Disaster recovery: recover Intune configuration

Intune disaster recovery means getting Microsoft Intune configuration back after policies are deleted or changed, an admin device is lost, or a tenant has to be rebuilt. A backup is only useful if you can restore from it when things go wrong. This page shows how to prepare, and which TenuVault workflow to use for each recovery scenario. For the planning checklist, see the Intune disaster recovery plan on the product site.

Prepare before you need it

Work through this checklist for every tenant you protect:

1. Schedule backups. Set a daily (Pro and MSP) or weekly schedule so a recent backup always exists. See Schedule backups.
2. Save the recovery key, for backups on the device. Go to Settings > Storage and recovery and click Save recovery key. Store the file in your password manager. Without it, backups on the device can only be read on the device that made them. Azure backups do not need it. See Encryption and recovery key.
3. Keep backups off the admin device. Use an Azure storage account (Pro and MSP), which every admin with access can read from any computer, or point the local backup folder at a network share, where the files stay encrypted. See Backup storage and retention.
4. Keep an independent copy. A storage administrator can delete or lock a storage account. Keep a second copy of important backups under your own recovery policy.
5. Check recovery readiness. Open a backup in the restore wizard and expand Recovery readiness to see which items restore automatically and which need manual work. See Check recovery readiness.
6. Know who owns external artifacts. Record where the original app installers and Apple tokens come from, and who can renew them. Free App Backup can retain original .intunewin files you already have; keep a separate copy of its encrypted source folder and recovery key.
7. Practice a restore. Restore a few items with Create copies. Copies are unassigned by default and never change existing items, so a test is safe.

For a rehearsal checklist, follow the guide to practice an Intune restore.

Choose the right workflow

Situation	What to use
One policy was changed and you want the old settings back	Drift detection to review and revert it, or Replace in place in the restore wizard
Items were deleted	Replace in place. Deleted items are recreated under their original names.
Many items were changed or deleted	Replace in place with several items selected (Pro and MSP). Add Restore assignments if assignments must come back too.
You want to inspect an old version without touching the current one	Create copies, unassigned
The admin device was lost or reinstalled	Recover on a new device
Configuration must be rebuilt in another tenant	Restore to another tenant (MSP)

Recover lost or changed configuration

1. Take a backup of the current state first. A restore overwrites current versions. If you might need them, run a backup before you continue. The restore confirmation reminds you of this.
2. Go to Backup & Restore > Backup History and pick the last backup from before the problem. Use View Changes in Backup Details to see what changed between backups.
3. Click Restore from this backup.
4. Select the affected items. On How to restore, choose Replace in place.
5. Decide on Restore assignments. With it on, each item’s assignments are replaced with the ones in the backup. Restore Windows Autopilot profiles, Apple user enrollment profiles, terms and conditions and Intune roles in a separate selection with assignments off. See Restore modes and assignments.
6. On Review, check the labels. Items that already match are skipped, deleted items show Recreate: deleted from the tenant, and changed items show Overwrite the current version.
7. Tick the confirmation, click Restore N items, and check each result.
8. Resolve any Incomplete object or unknown outcomes as described in What cannot be restored and restore write history.
9. Complete the items that cannot be restored automatically. See Handle external artifacts.

TenuVault restores dependencies such as scope tags, assignment filters and categories before the items that use them, and policy sets last. Recreated items get new IDs, and later items in the same restore are pointed to them. Restore dependencies and the items that use them in the same selection.

Recover on a new device

Backups in your Azure storage account are readable from any device with access to the storage account. Backups on a device are encrypted with a key that is protected by your Windows or macOS account. A new or reinstalled device has a different key, so it needs your recovery key to read those, and to open Azure backups that an earlier TenuVault version encrypted.

1. Install TenuVault, select Connect your tenant and sign in to the tenant with the same app registration. The app registration already exists, so on the Connect step select I already have an app registration and enter its tenant ID and client ID. See Install and update TenuVault and Sign in to your tenant.
2. Activate your license. If the old device is gone and your license has reached its installation limit, deactivate the old installation in the customer portal. See Activate and manage your license.
3. If the backups are on a device, or include older encrypted Azure backups: go to Settings > Storage and recovery, click Import a recovery key, paste the key (it starts with TVK2., or TVK1 for older keys) and click Import. The imported key encrypts new backups on this device, and backups made with earlier keys stay readable. Skip this step for Azure backups made by this version.
4. Point the tenant at the existing backups:
   • Azure storage: choose the same storage account for the tenant in Settings > Sign-in > Change storage.
   • This device: click Change folder under Backups on this device and choose the folder that holds the backups, for example the network share or a restored copy.
5. Open Backup & Restore. The backups appear in Backup History and can be restored.

