# Back up Intune scope tags and roles | TenuVault Back up Intune scope tags and roles with TenuVault. Save custom RBAC settings, understand built-in exclusions and review role assignment restore limits. Canonical: https://www.tenuvault.com/guides/back-up-intune-scope-tags-and-roles Practical guide # Back up Intune scope tags and roles Back up Intune scope tags and roles under Tenant administration in TenuVault. Custom roles include role assignments, members and scopes; built-in roles and scope tags are skipped. In-place role assignment replacement is unsupported, so recovery needs a separate access review in Intune. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Which custom Intune roles and scope tags are saved? TenuVault backs up custom Intune roles with their role assignments, including members and scopes. Scope tags are also a documented backup type with assignments. Built-in objects that Intune creates itself are skipped, so their absence from the backup is expected. Capture scope tags alongside policies and custom roles that reference them. This is Intune administration configuration, not a promise to back up every Microsoft Entra directory role or recreate directory groups. Keep the inventory focused on the supported types and the references they require. ## How do I record Intune RBAC permissions, members and scopes? Microsoft Intune role-based access control separates permissions, role assignments and scope. Scope tags help organize which objects administrators can see. Review those relationships in Intune before changing delegated administration. Keep a record of custom roles and their intended members alongside the relevant scope tags. A list of permission names does not capture who receives them or which scope applies. An access recovery procedure should include checking the current memberships, since an old backup may describe access that was deliberately revoked. - [Microsoft: manage this configuration](https://learn.microsoft.com/en-us/intune/fundamentals/role-based-access-control/overview) - [Compare Intune policy export formats](https://www.tenuvault.com/guides/export-intune-policies) ## How do I back up Intune scope tags and roles? Establish the current authorized role memberships before preserving RBAC configuration. An older assignment may describe access that has since been withdrawn, so copying its membership list into a recovery ticket does not authorize reinstatement. 1. Choose Scope tags and Intune roles from Tenant administration in the Custom selection. 2. Include policies referencing those tags when your change also affects their visibility or dependency references. 3. Inspect Tenant administration in Backup Details for the expected custom role definitions and non-built-in tags. Compare the saved members and scopes with the access review. 4. Prepare Intune roles for replacement with Restore assignments disabled. Plan the manual assignment reconciliation separately from restoring definitions and tag references. - [Prepare and verify your first Intune backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Review Intune backup scope and storage](https://www.tenuvault.com/intune-backup) ## Why must in-place role assignments be reconciled manually? Dependencies such as scope tags and Intune roles are restored before objects that reference them. Recreated dependencies receive new IDs, and later references in the same restore are updated. Select the related objects together when rebuilding supported configuration. For Replace in place, turn Restore assignments off for Intune roles and reconcile their assignments in the admin center. TenuVault blocks assignment replacement for those roles when the option is on. A backup containing members and scopes does not mean existing role memberships can be automatically rolled back. Pro or MSP is required for replacement; review the plan table before choosing recovery mode. - [Review restore modes and plan requirements](https://www.tenuvault.com/intune-restore) ## How do I review administrative access after restoring RBAC? Review custom role permissions and the intended scopes before a production operation. Check the memberships currently authorized by your access review, rather than reinstating everyone recorded in an older backup. Treat configuration recovery and access approval as separate checks in the same change record. After recovery, verify policy scope tags and custom role assignments in Intune. Test visibility with the appropriate administrative account through your normal review procedure. Document which assignments you reconciled manually, and record any referenced groups or tags that were outside the restore selection. Keep the backup until those checks are complete. Download TenuVault and rehearse preserving a custom role and its related scope tags in your tenant. Review the recovered permissions against the approved administrative responsibility, then reconcile membership through Intune. Keep a record of the authorized scope and the access checks performed after recovery. - [Download TenuVault for Windows or macOS](https://www.tenuvault.com/download) - [Plan an Intune restore drill](https://www.tenuvault.com/guides/intune-restore-drill) - [Back up Conditional Access separately](https://www.tenuvault.com/guides/backup-conditional-access-policies) ## Read the technical guides - [Backup coverage by object type](https://docs.tenuvault.com/backups/coverage/) - [Restore modes and assignments](https://docs.tenuvault.com/restore/modes/) - [Restore limitations and incomplete results](https://docs.tenuvault.com/restore/limitations/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Are built-in Intune roles and tags backed up? A: No. Built-in roles and built-in scope tags are skipped because Intune provides them. Custom roles and non-built-in tags are included. ### Q: Are members and scopes included in a custom role backup? A: Yes. The coverage explicitly includes role assignments, members and scopes. In-place assignment replacement still requires manual reconciliation in Intune. ### Q: Can Restore assignments roll back an existing role assignment? A: No. Turn it off for in-place Intune role restoration and reconcile assignments in Intune. Review access that may have been revoked since the backup. ## Related guides - [Intune backup](https://www.tenuvault.com/intune-backup) - [Back up Intune update rings](https://www.tenuvault.com/guides/back-up-intune-update-rings) - [Back up Conditional Access policies](https://www.tenuvault.com/guides/backup-conditional-access-policies) - [Check Intune backup freshness](https://www.tenuvault.com/guides/check-intune-backup-freshness) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)