Create an Intune test tenant

Where can I create an Intune test tenant?

Microsoft offers a 30-day Intune trial that creates a new tenant during signup. Choose a new account for this separate environment: signing in with an existing work or school account instead adds Intune to that subscription. The new account cannot be combined with your existing work or school account.

1. Follow Microsoft's Intune free trial signup and choose the username and onmicrosoft.com domain for the test organization. The initial onmicrosoft.com domain cannot be renamed or removed.
2. Add the payment method required for verification. Microsoft says the card is not charged unless you buy something.
3. Complete MFA setup when prompted. The account creating the subscription receives Global Administrator, which has more permissions than most Intune tasks need.
4. Open the Intune admin center and check Tenant administration. The MDM authority is set by default during trial creation and should show Microsoft Intune.

• Microsoft: sign up for the Intune free trial

Can I use a Microsoft 365 developer sandbox?

Eligible Developer Program members can request a Microsoft 365 E5 developer subscription with access to Intune. Eligibility includes qualifying Visual Studio Professional or Enterprise standard subscriptions, companies in ISV Success or eligible Microsoft partner program tiers, and companies with Premier or Unified Support contracts. A production subscription alone does not qualify you.

The developer subscription lasts up to 90 days, and Microsoft may require the tenant to be recreated every 90 days. It is for development and testing, not production workloads or long-term storage. Microsoft explicitly tells you to back up data and configuration outside the developer tenant. Linking a valid billing account is mandatory during sandbox setup.

• Microsoft: developer sandbox eligibility
• Microsoft: sandbox lifetime and external backups

Can I copy policies through the Intune admin center?

For Settings Catalog, Microsoft documents a JSON export and import route for an individual policy. Select the Windows Settings Catalog policy, then its context menu and Export JSON. To create a new policy from that file, choose Create > Import policy, select it and name the new policy. Repeat for each policy you need.

Duplicate creates a profile copy with the original setting configurations and scope tags, without assignments. Microsoft's Duplicate steps do not cover copying a profile to another tenant.

• Microsoft: Settings Catalog export, import and duplicate

How do I copy production policies into the test tenant?

TenuVault Pro includes two tenants, such as production and test. Sync on Pro works between those two licensed tenants in either direction; Community only previews Sync. Connect each tenant through Set up TenuVault, using Set up with Microsoft sign-in once per tenant to create its app registration. Setup requires Global Administrator, Cloud Application Administrator or Application Administrator.

1. Select production as the source and open Sync below Drift Detection. Choose Settings Catalog, Compliance, Endpoint security or Device configuration, then select up to 25 policies read live from production.
2. Choose the test tenant as the target. On Pro, the other tenant of your license is the available target.
3. Select Review N tenants to read the target without writing. Inspect Create, Update and Blocked outcomes; an unmatched source scope tag makes a new policy use Default.
4. Keep Back up first enabled and review the target backup settings. If that backup fails or omits a policy type being changed, Sync changes nothing in that target.
5. Choose Approve and sync to N tenants after reviewing the plan. Production remains read-only throughout this source-to-target copy.

• Check the two-tenant Pro plan
• Read the Sync workflow and rollback instructions

What still needs attention after the copy?

Sync leaves new policies unassigned and keeps existing target assignments unchanged. Masked secret values must be set again in the target. It deletes nothing there. A later sync updates the linked target policy rather than creating another copy; if that linked policy was deleted, the review reports its recreation.

For a way back, select Preview rollback and inspect the changes before creating a rollback change set for review. Rollback also backs up the target first and requires backup storage there.

• Plan testing before production changes

How do I refill a recreated developer tenant?

Keep configuration backups outside the sandbox, as Microsoft recommends. Removing an old tenant in TenuVault frees its license place and removes its automatic backup schedule, while existing backups stay in their storage location. Nothing in the removed tenant itself changes.

Connect the replacement sandbox, then repeat production-to-test Sync for the selected policies. Review its live target state again: new policies arrive without assignments, and masked values still need attention. When testing is complete, Dev to Prod can promote selected policies back to production, one way and on demand.

• Keep Intune configuration backed up
• Promote tested Intune policies to production

How can I try this on my tenant?

Download TenuVault, enter a Pro license key and connect your production and test tenants. Start with one Settings Catalog policy, inspect its test-target review, and approve the copy with Back up first enabled. Check the unassigned result before selecting more production policies.

• Download TenuVault for production-to-test Sync