Note

After you import a key, click Save recovery key again. The saved bundle includes all keys on the device, so one file opens every backup.

Restore from a ZIP export

If you only have a ZIP export of a backup (from Download in Backup Details), you can import it on any device:

1. Go to Settings > Storage and recovery > Backups on this device and click Import backup ZIP.
2. Choose the ZIP file. It must be smaller than 128 MiB, contain a complete backup and include its tenuvault-manifest.json.
3. Review the dialog. It shows the source tenant, the backup ID and a SHA-256 digest of the archive, then asks “Import N policy snapshots?” Click Import locally.
4. Choose This device as backup storage for the source tenant. The import message tells you which tenant: “Select this device as storage for tenant ID to preview and restore it.”
5. Restore from the imported backup as usual.

Importing never changes Intune. The source tenant must be licensed on the device. The archive declares its source but is not signed, so only import files from a source you trust.

Caution

ZIP exports are not encrypted and can contain secrets such as OMA-URI values. Protect them like the configuration they hold.

Rebuild in another tenant

With MSP you can copy items from a backup of one connected tenant into another connected tenant. Copies keep their original names, get the Default scope tag and are never assigned. See Restore to another tenant for the full procedure, including dependency mappings for apps and app categories.

After the copy:

• Recreate groups, exclusions and filters in the target tenant, then assign the copies and validate targeting.
• Review Intune roles and their memberships carefully, so the recovery does not reinstate access you revoked.

Check recovery readiness

On Choose what to restore, expand Recovery readiness for N objects. For every object in the backup it reports:

Field	Meaning
Automatic configuration restore available	TenuVault can recreate the configuration without manual work.
Review required	At least one of the fields below needs attention.
External artifacts	Something only its owner can supply, such as an installer, signing material or a service token.
Missing mappings	References to other tenant objects that need a target in another tenant.
Manual actions	Steps you complete yourself, for example recreating group targeting for a cross-tenant copy, or reviewing role memberships.

“Readiness unavailable. Retry loading the backup.” means TenuVault could not assess the object. A missing assessment is not a pass. The report assumes the harder cross-tenant case, so some items flagged for review restore without extra work in their own tenant. No tenant changes happen while you review it.

Handle external artifacts

Backup metadata cannot recreate private keys, installer payloads or Apple credentials that the Microsoft Graph API does not export.

• Apps with installers: get the original installer from a trusted source, verify its publisher, and upload it through Intune’s app workflow. For a copy into another tenant, then map the new app with a reviewed dependency mapping.
• Apple automated device enrollment: renew or upload the enrollment token through Apple Business Manager or Apple School Manager and Intune. Use the backed-up enrollment profiles as a reference.
• Masked secrets: a profile whose backup holds a masked OMA-URI value (****) needs a new backup before it can be restored.

The full list is in What cannot be restored.

Frequently asked questions

What should I do before I need to recover Intune configuration?

Schedule backups, keep backups off the admin device (in an Azure storage account on Pro and MSP, or on a network share), save the recovery key in your password manager when backups stay on the device, keep an independent copy of important backups, check recovery readiness and practice a restore with Create copies.

How do I restore Intune items that were deleted?

Go to Backup & Restore > Backup History, pick the last backup from before the problem and click Restore from this backup. Select the items and choose Replace in place, which needs Pro or MSP. Deleted items are recreated under their original names. Turn on Restore assignments if their assignments must come back too.

Can I read my backups on a new or reinstalled computer?

Yes. Install TenuVault, sign in with the same app registration, activate your license and point the tenant at the existing Azure storage account or backup folder. Azure backups need no key. Backups kept on a device, and Azure backups an earlier TenuVault version encrypted, need the recovery key, imported under Settings > Storage and recovery.

What cannot be recovered automatically?

Anything Microsoft Graph does not export: app installer files, Apple automated device enrollment tokens, and private keys or other secret material. Upload the original installer again, renew the Apple token through Apple Business Manager or Apple School Manager, and run a new backup for profiles that hold a masked OMA-URI value.

Can I rebuild Intune configuration in another tenant?

Yes, with the MSP plan. You can copy items from a backup of one connected tenant into another connected tenant. Copies keep their original names, get the Default scope tag and are never assigned, so you recreate groups, exclusions and filters and then assign the copies.

Related pages

• Intune disaster recovery plan: the preparation checklist, on the product site
• Intune restore drill: practice a restore before you need one
• Restore Intune policies
• Restore modes and assignments
• Encryption and recovery key
• Troubleshooting