Back up Intune app protection policies

Are targeted apps included with app protection settings?

TenuVault documents iOS, Android and Windows app protection policies under App protection and configuration. Each type includes the apps it targets and its assignments. Select the actual platforms used by your organization rather than assuming one platform entry includes the others.

Everything except apps still includes app protection policies. The excluded Apps type refers to app details and assignments, not this policy area. App configuration policies are also separate entries, so do not interchange app configuration and app protection when describing what your selected backup contains.

How can I record an Intune app protection policy before editing it?

Microsoft app protection policies define rules for organizational data in managed apps. Review the platform-specific policy and its intended users in the Intune admin center before editing data protection or access requirements.

Document the policy configuration together with its targeted apps and assignments. A list of protected app names is not a recovery point for the settings. Likewise, preserving the policy does not preserve the documents or other business data used by those apps. Keep that data recovery process separate.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune app protection policies?

Inventory app protection by platform and targeted application before changing data-sharing rules. Capturing an iOS policy does not demonstrate that the Android counterpart, Windows policy or its user assignment was included.

1. In Custom, expand App protection and configuration and select the protection policy types used by your organization.
2. Include iOS, Android and Windows entries individually where needed, keeping app configuration selections distinct from protection rules.
3. Check the platform-specific backup results for failures before approving any change to data transfer or access requirements.
4. Within App protection and configuration in Backup Details, inspect the saved policies, their targeted apps and recorded assignments. Compare the recovered app scope before deciding whether user targeting should be restored.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Can I recover app protection rules without restoring user targeting?

Use Create copies with assignments off to inspect the recovered settings before introducing user targeting. Community restores one unassigned copy at a time. Pro and MSP provide multiple-item restore, replace in place and the option to restore supported assignments.

Replacing assignments uses the saved assignment set as a whole. It can remove targeting added after the backup or bring back targeting you removed. Inspect groups, exclusions and any filter references before enabling that option. Restore required dependencies in the same selection where possible, and review failed or incomplete results before attempting another operation.

• Review restore modes and plan requirements

How do I validate an iOS, Android or Windows protection restore?

Compare protection settings, targeted apps and assignments as three separate checks. A restored policy name by itself does not demonstrate that the intended app scope was recovered. Keep the first copy unassigned while you review the configured values and decide on a pilot.

After a reviewed production restore, use the Intune admin center to check the policy and its targeting. Assess the user experience through your normal pilot procedure before broadening scope. Do not describe successful policy restoration as recovery of application data, an app installation or content that an earlier protection action removed.

Try a protection-policy capture for one platform on your tenant after downloading TenuVault. Inspect an unassigned restored policy for the expected apps and protection values, then plan user validation through a pilot. Document the app scope alongside the result so a successful configuration restore is not mistaken for recovery of business data.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately