What Windows Recall Saves During Your Interview

Windows Recall takes periodic snapshots of your screen on Copilot+ PCs, stores them encrypted on the local disk, and makes them searchable. If you sit a remote interview or an online assessment on a Copilot+ PC with Recall enabled, the assessment itself becomes part of that local record: the problem statement, your editor, your browser tabs, and anything else that was on screen. Microsoft's documentation states the snapshots never leave the device and that IT administrators cannot view them. Some exam applications have nevertheless started detecting Recall and refusing to launch until it is turned off.

This article covers what Recall is documented to capture during an interview, who can reach that data, what it is documented to skip, and the specific decisions worth making before your next assessment. Facts below were checked against Microsoft's documentation on October 11, 2026.

Does Recall record your interview?

Only if three things are true at once: the machine is a Copilot+ PC, Recall is installed, and you consented to saving snapshots.

Microsoft's management documentation for Recall states that "Recall is an opt-in experience that requires end user consent to save snapshots," and that administrators "can't enable saving snapshots on behalf of their users." The end-user documentation is blunter: "By default, saving snapshots for Recall aren't enabled" (Microsoft Learn: Manage Recall for Windows clients; Microsoft Support: Retrace your steps with Recall).

The hardware bar is real. Microsoft lists a Copilot+ PC meeting the Secured-core standard, a 40 TOPS NPU, 16 GB of RAM, eight logical processors, and 256 GB of storage, with at least 50 GB free to enable snapshots. Saving "automatically pauses once the device has less than 25 GB of storage space." A 2021 ThinkPad cannot run Recall. A 2026 Snapdragon or Lunar Lake laptop can.

If all three conditions hold, assume the interview was snapshotted. Recall captures the screen, not the meeting: Microsoft states it "doesn't record audio or save continuous video."

Who can read the snapshots

This is where Recall differs sharply from proctoring software, and where the usual candidate anxiety is misplaced.

Microsoft states that "snapshots are locally stored and locally analyzed on your PC," that "no internet or cloud connections are required or used to save and analyze snapshots," and that "snapshots aren't sent to Microsoft." The same page states that Recall "doesn't share snapshots with other users that are signed into Windows on the same device and IT admins can't access or view the snapshots on end-user devices. Microsoft can't access or view the snapshots."

Access is gated on biometrics. Microsoft requires that "at least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall," with snapshot and vector-database encryption keys protected by the TPM and usable only inside a Virtualization-based Security enclave.

There is one documented path off the device: "Filing feedback will send data from Recall to Microsoft, including any screenshots that a user attaches to the feedback." Do not attach Recall screenshots to a Feedback Hub report after an assessment.

The practical reading: Recall is not a channel through which an interviewer or an assessment vendor obtains your screen. It is a local archive on your own machine that someone with your device and your face or fingerprint could search. That is a different threat model from what the assessment platform itself records, and it deserves a different response.

What Recall is documented not to save

Four exclusions matter during an interview, and each has a caveat.

Sensitive information filtering. Enabled by default, it withholds snapshots "when potentially sensitive information is detected," such as passwords and credit card numbers, using the NPU and the Microsoft Classification Engine. Microsoft also notes that "the sensitive information remains on the device at all times, regardless of whether the Sensitive information filtering setting is enabled or disabled." It is a filter on snapshots, not a protection on the underlying data.

Private browsing. Microsoft states that Edge, Firefox, Opera, and Chrome filter private browsing activity, and that other Chromium-based browsers at version 124 or later filter private browsing only, not specific websites. Microsoft's developer guidance explains the mechanism: a browser signals private mode by calling SetInputScope on its window with IS_PRIVATE (Microsoft Learn: Recall guidance for developers of web browsers).

Filtered websites and apps. You can exclude both under Settings > Privacy & security > Recall & snapshots. The limitation is stated plainly and is the single most important line for anyone relying on this: "Parts of filtered websites can still appear in snapshots such as embedded content, the browser's history, or an opened tab that isn't in the foreground." Filtering the assessment domain does not reliably keep the assessment out of your snapshots.

DRM-protected and capture-excluded windows. Microsoft states that "like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content." Windows exposes the underlying window-level mechanism as SetWindowDisplayAffinity with WDA_EXCLUDEFROMCAPTURE, available since Windows 10 version 2004, which makes a top-level window absent from capture rather than merely blank. Microsoft's own API documentation cautions that it "works only when the Desktop Window Manager (DWM) is composing the desktop" and that "there is no guarantee that using SetWindowDisplayAffinity ... will strictly protect windowed content" (Microsoft Learn: SetWindowDisplayAffinity). Whether any given app's overlay is absent from Recall snapshots specifically is a question about that app, not about Windows.

