Back up Intune assignment filters

What does an assignment filter backup actually contain?

TenuVault lists Assignment filters as a supported type in Tenant administration. The coverage table says No in the Assignments column because a filter does not have an assignment set of its own. That column is not an indication that filter backup is unsupported.

Capture the filter and affected policies together. The policy backup holds targeting where supported, while the filter object supplies the reusable definition. Record whether each policy includes or excludes the filtered population, and review that intent before restoring saved assignments. A familiar name alone does not establish that the targeting is correct.

Can I document an Intune filter rule and its policy references?

Microsoft assignment filters refine the targeting of supported apps, policies and profiles. Review the filter definition and where it is used in the Intune admin center before editing a rule.

A manual copy of a rule helps with review, but it does not capture the full relationship between that filter and policy targeting. Keep an inventory of the policies that reference it. Exporting only a policy or only a filter leaves part of that recovery question unanswered.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune assignment filters?

List the policies using a filter before editing its rule. A filter object describes a condition, while the consuming assignment determines how that condition changes targeting; recovery needs both pieces of that relationship.

1. Under Custom > Tenant administration, include Assignment filters for the filter definitions.
2. Select the types of policies that consume those filters as part of the same capture.
3. After the backup finishes, inspect Assignment filters in the Tenant administration area of Backup Details and compare the saved rules with the intended population.
4. Prepare a recovery selection containing the filter and the affected policies when both need rebuilding. Inspect the policy assignments separately to decide whether their saved include or exclude targeting should return.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

What happens to filter IDs when policies are restored?

TenuVault restores dependencies such as assignment filters before the objects that use them. When a recreated dependency gets a new ID, later objects in the same restore are pointed to that new ID. Select the dependency and its consumers together when they need recovery.

Create copies lets you inspect an object separately; replace in place and Restore assignments require Pro or MSP. Restoring assignments on a supported policy replaces its complete assignment set, not just the filter reference you were investigating. If a required reference cannot be resolved, the item fails before creation rather than silently dropping the dependency.

• Review restore modes and plan requirements

How do I verify include and exclude filters after recovery?

Inspect the restored filter definition in Intune and compare it with your change record. Then review each dependent policy assignment. An unassigned policy copy can help inspect configuration before targeting devices, but does not demonstrate that the original assignment set was recovered.

If the restore recreates a filter, check the references in the restored policies rather than assuming the old ID survived. Document any policies outside the restore selection that still need manual reconciliation. Keep the original backup until the filter and the intended include or exclude behavior have both been reviewed.

Download TenuVault and test a filter with a small, documented pilot population on your tenant. Save its definition together with one dependent policy, then inspect the restored references and targeting. Record policies left outside that recovery selection so an administrator can reconcile their filter references explicitly.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately