# Back up Intune compliance policy settings | TenuVault Back up Intune compliance policy settings with TenuVault. Preserve tenant-wide switches and understand in-place recovery and validity-period limits. Canonical: https://www.tenuvault.com/guides/back-up-intune-compliance-policy-settings Practical guide # Back up Intune compliance policy settings Back up Intune compliance policy settings by selecting the tenant-wide settings type under Compliance in TenuVault. These switches restore in place only and cannot be copied to another tenant. The validity period also has a restore safeguard, so review the proposed values before confirming. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Which tenant-wide compliance switches are included? TenuVault captures Mark devices with no compliance policy assigned as and Compliance status validity period (days), plus the switches for scheduled actions for noncompliance and enhanced jailbreak detection. There is one set per tenant, without assignments. The backup deliberately excludes unrelated tenant features returned alongside these settings, including log collection, Autopilot diagnostics, Android device administrator enrollment and derived credentials. This scope is narrower than a complete tenant settings export. Keep the change request specific about which values you intend to recover. ## Where can I record compliance policy settings in Intune? Microsoft exposes tenant-wide Compliance policy settings under Endpoint security > Device compliance. These settings include how devices without an assigned compliance policy are treated and the compliance status validity period. They are distinct from the platform-specific compliance policies assigned to groups. Record the tenant-wide values directly in Intune before changing them. Exporting an individual Windows or mobile compliance policy does not establish a recovery record for these shared switches. - [Microsoft: manage this configuration](https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started) - [Compare Intune policy export formats](https://www.tenuvault.com/guides/export-intune-policies) ## How do I back up Intune compliance policy settings? Treat these switches as a tenant-wide change rather than another group-targeted compliance profile. Before capturing them, record which devices lack an assigned policy and whether an access rule depends on their compliance result. 1. In a Custom backup, select Compliance policy settings under Compliance, rather than selecting only the platform-specific policies. 2. Save the switches before editing the unassigned-device treatment or compliance status validity period. 3. In Backup Details, examine the Compliance area for the tenant-wide settings entry. Compare its saved values with the compliance change request. 4. Preview Replace in place for that singleton and inspect each differing value. If the stored validity period is zero or outside the supported range, document the live value that recovery will retain. - [Prepare and verify your first Intune backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Review Intune backup scope and storage](https://www.tenuvault.com/intune-backup) ## Can I restore the tenant-wide compliance validity period? Choose Replace in place on Pro or MSP. This singleton cannot be restored as a copy, and cross-tenant copying is blocked. The restore writes only the supported settings that differ from the current tenant. There is no unassigned duplicate on which to test these switches. If the backup records a compliance status validity period of 0, meaning never set, or a value outside 1 to 120 days, TenuVault leaves the tenant value unchanged and explains that in the review. Do not describe that result as a full rollback of every saved field. Check the actual value that remains in Intune. - [Review restore modes and plan requirements](https://www.tenuvault.com/intune-restore) ## How do I rehearse compliance-switch recovery safely? Review the current values against the saved values before authorizing a live replacement. Capture the current state first, since the restore itself does not preserve overwritten versions. Rehearse in a test tenant with its own backup rather than trying to copy the source singleton. Check the final switches in Intune and document any validity-period value left unchanged. If you use compliance with Conditional Access, review the access implications as part of the change process. Conditional Access policies themselves belong to a separate opt-in backup scope, covered in the linked guide. Download TenuVault and capture compliance settings in a test tenant that has its own reviewed access configuration. Rehearse a supported in-place change there, then verify the switches in Intune. On your production tenant, use the saved review to plan a deliberate replacement because an unassigned copy is unavailable. - [Download TenuVault for Windows or macOS](https://www.tenuvault.com/download) - [Plan an Intune restore drill](https://www.tenuvault.com/guides/intune-restore-drill) - [Back up Conditional Access separately](https://www.tenuvault.com/guides/backup-conditional-access-policies) ## Read the technical guides - [Backup coverage by object type](https://docs.tenuvault.com/backups/coverage/) - [Restore modes and assignments](https://docs.tenuvault.com/restore/modes/) - [Restore limitations and incomplete results](https://docs.tenuvault.com/restore/limitations/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does a compliance policy backup include these switches? A: Select Compliance policy settings explicitly. It is a separate type from Compliance policies and Settings catalog compliance policies. ### Q: Can I restore an unassigned copy for testing? A: No. These settings are tenant-wide and only support replacement in place. Use a test tenant and its own backup for a rehearsal. ### Q: Why was the saved validity period not restored? A: TenuVault does not write a saved value of 0 or one outside 1 to 120 days. The live tenant keeps its value, and the review explains the omission. ## Related guides - [back up Intune policies](https://www.tenuvault.com/intune-backup) - [Back up Intune endpoint security policies](https://www.tenuvault.com/guides/back-up-intune-endpoint-security-policies) - [Back up Intune OMA-URI profiles](https://www.tenuvault.com/guides/back-up-intune-oma-uri-profiles) - [Back up Intune scope tags and roles](https://www.tenuvault.com/guides/back-up-intune-scope-tags-and-roles) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)