the organization gains a documented, enforceable limit on how much sensitive on-screen history any single endpoint can retain.
And in modern security architecture, capping Recall snapshot storage is not optional, it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#setmaximumstoragespaceforrecallsnapshots
- https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🏆️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com
💬 Follow me for more Windows endpoint hardening and Intune content.