Back up Intune Autopilot profiles

What is saved for Autopilot profiles and registered devices?

Select both Windows Autopilot deployment profiles and Windows Autopilot devices when your change affects profiles and device metadata. Profiles include their assignments in the backup. Device records have no assignment set of their own.

For each device, TenuVault saves serial number, manufacturer, model, group tag, purchase order, assigned user and friendly name, and device name. Product keys and Surface Hub device account passwords are never stored. Hardware hashes are absent from the registered-device backup, so do not delete the original hash files after a successful run.

Can I export Autopilot group tags and assigned users?

Microsoft lets administrators manage Autopilot deployment profiles, organize registered devices using group tags and assign users. Keep the original device import files through your normal provisioning process.

A profile record, a group tag list and a hardware hash file serve different purposes. Recording a deployment profile does not preserve everything needed to register a device again. Match your device records by serial number before planning recovery, and retain the original registration artifacts separately.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune Autopilot profiles?

Separate deployment profiles from registered device metadata before an enrollment change. Keep hardware hash import files alongside the provisioning procedure, since a saved group tag or assigned user cannot register a missing device.

1. Use Custom to select both Windows Autopilot deployment profiles and Windows Autopilot devices within Enrollment.
2. Capture the records before a bulk group-tag or assigned-user edit, then inspect the enrollment results for unreadable objects.
3. In Backup Details > Enrollment, compare profile names and device serial numbers with the planned enrollment changes.
4. Use Export CSV beside Windows Autopilot devices when you need an inventory for matching group tags to hash files. Check the device is registered before planning metadata restoration.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Which Autopilot device fields can be restored in place?

Deployment profiles support the documented restore modes, but assignment replacement in place is unsupported. Restore profiles in a separate selection with Restore assignments off, then reconcile their assignments in Intune. Pro or MSP is required for replace in place.

Device records restore only in place: group tag, assigned user and its friendly name, and device name. Restore does not register devices or copy them to another tenant. A deleted and reimported device can be matched by serial number. A missing user in the backup unassigns the user; friendly names that cannot be cleared or set independently remain unchanged, as shown in review.

• Review restore modes and plan requirements

How do I match a recovered Autopilot device by serial number?

Review each device result and allow for Intune to apply the changes within a few minutes. Device restore is not a reset or re-enrollment procedure. If the device is missing, register it separately using the original hash or your provisioning process before recovering its saved metadata.

In Backup Details > Enrollment, Export CSV beside Windows Autopilot devices gives a readable inventory including group tags and users. Use serial numbers to match it to the original hash files. Protect that export as device and user information, and keep it separate from public change records.

Try an Autopilot recovery rehearsal on a registered test device in your tenant. Download TenuVault, capture its group tag, user and name, then review the proposed in-place differences. Keep the deployment profile assignment review separate, and document any friendly-name value Intune cannot change independently.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately