Intune restore: restore policies from a backup

Restore Microsoft Intune policies from a TenuVault backup: recreate deleted policies, replace changed policies in place, or create unassigned copies.

An Intune restore brings Microsoft Intune policies back as they were when a backup ran, including policies that were changed or deleted afterwards. Recreated policies get new IDs in Intune, and references within the same restore are pointed to them. The restore wizard walks you through it: pick a backup, choose the policies, decide how to restore them, review exactly what will happen to each policy, and then watch the restore run. For the product overview, see Intune restore with TenuVault.

Before you start

The tenant is signed in and its license is active. If not, TenuVault shows a notice with Open sign-in settings and Open license above the page. See Sign in to your tenant and Activate and manage your license.
The tenant has backup storage chosen, and at least one backup with items in it. See Run a backup.
Your admin account has an Intune role that can write the item types you restore, for example Intune Administrator. TenuVault uses delegated permissions, so it can never do more than your account can.
If the backup is in a folder from another device, import that device’s recovery key first. Azure backups need no key, except older Azure backups that an earlier TenuVault version encrypted. See Encryption and recovery key.

What your plan includes

Capability	Community	Pro	MSP
Restore one item at a time as an unassigned [Restored] copy	Yes	Yes	Yes
Restore several items at once	No	Yes	Yes
Replace in place	No	Yes	Yes
Restore assignments	No	Yes	Yes
Copy to other tenants instead	No	No	Yes

Features your plan does not include show a plan badge in the wizard. If you send a request your plan does not cover, TenuVault answers with a message such as “Restoring several items at once: included in TenuVault Pro and MSP. Upgrade on the License page.”

Open the wizard

You can start a restore in two ways:

Go to Backup & Restore, select the tenant, and open the Restore tab. The wizard starts at step 1.
Go to Backup & Restore > Backup History, select a backup in the timeline, and click Restore from this backup in Backup Details. The wizard opens with that backup already chosen, at step 2. The button is unavailable while the backup is still running or when it holds no items.

The steps across the top are Backup, Items, Options, Review and Restore. You can click an earlier step to go back to it. Once a restore starts, the other steps are locked. When it finishes, use Restore more items to make a new selection.

Step 1: Choose a backup

Choose a backup lists every backup for the selected tenant that holds at least one item and is not still running. Each entry shows the date and time, the number of items, the size and the backup status (Complete, Completed with warnings, Failed, Cancelled, Incomplete or Status unknown). A backup that left some types out also shows its scope.

Backups that stopped early are listed too, because they still hold complete snapshots of the items they saved. When you choose one, step 2 shows: “This backup did not complete fully, so some items may be missing from it.” For a backup you cancelled, it shows in grey: “Cancelled: this backup was cancelled before it finished, so some items may be missing from it.” For a backup whose status is unknown, step 2 shows why its details could not be read and that some items may be missing.

If no backup qualifies, the wizard shows No backups to restore from and asks you to run a backup first.

Click a backup to continue.

Step 2: Choose what to restore

TenuVault reads the backup (Reading the backup…) and lists its items grouped by area (for example Device configuration, Compliance, Apps) and then by type.

Use Search by name or type to filter the list. Matching types expand automatically.
Expand a type and select individual items, or use the checkbox next to a type to select all of its restorable items.
On Pro and MSP, Select all (or Select all shown while searching) selects every restorable item in view, and Clear clears the selection.
On Pro and MSP, the Restore method list lets you pick Create copies or Replace in place now, because some items can only be restored one way. You confirm the method again in step 3.

The counter shows how many items are selected, for example “3 of 120 selected”.

Items that cannot be restored with the current method are greyed out and show the reason under their name. For example, an app that needs an installer file shows “Intune does not let apps download installer files. Upload the installer again to restore this app.” An item that can only be updated in place, such as a tenant default, shows “Replace only: this object cannot be copied.” when you create copies. See What cannot be restored for the full list.

Settings Catalog policies are also checked against the current Settings Catalog. A policy containing settings Microsoft now lists as deprecated shows a warning under its name naming those settings, and a banner above the list counts the affected policies with the catalog check date. The same warning appears again for the selected items in step 4. The check never blocks a restore: deprecated settings restore exactly as backed up, and deprecated does not prove a setting no longer applies. Review them in Intune after restoring. When the catalog cannot be read, the wizard says deprecated settings were not checked instead of showing the backup as clean. The check reads the catalog in the tenant you restore from; for copies to other tenants, their catalogs may differ.

