> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/intune-assistant/backup-restore/backup-restore.md). # Backup & Restore ## What it does The Backup & Restore page has two independent tabs: **Backup** and **Restore**. The Backup tab exports all supported Intune and Azure AD configuration types to a ZIP archive you download in your browser. Each resource type gets its own folder inside the ZIP, and each item inside is a separate JSON file named after its display name. The format is compatible with the IntuneManagement open-source tool, so backups created in IntuneAssistant can be imported by either tool. The Restore tab lets you upload a backup ZIP and selectively re-import configurations into a tenant. You choose which resource types and individual items to restore, control whether assignments are applied, and whether Conditional Access policies are created in report-only mode first. The restore uses a guided three-step flow so nothing is imported by accident. *** ## Backup ### How to use it 1. Navigate to **Configuration > Backup & Restore** in the sidebar. 2. On the **Backup** tab, select the resource types you want to export using the checkboxes in the table header or per row. 3. Click **Start Backup**. The table updates in real time as each type is exported. 4. When all selected types show Done, click **Download ZIP** to save the archive. ### What you will see The status table has one row per resource type. Each row shows the resource type name, current status (Not started, Running, Done, or Error), and the item count once the export completes. If a type returns an error (for example because a Graph permission was not consented), the row shows the error and the remaining types continue. The downloaded file is named `IntuneBackup-YYYY-MM-DD.zip`. Inside, each resource type has its own folder containing one `.json` file per configuration item. *** ## Restore The Restore feature requires the Config Management module. Backup is available without it. ### Three-step flow **Step 1 — Upload** Drag and drop your backup ZIP onto the upload area, or click to browse. The file is processed in your browser; nothing is sent to the server at this point. **Step 2 — Configure** Set your import options before reviewing what will be restored: * **Skip assignments** (on by default) — creates policies without any group or user assignments. Recommended when restoring to a different tenant or when you want to review assignments before activating policies. Turn this off only when restoring to the same tenant and you are sure the group IDs match. * **CA report-only** — creates all Conditional Access policies in report-only mode so they do not enforce immediately. Recommended when restoring to a production tenant. * **Exclude scope tags** — if your backup contains scope tags, you can deselect specific ones so items that reference only those tags are excluded from the import. **Step 3 — Review and Import** The review table lists every resource type and item found in the ZIP. You can: * Expand a resource type to see individual items. * Deselect items you do not want to restore. * Use the select-all checkbox in the row header to select or deselect all items for a type. Items that cannot be restored are greyed out with an explanation (for example, Microsoft proprietary scripts). These cannot be selected. Click **Start Import** to begin. Each item shows its result inline: a check mark for success, an X for failure with the error message, or a warning where the policy was created but with caveats (such as a removed secret reference or a reset notification template). When the import finishes, a summary shows how many items succeeded and how many failed. You can retry failed items individually or click **Reset & Re-import** to start over with the same ZIP. *** ## Supported resource types The following types are supported for both backup and restore unless noted. | Type | Backup | Restore | Notes | | ---------------------------------- | ------ | ------- | ------------------------------------------------------------------------------ | | Settings Catalog | yes | yes | Secret/password settings are skipped on restore | | Device Configuration | yes | yes | | | Compliance Policies | yes | yes | Scheduled action configurations are expanded | | Conditional Access | yes | yes | Location and Terms of Use refs stripped; auth strength limited to built-in IDs | | Assignment Filters | yes | yes | | | Scope Tags | yes | yes | | | App Protection (iOS) | yes | yes | | | App Protection (Android) | yes | yes | | | App Protection (Windows) | yes | yes | | | Enrollment Restrictions | yes | yes | Built-in default restriction cannot be restored | | Autopilot Profiles | yes | yes | | | Device Health Scripts | yes | yes | Microsoft global scripts are skipped on restore | | PowerShell Scripts | yes | yes | Microsoft proprietary scripts are skipped | | macOS Shell Scripts | yes | yes | | | Administrative Templates | yes | yes | Definition values not included | | Feature Update Profiles | yes | yes | EOL Windows versions may be rejected | | Driver Update Profiles | yes | yes | | | Quality Update Profiles | yes | yes | | | Endpoint Security | yes | no | Restore not yet supported | | App Configuration (Managed App) | yes | yes | | | App Configuration (Managed Device) | yes | yes | | | Enrollment Status Page | yes | yes | | | Notification Templates | yes | yes | | | Intune Branding | yes | yes | | | Terms of Use | yes | no | Cross-tenant IDs cannot be resolved | | Named Locations | yes | yes | Location IDs stripped; recreated as new | | Authentication Strengths | yes | no | Custom strengths are tenant-specific | | Compliance Scripts | yes | yes | | | ADMX Files | yes | no | Binary content not supported | *** ## Requirements * The **Config Management** module must be enabled for your tenant to use Restore. Backup is available with any active subscription. * Your Microsoft account must have permission to read (for backup) or write (for restore) the relevant Intune and Azure AD resources. The application prompts for consent if any permission is missing. * For restore, the following Microsoft Graph permissions are required: `DeviceManagementConfiguration.ReadWrite.All`, `DeviceManagementApps.ReadWrite.All`, `DeviceManagementRBAC.ReadWrite.All`, `DeviceManagementServiceConfig.ReadWrite.All`, `DeviceManagementScripts.ReadWrite.All`, `Policy.ReadWrite.ConditionalAccess`. *** ## Common questions **Can I restore a backup from a different tenant?** Yes. Enable Skip assignments and CA report-only to avoid unintended enforcement. Review all policies after import before enabling them. **What happens to assignments when Skip assignments is off?** Group and user IDs from the backup are used as-is. If those IDs do not exist in the target tenant, Intune will reject the assignments with a 404. Only use this option when restoring to the same tenant. **Why are some items greyed out in the review table?** Those items cannot be created via the API. Common examples are Microsoft global scripts (built-in Intune content), built-in enrollment restrictions, and Terms of Use entries. They are included in the backup so you have a record, but the restore skips them automatically. **What are the warnings shown after a successful restore?** Some fields cannot be transferred across tenants and are cleared automatically. You will see a warning when secret settings were skipped, notification templates were reset to the default, or a custom authentication strength was nulled out. Review the warnings and re-configure those fields in the target tenant. **Can I import a ZIP created by IntuneManagement (Mikael Karlsson's tool)?** Yes. The ZIP format is compatible. Note that some IntuneManagement exports do not include the `@odata.type` field inside each JSON file. IntuneAssistant detects the platform for App Protection policies (iOS/Android/Windows) from the file name in that case. **What if an import fails partway through?** Failed items remain in the review table with their error messages. Use the Retry button next to a failed resource type to retry only the failed items, or click Reset & Re-import to start the whole import over. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.intuneassistant.cloud/intune-assistant/backup-restore/backup-restore.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.