Back up Intune compliance policy settings

Which tenant-wide compliance switches are included?

TenuVault captures Mark devices with no compliance policy assigned as and Compliance status validity period (days), plus the switches for scheduled actions for noncompliance and enhanced jailbreak detection. There is one set per tenant, without assignments.

The backup deliberately excludes unrelated tenant features returned alongside these settings, including log collection, Autopilot diagnostics, Android device administrator enrollment and derived credentials. This scope is narrower than a complete tenant settings export. Keep the change request specific about which values you intend to recover.

Where can I record compliance policy settings in Intune?

Microsoft exposes tenant-wide Compliance policy settings under Endpoint security > Device compliance. These settings include how devices without an assigned compliance policy are treated and the compliance status validity period.

They are distinct from the platform-specific compliance policies assigned to groups. Record the tenant-wide values directly in Intune before changing them. Exporting an individual Windows or mobile compliance policy does not establish a recovery record for these shared switches.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune compliance policy settings?

Treat these switches as a tenant-wide change rather than another group-targeted compliance profile. Before capturing them, record which devices lack an assigned policy and whether an access rule depends on their compliance result.

1. In a Custom backup, select Compliance policy settings under Compliance, rather than selecting only the platform-specific policies.
2. Save the switches before editing the unassigned-device treatment or compliance status validity period.
3. In Backup Details, examine the Compliance area for the tenant-wide settings entry. Compare its saved values with the compliance change request.
4. Preview Replace in place for that singleton and inspect each differing value. If the stored validity period is zero or outside the supported range, document the live value that recovery will retain.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Can I restore the tenant-wide compliance validity period?

Choose Replace in place on Pro or MSP. This singleton cannot be restored as a copy, and cross-tenant copying is blocked. The restore writes only the supported settings that differ from the current tenant. There is no unassigned duplicate on which to test these switches.

If the backup records a compliance status validity period of 0, meaning never set, or a value outside 1 to 120 days, TenuVault leaves the tenant value unchanged and explains that in the review. Do not describe that result as a full rollback of every saved field. Check the actual value that remains in Intune.

• Review restore modes and plan requirements

How do I rehearse compliance-switch recovery safely?

Review the current values against the saved values before authorizing a live replacement. Capture the current state first, since the restore itself does not preserve overwritten versions. Rehearse in a test tenant with its own backup rather than trying to copy the source singleton.

Check the final switches in Intune and document any validity-period value left unchanged. If you use compliance with Conditional Access, review the access implications as part of the change process. Conditional Access policies themselves belong to a separate opt-in backup scope, covered in the linked guide.

Download TenuVault and capture compliance settings in a test tenant that has its own reviewed access configuration. Rehearse a supported in-place change there, then verify the switches in Intune. On your production tenant, use the saved review to plan a deliberate replacement because an unassigned copy is unavailable.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately