Backup & Restore
What it does
The Backup & Restore page has two independent tabs: Backup and Restore.
The Backup tab exports all supported Intune and Azure AD configuration types to a ZIP archive you download in your browser. Each resource type gets its own folder inside the ZIP, and each item inside is a separate JSON file named after its display name. The format is compatible with the IntuneManagement open-source tool, so backups created in IntuneAssistant can be imported by either tool.
The Restore tab lets you upload a backup ZIP and selectively re-import configurations into a tenant. You choose which resource types and individual items to restore, control whether assignments are applied, and whether Conditional Access policies are created in report-only mode first. The restore uses a guided three-step flow so nothing is imported by accident.
Backup
How to use it
Navigate to Configuration > Backup & Restore in the sidebar. The table already shows, per resource type, how many items exist and how many are ready locally (the Ready column) - Intune Assistant collects this in the background from the moment you sign in.
On the Backup tab, select the resource types you want to export using the checkboxes in the table header or per row, and optionally narrow by platform or scope tag.
Click Download backup. The text next to the button tells you whether everything is ready (the ZIP is built locally, instantly) or how many items still have to be fetched first. If anything is fetched, the table updates in real time and the ZIP is saved automatically when it is done.
Use Save ZIP again if you want the same archive a second time, or after retrying failed items.
What you will see
The status table has one row per resource type. Each row shows the resource type name, the Ready count (items available locally versus items that exist; "listed on download" for the few types the overview does not collect), the current status (Not started, Running, Done, or Error), and the item count once the export completes. If a type returns an error (for example because a Graph permission was not consented), the row shows the error and the remaining types continue.
The downloaded file is named IntuneBackup-YYYY-MM-DD.zip. Inside, each resource type has its own folder containing one .json file per configuration item.
Where the data comes from
The Backup page works together with the tenant overview that Intune Assistant collects when you sign in:
What exists (the list of items per resource type) comes from that overview, so a backup starts immediately instead of asking Microsoft Graph for each type first. The note above the filters tells you when the overview was collected and offers a refresh.
Item content is fetched live the first time, and kept locally afterwards. A later backup reuses the content of items that have not been modified since, and only fetches what is new or changed. The row shows how many items came from that local copy (for example "312 / 320 · 300 cached").
Keep backup content ready is on by default: the content is collected in the background as soon as the overview has loaded, so pressing Start Backup produces the ZIP without waiting for Microsoft Graph. It costs one Graph read per configuration item after every overview refresh; on a very large tenant, or if you rarely back up, switch it off and content is fetched only when you start a backup. The choice is remembered in your browser. Clear content cache throws the local copies away; Reset cache on the Tenant Overview page does the same as part of a full reset.
The locally kept content lives in your own browser, per signed-in account and per tenant, and is removed when you sign out.
Restore
The Restore feature requires the Config Management module. Backup is available without it.
Three-step flow
Step 1 — Upload
Drag and drop your backup ZIP onto the upload area, or click to browse. The file is processed in your browser; nothing is sent to the server at this point.
Step 2 — Configure
Set your import options before reviewing what will be restored:
Skip assignments (on by default) — creates policies without any group or user assignments. Recommended when restoring to a different tenant or when you want to review assignments before activating policies. Turn this off only when restoring to the same tenant and you are sure the group IDs match.
CA report-only — creates all Conditional Access policies in report-only mode so they do not enforce immediately. Recommended when restoring to a production tenant.
Exclude scope tags — if your backup contains scope tags, you can deselect specific ones so items that reference only those tags are excluded from the import.
Step 3 — Review and Import
The review table lists every resource type and item found in the ZIP. You can:
Expand a resource type to see individual items.
Deselect items you do not want to restore.
Use the select-all checkbox in the row header to select or deselect all items for a type.
Items that cannot be restored are greyed out with an explanation (for example, Microsoft proprietary scripts). These cannot be selected.
Click Start Import to begin. Each item shows its result inline: a check mark for success, an X for failure with the error message, or a warning where the policy was created but with caveats (such as a removed secret reference or a reset notification template).
When the import finishes, a summary shows how many items succeeded and how many failed. You can retry failed items individually or click Reset & Re-import to start over with the same ZIP.
Restore builds up from the lowest level
Restore works in levels, lowest first, because later items refer to earlier ones:
Scope tags
Groups (only when you select them, or when something you selected needs them)
Assignment filters
Building blocks: named locations, authentication strengths, notification templates, compliance scripts, terms of use and uploaded ADMX files
Policies of every other type
Conditional Access, last, because it refers to groups, named locations and authentication strengths
With Map references to this tenant (on by default) Restore also translates the ids in each item to this tenant's. A scope tag is only a number, and the same number is a different scope tag in another tenant, so scope tags, and for Conditional Access the groups, named locations and authentication strength, are matched by name (or by the same id where ids are globally unique). The mapping is the same one the health scan shows.
Prerequisites are added for you. What the items you selected need, and your tenant doesn't have yet, is added to the restore when the backup holds it, and marked added automatically. It is created before the items that need it.
Compliance policies keep their links. A compliance policy that sends a notification uses a notification template (and can CC groups), and a custom compliance policy runs a compliance script. Those links are translated to your tenant's own template, group and script, which Restore creates first when the backup holds them. Without the map the links are reset or removed, with a warning, as before.
Terms of use can't be restored. The backup holds no PDF, and writing an agreement needs a permission that no module includes. A Conditional Access policy that needs a terms of use your tenant doesn't have is not restored, and the row says which one; create it by hand and restore again.
Nothing lands on the wrong tag or group. An item that needs something your tenant still lacks, or that matches several of your items, is not restored. The row says exactly what is missing, for example "scope tag '26H2' does not exist in the tenant".
Nothing changes in what is restored beyond the ids. Existing items are not overwritten by prerequisites. Assignments are still not restored.
Not verified. An id the backup has no name for (for example a backup without its scope tags) can't be checked. The item is restored as it is and the row says it wasn't verified.
Turn the option off to restore exactly as before: ids are sent as they are, in the same level order.
Supported resource types
The following types are supported for both backup and restore unless noted.
Settings Catalog
yes
yes
Secret/password settings are skipped on restore
Device Configuration
yes
yes
Compliance Policies
yes
yes
Scheduled action configurations are expanded
Conditional Access
yes
yes
Location and Terms of Use refs stripped; auth strength limited to built-in IDs
Assignment Filters
yes
yes
Scope Tags
yes
yes
App Protection (iOS)
yes
yes
App Protection (Android)
yes
yes
App Protection (Windows)
yes
yes
Enrollment Restrictions
yes
yes
Built-in default restriction cannot be restored
Autopilot Profiles
yes
yes
Device Health Scripts
yes
yes
Microsoft global scripts are skipped on restore
PowerShell Scripts
yes
yes
Microsoft proprietary scripts are skipped
macOS Shell Scripts
yes
yes
Administrative Templates
yes
yes
Definition values not included
Feature Update Profiles
yes
yes
EOL Windows versions may be rejected
Driver Update Profiles
yes
yes
Quality Update Profiles
yes
yes
Endpoint Security
yes
no
Restore not yet supported
App Configuration (Managed App)
yes
yes
App Configuration (Managed Device)
yes
yes
Enrollment Status Page
yes
yes
Notification Templates
yes
yes
Intune Branding
yes
yes
Terms of Use
yes
no
Cross-tenant IDs cannot be resolved
Named Locations
yes
yes
Location IDs stripped; recreated as new
Authentication Strengths
yes
no
Custom strengths are tenant-specific
Compliance Scripts
yes
yes
ADMX Files
yes
no
Binary content not supported
Requirements
The Config Management module must be enabled for your tenant to use Restore. Backup is available with any active subscription.
Your Microsoft account must have permission to read (for backup) or write (for restore) the relevant Intune and Azure AD resources. The application prompts for consent if any permission is missing.
For restore, the following Microsoft Graph permissions are required:
DeviceManagementConfiguration.ReadWrite.All,DeviceManagementApps.ReadWrite.All,DeviceManagementRBAC.ReadWrite.All,DeviceManagementServiceConfig.ReadWrite.All,DeviceManagementScripts.ReadWrite.All,Policy.ReadWrite.ConditionalAccess.
Common questions
Can I restore a backup from a different tenant? Yes. Enable Skip assignments and CA report-only to avoid unintended enforcement. Review all policies after import before enabling them.
What happens to assignments when Skip assignments is off? Group and user IDs from the backup are used as-is. If those IDs do not exist in the target tenant, Intune will reject the assignments with a 404. Only use this option when restoring to the same tenant.
Why are some items greyed out in the review table? Those items cannot be created via the API. Common examples are Microsoft global scripts (built-in Intune content), built-in enrollment restrictions, and Terms of Use entries. They are included in the backup so you have a record, but the restore skips them automatically.
What are the warnings shown after a successful restore? Some fields cannot be transferred across tenants and are cleared automatically. You will see a warning when secret settings were skipped, notification templates were reset to the default, or a custom authentication strength was nulled out. Review the warnings and re-configure those fields in the target tenant.
Can I import a ZIP created by IntuneManagement (Mikael Karlsson's tool)? Yes. The ZIP format is compatible. Note that some IntuneManagement exports do not include the @odata.type field inside each JSON file. IntuneAssistant detects the platform for App Protection policies (iOS/Android/Windows) from the file name in that case.
What if an import fails partway through? Failed items remain in the review table with their error messages. Use the Retry button next to a failed resource type to retry only the failed items, or click Reset & Re-import to start the whole import over.
Last updated