TenuVaultDesktopComparison
Microsoft Entra Backup and Recovery or an Intune backup
Microsoft Entra Backup and Recovery backs up Entra objects such as users, groups, applications and Conditional Access policies every day, and is generally available since June 2026. It is the right tool for identity, and TenuVault does not compete with it there. It lists no Intune objects, so Intune configuration needs its own backup. This page explains how the two fit together.
At a glance
- Microsoft Entra Backup and Recovery backs up supported objects once a day and keeps up to seven days of backup history.
- It covers users, groups, applications, service principals, Conditional Access policies, named locations, the authentication method policy and selected properties of the authorization policy.
- It lists no Intune objects, and it does not recover or recreate hard-deleted objects.
- It needs Microsoft Entra ID P1 or P2 licenses.
- TenuVault backs up Intune configuration only. Entra objects such as groups and Conditional Access policies are not in its backups. Assignments are saved as references to Entra groups; the groups themselves are not backed up.
Side by side
| Question | Entra Backup and Recovery | TenuVault backup |
|---|---|---|
| What it covers | Entra users, groups, apps, service principals, Conditional Access and more | Intune configuration: 40 Intune object types in nine areas, with their assignments where Intune has them |
| Intune policies | No | Yes |
| Entra groups and Conditional Access | Yes | No |
| How often | Once a day, automatically | Weekly on Community, daily on Pro and MSP, and whenever you start one |
| History | Up to seven days | Up to 30 days on Community; 7 to 365 days or forever on Pro and MSP |
| Licensing | Entra ID P1 or P2 | Community is free for one tenant; Pro and MSP are paid |
Why Intune needs its own backup
Microsoft's list of objects supported by Entra Backup and Recovery has no Intune configuration: no device configuration or settings catalog policies, compliance policies, apps, scripts or enrollment settings. Those live in Intune and are read through Intune's Microsoft Graph APIs.
So a tenant that relies on Entra Backup and Recovery alone can bring back a deleted group or Conditional Access policy, but not the compliance policy that Conditional Access depends on.
How the two fit together
Intune assignments point at Entra groups by ID. A TenuVault backup saves those references but not the groups, so a restored policy can only be assigned to groups that still exist. That is where Entra matters: deleted security and Microsoft 365 groups can be restored from Entra's soft delete for 30 days with the same ID, and Entra Backup and Recovery covers group objects as well.
In a recovery, restore missing groups in Entra first, then restore Intune policies with their assignments.
When you do not need TenuVault
Entra Backup and Recovery covers your needs when:
- What you need to protect is identity: users, groups, applications and Conditional Access.
- You do not use Intune, or you already back up Intune configuration another way.
When you need both
If you manage devices with Intune, you need a backup of Intune configuration as well as of Entra. The two do not overlap: one covers identity, the other covers device configuration. Windows settings backup and restore is a third, separate feature for user settings on devices.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does Microsoft Entra Backup and Recovery back up Intune?+
No. Its list of supported objects covers Entra objects such as users, groups, applications, service principals and Conditional Access policies, and lists no Intune objects.
How long does Entra Backup and Recovery keep backups?+
It takes a backup of supported objects once a day and keeps up to seven days of backup history.
Does TenuVault back up Entra groups or Conditional Access?+
No. TenuVault backs up Intune configuration only. Assignments are saved as references to Entra groups, so restore deleted groups in Entra before restoring Intune assignments.