Intune backup: run a backup
Run an Intune backup with TenuVault: back up 41 Microsoft Intune object types with assignments, encrypted on your device or in your own Azure storage account.
An Intune backup is a complete, point-in-time copy of your Microsoft Intune configuration: policies, scripts, enrollment and tenant settings, saved with their assignments so they can be restored later. Intune itself has no native backup or recycle bin for policies, which is why TenuVault saves the configuration through Microsoft Graph. This page shows how to start a backup, choose what it covers, follow it while it runs and read the result. For the product overview, see Intune backup with TenuVault.
How a backup works
Section titled “How a backup works”TenuVault reads your Intune configuration through Microsoft Graph (beta) with your own delegated sign-in. It saves every object as its own file, together with its assignments, in a new backup folder named after the start time in UTC, for example backup-2026-09-28-020000. When all objects are read, it writes a summary with the item counts, the result and a fingerprint of every item, which later lets TenuVault compare backups.
Backups go to the storage you chose for the tenant: encrypted on this device, or in your own Azure storage account, which every admin with access shares. See Backup storage and retention.
For the full list of object types, see What gets backed up.
For original Win32 installer files you already have, use free App Backup. Its encrypted installer store is separate from policy backup storage and remains accessible while signed out.
Before you start
Section titled “Before you start”- You are signed in to the tenant. See Sign in to your tenant.
- Your license covers the tenant. A tenant that is not licensed is not backed up.
- The tenant has a storage location. If not, TenuVault asks you to “Choose where backups for this tenant are stored in Settings first.”
- For backups to your Azure storage account: the tenant is on Pro or MSP, and your account has the Storage Blob Data Contributor role on the storage account. No recovery key is needed. See Encryption and recovery key.
Start a backup
Section titled “Start a backup”- Select the tenant in the tenant switcher.
- Open Backup & Restore in the sidebar.
- Click Run Backup. The Back up dialog opens with the tenant’s saved backup choice selected.
- Keep the choice or change it (see Choose what to back up).
- Click Start backup.
The Backup Progress dialog opens. See Follow a running backup.
You can also start a backup from other places:
| Where | Button | What happens |
|---|---|---|
| Dashboard | Run Backup | Opens Backup & Restore |
| All tenants | Back up now on a tenant card | Opens the Back up dialog; progress appears in the lower right corner |
| Tenants | Backup Now on a card, or the backup button in the list view | Opens the Back up dialog, then Backup Progress |
| Tenants | Backup Selected (MSP) | Backs up every selected tenant with its saved choice, after you confirm |
| Menu bar icon on macOS or tray icon on Windows | Back up all tenants now | Backs up every connected tenant with its saved choice. See Schedule backups. |
TenuVault runs one backup per tenant at a time. If you start a backup while one is already running for the same tenant, you follow the running one. Each backup also claims its folder before writing any policy, so a backup from another computer or an automation run that starts in the same second cannot write into the same folder. The second backup fails without writing anything, and its error names the folder that was already in use.
Choose what to back up
Section titled “Choose what to back up”The Back up dialog offers three choices:
| Choice | What it covers |
|---|---|
| Everything except apps | “Policies, scripts, updates, enrollment and tenant settings.” Every type except apps. App categories, policy sets, app configuration and app protection policies are still included. |
| Everything | “Also app details and assignments. Installer files are never included.” All 41 types. |
| Custom | “Choose areas and individual types.” |
With Custom, TenuVault lists the areas (for example Device configuration or Enrollment). Tick an area to include all of its types, or expand it to tick individual types. When the tenant has an earlier backup, each area and type shows how many items it held last time, and the dialog estimates the total number of items.
The line under the choices shows how many of the 41 types the backup covers. Start backup is unavailable until at least one type is ticked (“Choose at least one type.”).
When apps are included, a note explains that apps are saved as their Intune details and assignments, which makes them the slowest type to back up, and that installer files are never downloaded.
The saved backup choice
Section titled “The saved backup choice”Each tenant has a saved backup choice. Automatic backups, Back up all tenants now and Backup Selected use it, and the Back up dialog starts from it.
- A tenant without a saved choice uses Everything except apps. The Schedule tab shows it as “(default)”.
- To change the saved choice from the Back up dialog, pick a different choice and tick Also use this for automatic backups of the tenant before you start.
- To change it without running a backup, open Backup & Restore, then the Schedule tab, and edit What to back up. See Schedule backups.
A backup that leaves out types never ages out the only copy of those types. See Retention.