Recovery readiness

Above the list, Recovery readiness for N objects expands into a read-only report for every item in the backup. For each item it shows:

Automatic configuration restore available or Review required
External artifacts: things TenuVault cannot recreate, such as installers or Apple tokens
Missing mappings: references to other tenant objects that would need a target in another tenant
Manual actions: steps you complete in Intune yourself

The report is conservative because it assumes a copy into another tenant. Nothing changes in your tenant while you read it. See Disaster recovery for how to act on it.

Click Next when your selection is ready, or Other backup to go back.

Step 3: How to restore

How to restore shows how many items are selected and offers the restore options:

Create copies: “Each item is created next to the current one with a [Restored] name. Nothing existing changes.”
Replace in place: “Items that still exist are put back to the backed-up version. Deleted items are recreated with their original name. Items that already match are left alone.”
Restore assignments: “Assign restored items to the same groups and filters as in the backup.”
Where: Copy to other tenants instead lets MSP tenants send copies to other connected tenants. Leave all tenants unchecked to restore to the selected tenant.

The details of each option, including which types support assignment restore, are in Restore modes and assignments. Copying to other tenants is covered in Restore to another tenant.

If you are recovering one missing policy, follow the guide to restore a deleted Intune policy for a worked recovery scenario.

Click Review to continue, or Items to go back.

Step 4: Review

Review shows what restoring each selected item will do. What TenuVault checks depends on the method:

Create copies and copies to other tenants do not read the existing items, because nothing existing changes. The wizard only checks the selected items (Checking the selected items…).
Replace in place reads every selected item from the tenant as it is now (Comparing with tenant…) and compares it with the backup.

A row of counters summarizes the plan, and the list below shows one label per item:

Label	Meaning
Create a [Restored] copy	A new copy is created next to the current item.
Copy to the chosen tenants	A copy is created in each selected target tenant.
Recreate: deleted from the tenant	The item no longer exists and is recreated under its original name.
Overwrite the current version	The item exists but differs from the backup, and is put back to the backed-up version.
Skip: already matches the backup	The item already matches, so nothing is sent. With Restore assignments off, an item whose only difference is its assignments is also skipped.
Cannot be restored	The item cannot be restored with this method. The reason is shown under the item name.
Restore: the current version could not be checked	TenuVault could not read the current item. It will still be restored, and the read error is shown under the item name.

If an item was renamed since the backup, the row shows its current name, for example now named "Contoso Baseline v2".

Each row also has Review snapshot content (may contain secrets), which expands the exact JSON TenuVault restores from the backup. Use it to check the settings before you write them.

Confirm changes to existing items

If any item will be overwritten, recreated or restored without a check, TenuVault asks you to confirm with a checkbox that spells out the effect, for example:

I understand that 4 items in Contoso will be overwritten, including assignments and 1 item deleted from Contoso will be recreated. Changes reach devices at their next check-in. Run a backup first if you may want the current versions back.

The restore button stays disabled until you tick it. If every selected item already matches or cannot be restored, the wizard shows “Nothing to restore: every selected item already matches the backup or cannot be restored.”

Click Restore N items to start. Only items that will actually change are sent; skipped and blocked items are left out of the count.

Validate the backup without restoring

Next to the restore button, Validate backup (no changes) runs a dry run over the whole backup. It reads every file back from backup storage and checks each item:

Manifest completeness: the backup finished, and every file recorded in its manifest is present.
Readable and decryptable: the file can be read back and decrypted with the keys on this device.
Recorded fingerprint: the content still matches the fingerprint recorded when the backup ran.
Policy payload: the payload parses and a restore plan can be built from it.
Assignment references: recorded assignments point at valid targets.

The result lists, per policy type, how many items passed and failed, and names every failing item with the check that failed. A valid backup reports that all items passed. Nothing is written to your tenant, to Microsoft Graph or to a change set, and no restore starts. Run it when you want to prove a backup is restorable before you need it, or to find the exact item that is missing or corrupt. Validating a whole backup is included in TenuVault Pro and MSP, like restoring several items at once.

Step 5: Restore

The Restoring… screen shows the item being restored and a progress bar. TenuVault restores items that others depend on first (scope tags, assignment filters, Intune roles, app categories, device categories, notification templates and reusable settings) and policy sets last. When an item is recreated with a new ID, later items in the same restore that reference it are pointed to the new ID.

When the restore ends, the heading changes to Restore finished and a summary such as “12 items completed; 1 failed.” appears. It names failed and skipped items only when there are some, so a clean run reads “1 item completed.” Each item shows its outcome:

Outcome	Meaning
Created a [Restored] copy	A copy was created in this tenant.
Recreated	A deleted item was created again under its original name.
Put back to the backed-up version	An existing item was updated in place.
Copied	A copy was created in the target tenant shown before the item name.
Already matched the backup	Nothing needed to change.
An error message	The item failed. The message comes from Microsoft Graph or TenuVault.

Some results carry extra notes:

Incomplete object: ID. The item was created or updated, but a follow-up step (such as settings, categories or assignments) failed. If TenuVault can safely resume, the note says “Retry repairs the remaining steps without creating another object. Repair is available for one hour in this app session.” Otherwise it says “Check and repair it in Intune.”
Check this item in Intune before retrying; a write may already have completed. The response was lost, so TenuVault does not know whether the write reached Intune. It does not retry this item automatically. See Restore write history.
Warnings in amber describe partial problems, for example “Assignments could not be restored: …” followed by the Graph error.

Open a restored item

Each item that is now in the tenant has a button next to it that opens it in the admin center, in the tenant it was restored to:

Open in Intune opens the item itself: settings catalog and endpoint security policies, device configuration profiles (including update rings), compliance policies, apps, app protection policies, PowerShell and shell scripts, remediations, Windows Autopilot profiles and feature update profiles.
Open in Entra opens a Conditional Access policy.
Open list in Intune or Open list in Entra opens the list the item is in, for types whose page the admin centers do not let TenuVault open directly, such as administrative templates, app configuration policies, enrollment restrictions, assignment filters, scope tags, named locations and authentication strengths. Find the item there by its name.

Skipped items, and failed items that left nothing behind, have no button. An incomplete object has one, so you can check and finish it in the admin center.

After the restore

Retry failed items appears when some failures are safe to retry. It retries only confirmed failures, in their original target tenant, and repairs incomplete objects instead of creating new ones. Successful items are never sent again.
Restore more items returns to step 2 with the same backup so you can make another selection.
Restores are recorded in the tenant’s audit log.
Restored or overwritten items reach devices at their next check-in. Unassigned copies do not reach any device until you assign them in Intune.

Frequently asked questions

How do I restore an Intune policy?

Open Backup & Restore in TenuVault and start the restore wizard, or pick a backup in Backup History and click Restore from this backup. Choose the policies, choose Create copies or Replace in place, review what will happen to each policy, then confirm.

Can I restore a deleted Intune policy?

Yes, if a backup from before the deletion exists. Choose Replace in place in the restore wizard and the deleted policy is recreated under its original name. Without a backup, a deleted Intune policy cannot be recovered, because Intune has no recycle bin for policies.

What is the difference between Create copies and Replace in place?

Create copies adds separate copies and never changes existing policies. With Restore assignments turned off the copies are unassigned and reach no device, which makes them safe for testing a restore. With Restore assignments on (Pro and MSP), copies get the backed-up groups and filters and do reach devices at their next check-in. Replace in place overwrites the current version with the backed-up version and recreates deleted policies. Replace in place and restoring several policies at once need Pro or MSP.

Are assignments restored with an Intune policy?

Only when you turn on Restore assignments, which needs Pro or MSP. With it on, the policies you restore get the assignments recorded in the backup, where assignment replacement is supported. Windows Autopilot profiles, Apple user enrollment profiles, terms and conditions and Intune roles do not support assignment replacement in place: restore them in a separate selection with assignments off. Copies with assignments off and cross-tenant restores arrive unassigned.

Can I restore Intune configuration to another tenant?

Yes, with the MSP plan. Copies keep their original names, get the Default scope tag and are never assigned, so you recreate groups, exclusions and filters in the target tenant and then assign the copies.

Intune restore: restore modes, plans and limits, on the product site
How to restore a deleted Intune policy
Your own Intune export script or a backup app: where restore gets hard in a script, on the product site
Restore modes and assignments
Restore to another tenant
What cannot be restored and restore write history
Disaster recovery
Drift detection, for reverting a single changed policy