# Back up Intune OMA-URI profiles | TenuVault Back up Intune OMA-URI profiles with TenuVault. See how encrypted values are captured, where secrets are readable and when masked values block restoration. Canonical: https://www.tenuvault.com/guides/back-up-intune-oma-uri-profiles Practical guide # Back up Intune OMA-URI profiles Back up Intune OMA-URI profiles with TenuVault by selecting Device configuration profiles. Secret values returned by Microsoft are retained so a restore can put them back. A backup containing masked values cannot restore that profile, so verify secret capture before relying on it. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## What happens to OMA-URI secrets in a backup? TenuVault backs up custom OMA-URI profiles as device configuration profiles, including their assignments. The handling of encrypted values is part of the backup, rather than a promise that every secret can always be retrieved. Backups on this device encrypt the saved files. Current Azure backups are readable JSON protected by Azure encryption at rest and storage access controls. Secret OMA-URI values in those files are readable to anyone who can read the container. Downloaded backup ZIP files are also unencrypted. ## Can I export custom OMA-URI settings from Intune? In Intune, a custom profile contains the OMA-URI paths, data types and values you configure. The custom settings page can export the added values as a CSV list. Keep that export for review, while checking separately whether your recovery copy holds usable secrets. A list of paths without usable values is insufficient for recovery. Record what each entry does and where the original secret can be obtained. Do not treat an encrypted field shown by the service as proof that a readable value has been captured in your backup. - [Microsoft: manage this configuration](https://learn.microsoft.com/en-us/intune/device-configuration/templates/configure-custom-settings-windows) - [Compare Intune policy export formats](https://www.tenuvault.com/guides/export-intune-policies) ## How do I back up Intune OMA-URI profiles? Choose the backup location before collecting a custom profile that contains credentials. A successful copy of its paths is insufficient if a required value remains masked, and a readable secret needs controlled storage throughout the recovery process. 1. In the Custom backup picker, include Device configuration profiles for the Windows custom policies you need. 2. Capture an OMA-URI profile manually with your administrator sign-in when validating whether its encrypted values can be returned. 3. Inspect profile-specific failures and masked-value warnings after the run. A refused secret read needs investigation even when other configuration was saved. 4. Locate the custom profile within Device configuration in Backup Details, then review its restore eligibility. Keep the newest usable secret-bearing snapshot until another verified capture replaces it. - [Prepare and verify your first Intune backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Review Intune backup scope and storage](https://www.tenuvault.com/intune-backup) ## Why can masked OMA-URI values block a restore? When Microsoft returns the value, the backup retains it in plain text within the saved configuration, protected according to the chosen storage location. A scheduled Backup Reader or cloud backup stores a refused value as \*\*\*\* and marks the profile not restorable. A manual backup fails for that profile if the secret read is refused. Do not restore a masked snapshot or substitute the mask as a real value. Run a fresh manual backup when the service can return the secret, then verify that result. Retention keeps the newest backup with the readable values. Use Create copies without assignments for inspection; replace in place and restoring assignments require Pro or MSP. - [Review restore modes and plan requirements](https://www.tenuvault.com/intune-restore) ## How do I check secret recovery without exposing credentials? Inspect the backup outcome and restore readiness without pasting secret values into a ticket, screenshot or public report. If the profile is blocked, retain the source secret through your normal credential process and investigate the failed read before the production change. A copy test should compare paths, value types and configured values in a controlled environment. Keep it unassigned until you have reviewed its targeting. Protect exported archives as carefully as the original configuration, since storage encryption does not make a downloaded ZIP encrypted. Try the custom-profile workflow in your tenant with a nonproduction credential first. Download TenuVault, save that OMA-URI profile and confirm whether recovery is allowed. Record only the capture outcome and storage access controls, leaving secret values out of tickets and screenshots. - [Download TenuVault for Windows or macOS](https://www.tenuvault.com/download) - [Plan an Intune restore drill](https://www.tenuvault.com/guides/intune-restore-drill) - [Back up Conditional Access separately](https://www.tenuvault.com/guides/backup-conditional-access-policies) ## Read the technical guides - [Backup coverage by object type](https://docs.tenuvault.com/backups/coverage/) - [Restore modes and assignments](https://docs.tenuvault.com/restore/modes/) - [Restore limitations and incomplete results](https://docs.tenuvault.com/restore/limitations/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Are encrypted OMA-URI values backed up? A: Yes, when Microsoft returns them. TenuVault keeps their readable values so restoration can write them back. A masked value is not a recoverable secret. ### Q: Are Azure backup files encrypted by TenuVault? A: Current Azure backups are plain JSON. Azure encrypts storage at rest, while storage roles decide who can read the secret values. ### Q: What happens if a scheduled backup cannot read a secret? A: It stores \*\*\*\*, records a warning and blocks restoration of that profile from the affected backup. Try a manual backup with your sign-in and verify its result. ## Related guides - [Intune backup tool](https://www.tenuvault.com/intune-backup) - [Back up Intune scope tags and roles](https://www.tenuvault.com/guides/back-up-intune-scope-tags-and-roles) - [Back up Intune update rings](https://www.tenuvault.com/guides/back-up-intune-update-rings) - [Back up Conditional Access policies](https://www.tenuvault.com/guides/backup-conditional-access-policies) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)