Follow a running backup
Section titled “Follow a running backup”The Backup Progress dialog shows:
- a progress bar with the current step, for example “Reading Intune configuration…” or “Backing up” a type, and the result when the backup ends
- Policies saved (Saved so far while it runs), Types backed up and Duration
- Needs attention, when a type could not be read or was left out, or some objects could not be saved
- each type that was backed up, with its count, and the types that had nothing to back up
- the error, if the backup fails
- Show raw log, which opens the technical log with Copy log and the job ID
Click Run in Background, or close the dialog, to keep working. The backup continues and a panel in the lower right corner of the window shows its progress. Expand the panel for a short summary, the first types saved and Show raw log, or dismiss it with the close button. The panel shows Backup in progress, the result such as Backup completed successfully or Backup completed with 2 warnings, or Backup failed.
The backup log
Section titled “The backup log”The log lists what TenuVault did, with a time stamp per line. Typical lines:
| Log line | Meaning |
|---|---|
| “Leaving out N of 41 types: …” | The backup choice excludes these types |
| “Found N … (N built-in skipped).” | Items found for a type. Built-in objects Intune recreates itself are skipped. |
| “Backed up N …” | All items of a type are saved |
| “Skipped …: access was denied. The app registration may lack the permission or admin consent, or your Intune role may not allow it.” | Microsoft Graph refused access to this type: a permission or its admin consent is missing, or your Intune role does not cover it. The backup continues without it. |
| “Could not read …: …” | A whole type could not be listed. The backup completes with warnings. |
| “Could not back up “name”: …” | One item could not be read. The backup completes with warnings. |
| “Removed N backups older than N days.” | Retention removed old backups |
| “Older backups were kept because this backup is incomplete.” | Retention was skipped because of warnings |
| “Backup completed: N policies in …” | The final count and duration |
If Microsoft Graph throttles requests, TenuVault pauses and retries automatically. If your sign-in expires during a backup, the backup stops instead of reporting every remaining item as a warning. Sign in again and run a new backup.
Read the result
Section titled “Read the result”A backup ends with one of these results:
| Result | Meaning |
|---|---|
| Complete | Every item of every included type was saved |
| Completed with warnings | Some items or types could not be read. The rest was saved. The log and Backup Details list what is missing. |
| Failed | No item could be saved, or the backup stopped after it started saving, for example because the sign-in expired, Microsoft Graph stopped responding or the 30 minute deadline passed. It holds only the policies it saved and is never used as a complete backup. The timeline shows how it started, and retention removes it like any other backup once it is older than the retention period. |
| Cancelled | You cancelled the backup after it started saving. It is shown in a neutral tone, because you stopped it on purpose. Like a failed backup, it holds only the policies it saved, is never used as a complete backup, and retention removes it once it is older than the retention period. On the Dashboard it counts in the backups in storage, but not as successful or failed and not in Success Rate, and it does not change Tenant Health. Backups cancelled with an earlier version, which recorded them as failed, are shown as cancelled too. |
| Incomplete | The backup stopped and could not record its result, for example because TenuVault was closed or the storage could not be reached. It holds only part of the tenant. |
| Status unknown | The backup’s summary could not be read, so whether it finished is not known. Backup Details shows why, for example “This backup was encrypted by an earlier TenuVault version. Import the recovery key of the device that made it to open it.” for an older encrypted Azure backup, or a damaged file on this device. Import that recovery key, or select Refresh when the storage did not answer. Drift detection does not offer it until its summary can be read. |
| Running | The backup has not written its summary yet. A backup without a summary is shown as running while TenuVault runs it, or for six hours after it started, because another device may be running it or TenuVault restarted during it; after that it is shown as incomplete. On the Dashboard, one whose run failed counts as failed. |
When the tenant’s Azure storage account holds older backups that an earlier TenuVault version encrypted and no recovery key on this device opens, the backup timeline shows a notice, for example “2 older Azure backups need a recovery key”, with Import recovery key. The notice is only advice: new backups and the other backups keep working, and a backup that cannot be read is never deleted. In a storage account several tenants share, such backups may belong to another tenant. See Older encrypted Azure backups.
The Backup Progress dialog shows Failed with the error for every backup that failed, including the ones the timeline later lists as incomplete. A backup you cancelled shows Cancelled with a grey icon instead.
In a storage account that several tenants share, each backup records the tenant it belongs to. When that record could not be read, for example because the storage did not answer, the backup is left out of the list and the Dashboard, because it may be another tenant’s. Backup History and the Dashboard then show “N backups could not be read. Select Refresh to try again.” Once the record can be read, the backup is listed again, or left out if it belongs to another tenant.
The dashboard refreshes backup summaries every 30 seconds. It reuses unchanged summary metadata and reads one container inventory, including its continuation pages, instead of listing every backup folder separately. Counts, policy breakdowns and backup results stay the same.
A backup attempt can fail before any backup is saved. It does not appear in the timeline, but the Dashboard counts it as Failed and in Success Rate for the period. An automatic attempt also appears in the Schedule status. Click a scheduled or tray failure notification to open the affected tenant’s Schedule tab.
Types skipped because access was denied do not make the backup incomplete. Backup Details lists them: “Left out because access was denied”. Open the app registration in Microsoft Entra, go to API permissions and select Grant admin consent for <your tenant>, or run the setup script again. Then sign out of the tenant in TenuVault and sign in again. If every permission already shows Granted, check that your Intune role covers these items. See Create the app registration.
Backup history
Section titled “Backup history”The Backup History tab of Backup & Restore shows the Backup Timeline: every backup in the tenant’s storage, newest first. Click Refresh to reload it.
Each entry shows:
- the date and time
- what the backup covered: Everything, Everything except apps, or the number of types, for example “12 of 41 types”
- how it started: Manual, Scheduled or From tray
- the result, when it is not Complete
- Items, Size, Duration and Changes since the previous backup (see Compare backups)
Below the timeline, Trends by policy type shows one row per policy type found in the listed backups: how many backups held it, its latest item count, its latest and average stored size, the size change from the oldest to the newest backup that held it, and the latest, average and change of the whole backup duration for those backups. Each backup records one duration for the whole backup, so the duration columns are not a split by type. The trends use only the backup list already loaded for this tab. They need no extra reads and store nothing new. A type held by one backup shows Only one backup instead of a change, and a value a backup did not record shows Not recorded.
Click an entry to open its Backup Details:
| Part | What it shows |
|---|---|
| Buttons | View Changes (Compare backups), Download (export as ZIP) and Restore from this backup (Restore Intune policies) |
| Warnings | Why a backup is incomplete, how many items or types could not be read, and which types were left out for missing permissions |
| Totals | Items, Size, Duration and Changes since the previous backup |
| Contents | Item counts per area. Expand an area for counts per type, and to see how many of its types the backup did not include. Areas left out entirely show Not included. |
| About this backup | Status, Started (how it started), Included, Stored and Backup ID |
Restore from this backup is unavailable while a backup is running or when it holds no items.
Where to see backups at a glance
Section titled “Where to see backups at a glance”- The Dashboard shows the last backup, success rate, next automatic backup and Tenant Health of the selected tenant.
- The All tenants page shows the last backup of every tenant.
Plan requirements
Section titled “Plan requirements”| Action | Community | Pro | MSP |
|---|---|---|---|
| Manual backups to this device | Yes | Yes | Yes |
| Manual backups to your Azure storage account | No | Yes | Yes |
| Choose what to back up | Yes | Yes | Yes |
| Backup Selected across tenants | No | No | Yes |
If a tenant’s plan does not include an action, TenuVault shows which plan does and how to upgrade.
Frequently asked questions
Section titled “Frequently asked questions”How do I back up Microsoft Intune policies?
Section titled “How do I back up Microsoft Intune policies?”In TenuVault, select the tenant, open Backup & Restore and click Run Backup. Keep the saved backup choice or change it, then click Start backup. TenuVault reads the Intune configuration through Microsoft Graph with your own delegated sign-in and saves the objects in your backup choice, with their assignments where Intune has them.
What does an Intune backup include?
Section titled “What does an Intune backup include?”A full backup covers 41 Intune object types in nine areas, including Settings Catalog and device configuration policies, compliance policies, scripts, Administrative Templates, enrollment and tenant settings, plus app details and assignments. App installer files, Apple tokens and private keys cannot be exported by Microsoft Graph and are never included.
Does Microsoft Intune have a built-in backup?
Section titled “Does Microsoft Intune have a built-in backup?”No. Intune has no native backup, point-in-time restore or recycle bin for policies, so a deleted or changed policy cannot be recovered from the Intune portal. A backup tool such as TenuVault saves the configuration through Microsoft Graph before something goes wrong.
Where are Intune backups stored?
Section titled “Where are Intune backups stored?”On every plan, backups are encrypted with AES-256-GCM and stored in a local folder or on a network share. On Pro and MSP they can go to your own Azure storage account instead, where Azure encrypts them at rest and your role assignments decide which admins can read them. Backups are never sent to a TenuVault server.
How often should I back up Intune?
Section titled “How often should I back up Intune?”On a schedule, so a recent backup always exists before you need it. Community includes manual and weekly scheduled backups. Pro and MSP add daily schedules. Also run a manual backup before any large policy change.
Related pages
Section titled “Related pages”- Intune backup: what TenuVault backs up and why, on the product site
- Does Microsoft Intune have a built-in backup?
- Manual Intune exports or scheduled backups: when exporting by hand is enough, on the product site
- What gets backed up
- Schedule backups
- Restore Intune policies