Backup & Restore
What it does
The Backup & Restore page has two independent tabs: Backup and Restore.
The Backup tab exports all supported Intune and Azure AD configuration types to a ZIP archive you download in your browser. Each resource type gets its own folder inside the ZIP, and each item inside is a separate JSON file named after its display name. The format is compatible with the IntuneManagement open-source tool, so backups created in IntuneAssistant can be imported by either tool.
The Restore tab lets you upload a backup ZIP and selectively re-import configurations into a tenant. You choose which resource types and individual items to restore, control whether assignments are applied, and whether Conditional Access policies are created in report-only mode first. The restore uses a guided three-step flow so nothing is imported by accident.
Backup
How to use it
Navigate to Configuration > Backup & Restore in the sidebar.
On the Backup tab, select the resource types you want to export using the checkboxes in the table header or per row.
Click Start Backup. The table updates in real time as each type is exported.
When all selected types show Done, click Download ZIP to save the archive.
What you will see
The status table has one row per resource type. Each row shows the resource type name, current status (Not started, Running, Done, or Error), and the item count once the export completes. If a type returns an error (for example because a Graph permission was not consented), the row shows the error and the remaining types continue.
The downloaded file is named IntuneBackup-YYYY-MM-DD.zip. Inside, each resource type has its own folder containing one .json file per configuration item.
Restore
The Restore feature requires the Config Management module. Backup is available without it.
Three-step flow
Step 1 — Upload
Drag and drop your backup ZIP onto the upload area, or click to browse. The file is processed in your browser; nothing is sent to the server at this point.
Step 2 — Configure
Set your import options before reviewing what will be restored:
Skip assignments (on by default) — creates policies without any group or user assignments. Recommended when restoring to a different tenant or when you want to review assignments before activating policies. Turn this off only when restoring to the same tenant and you are sure the group IDs match.
CA report-only — creates all Conditional Access policies in report-only mode so they do not enforce immediately. Recommended when restoring to a production tenant.
Exclude scope tags — if your backup contains scope tags, you can deselect specific ones so items that reference only those tags are excluded from the import.
Step 3 — Review and Import
The review table lists every resource type and item found in the ZIP. You can:
Expand a resource type to see individual items.
Deselect items you do not want to restore.
Use the select-all checkbox in the row header to select or deselect all items for a type.
Items that cannot be restored are greyed out with an explanation (for example, Microsoft proprietary scripts). These cannot be selected.
Click Start Import to begin. Each item shows its result inline: a check mark for success, an X for failure with the error message, or a warning where the policy was created but with caveats (such as a removed secret reference or a reset notification template).
When the import finishes, a summary shows how many items succeeded and how many failed. You can retry failed items individually or click Reset & Re-import to start over with the same ZIP.
Supported resource types
The following types are supported for both backup and restore unless noted.
Settings Catalog
yes
yes
Secret/password settings are skipped on restore
Device Configuration
yes
yes
Compliance Policies
yes
yes
Scheduled action configurations are expanded
Conditional Access
yes
yes
Location and Terms of Use refs stripped; auth strength limited to built-in IDs
Assignment Filters
yes
yes
Scope Tags
yes
yes
App Protection (iOS)
yes
yes
App Protection (Android)
yes
yes
App Protection (Windows)
yes
yes
Enrollment Restrictions
yes
yes
Built-in default restriction cannot be restored
Autopilot Profiles
yes
yes
Device Health Scripts
yes
yes
Microsoft global scripts are skipped on restore
PowerShell Scripts
yes
yes
Microsoft proprietary scripts are skipped
macOS Shell Scripts
yes
yes
Administrative Templates
yes
yes
Definition values not included
Feature Update Profiles
yes
yes
EOL Windows versions may be rejected
Driver Update Profiles
yes
yes
Quality Update Profiles
yes
yes
Endpoint Security
yes
no
Restore not yet supported
App Configuration (Managed App)
yes
yes
App Configuration (Managed Device)
yes
yes
Enrollment Status Page
yes
yes
Notification Templates
yes
yes
Intune Branding
yes
yes
Terms of Use
yes
no
Cross-tenant IDs cannot be resolved
Named Locations
yes
yes
Location IDs stripped; recreated as new
Authentication Strengths
yes
no
Custom strengths are tenant-specific
Compliance Scripts
yes
yes
ADMX Files
yes
no
Binary content not supported
Requirements
The Config Management module must be enabled for your tenant to use Restore. Backup is available with any active subscription.
Your Microsoft account must have permission to read (for backup) or write (for restore) the relevant Intune and Azure AD resources. The application prompts for consent if any permission is missing.
For restore, the following Microsoft Graph permissions are required:
DeviceManagementConfiguration.ReadWrite.All,DeviceManagementApps.ReadWrite.All,DeviceManagementRBAC.ReadWrite.All,DeviceManagementServiceConfig.ReadWrite.All,DeviceManagementScripts.ReadWrite.All,Policy.ReadWrite.ConditionalAccess.
Common questions
Can I restore a backup from a different tenant? Yes. Enable Skip assignments and CA report-only to avoid unintended enforcement. Review all policies after import before enabling them.
What happens to assignments when Skip assignments is off? Group and user IDs from the backup are used as-is. If those IDs do not exist in the target tenant, Intune will reject the assignments with a 404. Only use this option when restoring to the same tenant.
Why are some items greyed out in the review table? Those items cannot be created via the API. Common examples are Microsoft global scripts (built-in Intune content), built-in enrollment restrictions, and Terms of Use entries. They are included in the backup so you have a record, but the restore skips them automatically.
What are the warnings shown after a successful restore? Some fields cannot be transferred across tenants and are cleared automatically. You will see a warning when secret settings were skipped, notification templates were reset to the default, or a custom authentication strength was nulled out. Review the warnings and re-configure those fields in the target tenant.
Can I import a ZIP created by IntuneManagement (Mikael Karlsson's tool)? Yes. The ZIP format is compatible. Note that some IntuneManagement exports do not include the @odata.type field inside each JSON file. IntuneAssistant detects the platform for App Protection policies (iOS/Android/Windows) from the file name in that case.
What if an import fails partway through? Failed items remain in the review table with their error messages. Use the Retry button next to a failed resource type to retry only the failed items, or click Reset & Re-import to start the whole import over.
Last updated