# Back up Intune endpoint security policies | TenuVault Back up Intune endpoint security policies with TenuVault. Learn where Defender, BitLocker and firewall settings are saved and how restore assignments work. Canonical: https://www.tenuvault.com/guides/back-up-intune-endpoint-security-policies Practical guide # Back up Intune endpoint security policies Back up Intune endpoint security policies by capturing both Settings Catalog policies and template-based security profiles in TenuVault. The backup includes settings and assignments, but restoring assignments is a separate choice. Check both areas before changing Defender, BitLocker or firewall configuration. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Where are Defender, BitLocker and firewall policies backed up? A security workload name alone does not tell you where its policy is stored. TenuVault lists Settings catalog and endpoint security policies under Device configuration, while Security baselines and template profiles sit under Endpoint security. Both are documented backup types. For a Defender, disk encryption or firewall change, identify the actual policies involved. Record their names, exclusions and intended pilot groups. Include reusable settings when a selected policy depends on them, rather than assuming the policy name contains everything needed for recovery. ## Can I export Intune endpoint security settings? Microsoft provides endpoint security policies for managing security configuration in Intune. You can inspect a policy in the admin center and document its settings and targeting before editing it. That manual record is useful during review, but it is not a saved recovery point that TenuVault can restore. Keep the policy settings together with their assignment context. The general export guide explains the difference between a policy export and a backup archive. - [Microsoft: manage this configuration](https://learn.microsoft.com/intune/device-configuration/endpoint-security/manage-policies) - [Compare Intune policy export formats](https://www.tenuvault.com/guides/export-intune-policies) ## How do I back up Intune endpoint security policies? Before adjusting antivirus rules, identify whether the profile uses Settings Catalog or an older security template. The same security workload can require two backup selections, so inventory the profile format along with its name. 1. From Run Backup, choose Custom and include the security profile formats present in your inventory. 2. For catalog-based profiles, select Settings catalog and endpoint security policies under Device configuration. Add Security baselines and template profiles under Endpoint security for legacy template-based profiles. 3. Capture the selected security objects before the rollout, checking Backup Progress for settings that could not be read. 4. In Backup Details, inspect Device configuration and Endpoint security against your Defender, BitLocker and firewall policy list. Verify reusable settings are present when the policy references them. - [Prepare and verify your first Intune backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Review Intune backup scope and storage](https://www.tenuvault.com/intune-backup) ## Can I restore endpoint security settings without changing targeting? TenuVault can create separate copies or replace supported policies in place. An unassigned copy lets you inspect the saved settings before applying targeting. Replace in place puts a changed object back to the saved version; a deleted object is recreated with a new ID. Community restores one unassigned copy at a time. Pro and MSP provide replace in place, multiple-item restore and Restore assignments. With assignment restore enabled, the saved groups and filters replace the current assignment set, including removing assignments added after the backup. Review that scope before confirming. - [Review restore modes and plan requirements](https://www.tenuvault.com/intune-restore) ## How do I test recovery of a Defender or firewall policy? Start with one unassigned policy copy and compare the saved security settings with your change record. Check whether the policy refers to reusable settings or other objects. A successful object restore does not by itself show that every intended device has received the configuration. For production recovery, review the complete assignment set separately from the setting values. Keep endpoint protection policy recovery separate from BitLocker recovery key retrieval: this guide covers policy configuration, and makes no promise to recover a device key or undo disk encryption. Try a Defender recovery on your tenant: download TenuVault and preserve the antivirus profile before its next approved edit. Restore an unassigned copy for comparison, then record whether exclusions and reusable settings match your intended protection. Keep disk encryption key recovery in its own procedure. - [Download TenuVault for Windows or macOS](https://www.tenuvault.com/download) - [Plan an Intune restore drill](https://www.tenuvault.com/guides/intune-restore-drill) - [Back up Conditional Access separately](https://www.tenuvault.com/guides/backup-conditional-access-policies) ## Read the technical guides - [Backup coverage by object type](https://docs.tenuvault.com/backups/coverage/) - [Restore modes and assignments](https://docs.tenuvault.com/restore/modes/) - [Restore limitations and incomplete results](https://docs.tenuvault.com/restore/limitations/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Are Defender, BitLocker and firewall policies included? A: Their Intune policy configuration is covered through the documented Settings Catalog and template-based endpoint security types. Select the types actually used by your tenant. ### Q: Does restoring a policy immediately assign a copy? A: Copies are unassigned when Restore assignments is off. Assigned copies can reach the saved targets, so review the assignments before enabling that option. ### Q: Does this also back up Conditional Access? A: Conditional Access is a separate opt-in service. Follow the Conditional Access guide rather than assuming endpoint security selection includes it. ## Related guides - [back up Intune policies](https://www.tenuvault.com/intune-backup) - [Back up Intune OMA-URI profiles](https://www.tenuvault.com/guides/back-up-intune-oma-uri-profiles) - [Back up Intune scope tags and roles](https://www.tenuvault.com/guides/back-up-intune-scope-tags-and-roles) - [Back up Intune update rings](https://www.tenuvault.com/guides/back-up-intune-update-rings) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)