Remote desktop clients are filtered by default, and the list is specific: mstsc.exe, VMConnect.exe, the Azure Virtual Desktop MSI client, and RAIL. Microsoft adds that "clients without screen capture protection may still be saved." If you are considering a remote session for an assessment, the Recall behavior is a footnote next to whether the assessment can tell you are on a remote desktop.

Some exam software now blocks Recall outright

This is the part that turns Recall from a privacy question into a logistics problem.

Examplify, the exam application from ExamSoft, detects Recall and halts. The National University of Singapore's student documentation, updated 5 June 2026, reproduces the dialog: a "Recall Alert" reading "Examplify has detected that Microsoft Recall is active on your device. Please disable the feature to continue." The same page warns that the obvious fix is not always sufficient — "in some cases, Settings > Privacy & Security > Recall & Snapshots and disabling them, does not work" — and instructs students to remove Recall entirely through "Turn Windows features on or off," then restart (NUS Digital Assessment: Recall is preventing me from starting the exam).

That is an academic exam app rather than a technical hiring platform, and we found no equivalent published behavior from HackerRank, CodeSignal, or Codility as of October 2026. Treat it as a demonstration of direction rather than a claim about your coding assessment. The relevant inference is narrow and useful: assessment software is capable of detecting an OS-level screen-history feature and conditioning launch on it, and that check fires at the worst possible moment — after you enter the exam password.

If your assessment runs in a lockdown client on a Copilot+ PC, do the disable step the day before, not five minutes before.

On a managed work laptop, this is a different question

Microsoft states that "by default, Recall is disabled and removed on managed devices," which it defines as Enterprise or Education SKUs, or premium SKUs managed by IT, volume-licensed, or domain-joined. So on a typical corporate laptop Recall is usually absent rather than quietly watching.

What administrators can do is bounded and worth knowing. They can make the component available or remove it, delete saved snapshots, cap storage between 10 and 150 GB, cap retention at 30 to 180 days, push app and URI deny lists, and set a Data Loss Prevention provider — Microsoft Purview is currently the only supported one — which removes sensitive windows from snapshots. Export of Recall data is EEA-only and disabled by default. None of these give an administrator a view of your snapshots, but the deny-list and DLP policies mean IT can observe policy-level configuration. The broader exposure on a work machine has little to do with Recall and much to do with what your employer's device management can already see.

What to actually do before an assessment

• Check whether Recall exists on the machine. Settings > Privacy & security > Recall & snapshots. If the page is absent, so is the feature.
• Pause rather than uninstall for a one-off. The Recall tray icon offers "Pause until tomorrow," which resumes at 12:00 AM. That covers a single interview without reconfiguring the machine.
• Disable, or remove the Windows feature, if a lockdown client is involved. Based on the Examplify case, a Settings toggle may not satisfy every detector. Do it with time to restart.
• Delete after the fact if the content was confidential. Recall supports deleting an individual snapshot or every snapshot for a given app or website.
• Do not rely on website filtering to exclude the assessment. Microsoft's own caveat about embedded content, history, and background tabs makes it unreliable for this purpose.

The same audit instinct applies on the other platform: if you interview on a Mac, the permissions an interview app can hold on macOS are the equivalent thing to check.

Where Control sits in this

Control is a desktop AI interview assistant for Windows and macOS. Its site states that the overlay "stays out of supported screen captures," with that behavior tested against Zoom 6.16 and earlier and browser-based screen recording as of September 2026, and its FAQ states that proctoring tools using their own capture driver or a locked-down browser are outside that tested scope.

Recall is not in that tested scope either, and Control's published material does not document Recall behavior. We are not going to assert an outcome we cannot cite. If you run a Copilot+ PC with snapshots enabled, verify on your own machine what appears in Recall before you depend on any assumption — which is the same advice that applies to testing an interview assistant before the interview rather than during it.

The short version

Recall does not hand your screen to an interviewer. It builds a local, encrypted, biometrically gated record of your own screen that includes the assessment, with documented exclusions that are narrower than they first appear — particularly website filtering. The near-term practical risk is not surveillance but a blocked launch: at least one exam application already refuses to start while Recall is active, and that check happens after you have committed to the exam. Find out which state your machine is in before the invitation arrives, not after.