Back up Intune BIOS configurations

Does a BIOS configuration backup include firmware and passwords?

BIOS configurations are an explicit type in the TenuVault backup coverage table, listed under Device configuration with assignments. Select that entry directly rather than assuming an unrelated Windows policy selection includes it.

Record the profile name, intended device population and relevant change ticket before capture. Keep the procedure limited to the Intune configuration object. The documented coverage does not promise recovery of a firmware password, device storage, an operating-system image or a firmware binary, so do not plan a device rebuild around this snapshot alone.

What should I preserve alongside an Intune BIOS profile?

Use the Intune admin center to review the BIOS configuration profile and the hardware requirements for applying it. Preserve the configuration record and its intended targets before making changes.

Hardware configuration recovery needs a clear boundary between the management object and the physical device. A saved Intune policy does not establish that firmware, external credentials or every hardware-specific prerequisite has been preserved. Keep any original setup material through your normal hardware administration process.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune BIOS configurations?

Identify the BIOS configuration object and the hardware group it is meant to manage before capturing it. Keep the original setup artifacts available through the device administration process, since policy recovery alone does not establish firmware recovery.

1. In the Custom picker, select BIOS configurations under Device configuration explicitly.
2. Save the BIOS profile before editing its configuration, including referenced scope tags when your recovery selection will need them.
3. Examine Device configuration > BIOS configurations within Backup Details for the expected saved object and assignment context.
4. For the first recovery check, inspect an unassigned copy against the recorded hardware scope. Reserve assignment changes for a reviewed pilot rather than treating profile creation as proof of a device-level outcome.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Can I restore a BIOS configuration without assigning hardware?

TenuVault documents BIOS configurations for backup and configuration restore through its supported workflow. Create copies with assignments off provides a separate object for inspection. Replace in place returns a supported existing object to the saved configuration; a deleted object is recreated with a new ID.

Community restores one unassigned copy at a time. Pro and MSP provide replace in place, multiple-item restoration and Restore assignments. Assignment recovery replaces the supported object assignment set with the saved groups and filters. Review those targets before applying the configuration to hardware, and inspect any missing-dependency or incomplete-object result.

• Review restore modes and plan requirements

How do I check BIOS policy recovery on a pilot device?

Start by comparing the recovered Intune object with your saved change record. Keep the copy unassigned while checking the intended configuration and hardware scope. Do not infer that the BIOS of a device has changed merely because a restore operation created a profile successfully.

Use a suitable pilot device and your normal hardware change process when validating an assigned recovery. Check Intune reporting and the device outcome separately. Record prerequisites and manual steps alongside the restore result, particularly where the hardware workflow relies on artifacts that are not part of the backed-up policy object.

Try a BIOS configuration rehearsal on your tenant with an appropriate hardware pilot. Download TenuVault and preserve the Intune profile before an approved adjustment, then compare the recovered object and its targets. Record the separate device checks and any external artifacts required to apply that configuration successfully.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately