Back up Intune endpoint security policies

Where are Defender, BitLocker and firewall policies backed up?

A security workload name alone does not tell you where its policy is stored. TenuVault lists Settings catalog and endpoint security policies under Device configuration, while Security baselines and template profiles sit under Endpoint security. Both are documented backup types.

For a Defender, disk encryption or firewall change, identify the actual policies involved. Record their names, exclusions and intended pilot groups. Include reusable settings when a selected policy depends on them, rather than assuming the policy name contains everything needed for recovery.

Can I export Intune endpoint security settings?

Microsoft provides endpoint security policies for managing security configuration in Intune. You can inspect a policy in the admin center and document its settings and targeting before editing it.

That manual record is useful during review, but it is not a saved recovery point that TenuVault can restore. Keep the policy settings together with their assignment context. The general export guide explains the difference between a policy export and a backup archive.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune endpoint security policies?

Before adjusting antivirus rules, identify whether the profile uses Settings Catalog or an older security template. The same security workload can require two backup selections, so inventory the profile format along with its name.

1. From Run Backup, choose Custom and include the security profile formats present in your inventory.
2. For catalog-based profiles, select Settings catalog and endpoint security policies under Device configuration. Add Security baselines and template profiles under Endpoint security for legacy template-based profiles.
3. Capture the selected security objects before the rollout, checking Backup Progress for settings that could not be read.
4. In Backup Details, inspect Device configuration and Endpoint security against your Defender, BitLocker and firewall policy list. Verify reusable settings are present when the policy references them.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Can I restore endpoint security settings without changing targeting?

TenuVault can create separate copies or replace supported policies in place. An unassigned copy lets you inspect the saved settings before applying targeting. Replace in place puts a changed object back to the saved version; a deleted object is recreated with a new ID.

Community restores one unassigned copy at a time. Pro and MSP provide replace in place, multiple-item restore and Restore assignments. With assignment restore enabled, the saved groups and filters replace the current assignment set, including removing assignments added after the backup. Review that scope before confirming.

• Review restore modes and plan requirements

How do I test recovery of a Defender or firewall policy?

Start with one unassigned policy copy and compare the saved security settings with your change record. Check whether the policy refers to reusable settings or other objects. A successful object restore does not by itself show that every intended device has received the configuration.

For production recovery, review the complete assignment set separately from the setting values. Keep endpoint protection policy recovery separate from BitLocker recovery key retrieval: this guide covers policy configuration, and makes no promise to recover a device key or undo disk encryption.

Try a Defender recovery on your tenant: download TenuVault and preserve the antivirus profile before its next approved edit. Restore an unassigned copy for comparison, then record whether exclusions and reusable settings match your intended protection. Keep disk encryption key recovery in its own procedure.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately