Back up Intune scope tags and roles

Which custom Intune roles and scope tags are saved?

TenuVault backs up custom Intune roles with their role assignments, including members and scopes. Scope tags are also a documented backup type with assignments. Built-in objects that Intune creates itself are skipped, so their absence from the backup is expected.

Capture scope tags alongside policies and custom roles that reference them. This is Intune administration configuration, not a promise to back up every Microsoft Entra directory role or recreate directory groups. Keep the inventory focused on the supported types and the references they require.

How do I record Intune RBAC permissions, members and scopes?

Microsoft Intune role-based access control separates permissions, role assignments and scope. Scope tags help organize which objects administrators can see. Review those relationships in Intune before changing delegated administration.

Keep a record of custom roles and their intended members alongside the relevant scope tags. A list of permission names does not capture who receives them or which scope applies. An access recovery procedure should include checking the current memberships, since an old backup may describe access that was deliberately revoked.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune scope tags and roles?

Establish the current authorized role memberships before preserving RBAC configuration. An older assignment may describe access that has since been withdrawn, so copying its membership list into a recovery ticket does not authorize reinstatement.

1. Choose Scope tags and Intune roles from Tenant administration in the Custom selection.
2. Include policies referencing those tags when your change also affects their visibility or dependency references.
3. Inspect Tenant administration in Backup Details for the expected custom role definitions and non-built-in tags. Compare the saved members and scopes with the access review.
4. Prepare Intune roles for replacement with Restore assignments disabled. Plan the manual assignment reconciliation separately from restoring definitions and tag references.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Why must in-place role assignments be reconciled manually?

Dependencies such as scope tags and Intune roles are restored before objects that reference them. Recreated dependencies receive new IDs, and later references in the same restore are updated. Select the related objects together when rebuilding supported configuration.

For Replace in place, turn Restore assignments off for Intune roles and reconcile their assignments in the admin center. TenuVault blocks assignment replacement for those roles when the option is on. A backup containing members and scopes does not mean existing role memberships can be automatically rolled back. Pro or MSP is required for replacement; review the plan table before choosing recovery mode.

• Review restore modes and plan requirements

How do I review administrative access after restoring RBAC?

Review custom role permissions and the intended scopes before a production operation. Check the memberships currently authorized by your access review, rather than reinstating everyone recorded in an older backup. Treat configuration recovery and access approval as separate checks in the same change record.

After recovery, verify policy scope tags and custom role assignments in Intune. Test visibility with the appropriate administrative account through your normal review procedure. Document which assignments you reconciled manually, and record any referenced groups or tags that were outside the restore selection. Keep the backup until those checks are complete.

Download TenuVault and rehearse preserving a custom role and its related scope tags in your tenant. Review the recovered permissions against the approved administrative responsibility, then reconcile membership through Intune. Keep a record of the authorized scope and the access checks performed after recovery.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately