TenuVaultDesktopPractical guide
How to clean up unused and unassigned Intune policies
Intune tenants collect policies that no longer do anything: unassigned test copies, duplicates, policies that target deleted groups and settings Microsoft has deprecated. Cleaning up means finding them, confirming nobody needs them and removing or fixing them, with a backup first because Intune has no recycle bin. TenuVault's hygiene scan finds all of these from your latest backup on Pro and MSP, and never deletes anything itself.
At a glance
- An unassigned Intune policy applies to no device or user.
- Intune has no recycle bin for policies, so a policy deleted during cleanup is gone unless you have a backup.
- An assignment that targets a group that no longer exists, or names a missing assignment filter, silently stops doing what it was meant to do.
- TenuVault's hygiene scan reports unassigned policies, duplicate profiles, missing groups, filters and scope tags, conflicting settings and deprecated settings.
- The scan reads the latest complete backup and never changes or deletes a policy.
What to look for
These are the usual sources of clutter, from safest to remove to most in need of care.
- Unassigned policies: they apply to nobody. Many are old tests, but some are kept on purpose as templates or for an upcoming rollout.
- Duplicate profiles: identical configuration apart from name, description, assignments and scope tags. Keep one and move its assignments.
- Broken references: assignments to groups Microsoft Graph reports as not existing, assignment filters or scope tags that are gone. The policy looks assigned but may reach nobody, or more devices than intended.
- Deprecated settings: Settings Catalog settings Microsoft marks as deprecated or obsolete.
- Conflicting settings: the same setting with different values in policies that can reach the same devices.
Clean up without losing anything
Treat cleanup as a change like any other, with a backup, a small batch at a time and a way back.
- Take a full backup first. Intune has no recycle bin, so the backup is your only way back from a removal you regret.
- Check the Intune audit logs for when each candidate last changed and who owns it.
- Unassign before you delete, and wait a while. If nobody complains, delete; if something breaks, assign it again.
- Fix broken references by assigning the policy to the right group or filter, rather than deleting a policy that still has a purpose.
- Record the policies you keep on purpose, such as templates, so the next cleanup does not ask the same question.
Find candidates with TenuVault
In TenuVault, open Governance, Conflicts and hygiene, and click Scan latest backup. The scan reads the latest complete backup and checks whether referenced groups exist, then lists unassigned policies, duplicate profiles, missing groups, filters and scope tags, conflicting settings and deprecated settings. Filter the findings by rule, status or classification and export them as CSV or JSON for review.
Mark findings you keep on purpose as acknowledged or as a false positive with a reason. Reviews reopen automatically when the evidence changes. The scan never changes or deletes a policy; removals happen in Intune, after your review. Conflicts and hygiene is part of Pro and MSP, and backups that let you restore anything you removed are included on every plan.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is it safe to delete unassigned Intune policies?+
Usually, but not always. Unassigned policies apply to nobody, yet some are kept as templates or for a planned rollout. Back up first, confirm with the owner and delete in small batches, because Intune has no recycle bin.
How do I find Intune policies assigned to deleted groups?+
Check each assignment's group ID against Entra ID. TenuVault's hygiene scan does this for every policy in your latest backup and reports assignments to groups Microsoft Graph says no longer exist, plus missing assignment filters and scope tags.
Can I undo an Intune cleanup?+
Only from a backup. Take a full backup before cleaning up; with TenuVault you can restore a deleted policy as a copy on every plan, or recreate it under its original name with assignments on Pro and MSP.