# Encrypt Intune backups | TenuVault Encrypt Intune backups on a device or network share and save the recovery key. Learn why Azure JSON backups and exported ZIP files need other controls. Canonical: https://www.tenuvault.com/guides/encrypt-intune-backups Practical guide # Encrypt Intune backups Encrypt Intune backups by choosing This device, encrypted in TenuVault, including when the backup folder is on a network share. Save the recovery key separately so another computer can read the files after device loss. Azure backups are plain JSON protected by Azure encryption at rest and role assignments. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Does an Intune policy export protect its own content? A native Settings Catalog export gives you a JSON policy file. Treat that file as configuration data and decide where it can be stored and who can open it. Exporting a policy is a transfer step; your storage and access procedure determines how that separate file is protected. Choose protection according to the destination. A folder carried between admin devices has different recovery needs from shared Azure storage. Record both the backup location and the recovery method, so the person responding to an incident knows whether they need a recovery key or storage account access. - [Microsoft Learn: Settings Catalog policy export and import](https://learn.microsoft.com/en-us/intune/intune-service/configuration/settings-catalog) ## How do I encrypt Intune backups on a device? 1\. Choose This device, encrypted as the tenant's storage. TenuVault encrypts backup files with AES-256-GCM and protects the backup key with Windows DPAPI or the macOS Keychain. Local encrypted storage with a recovery key is included in Community Free and remains available on Pro and MSP. 2\. In Settings, open Storage and recovery and inspect Backups on this device. Use Change folder if you need a different local folder or network share. The files stay encrypted on a share. Changing the selected folder does not move existing backups, so plan any file move separately. 3\. Select Save recovery key and put the exported key in a secure store separate from the backup computer. Assign someone to maintain access to it. The operating system protects the on-device copy for that user account, which is why simply copying app data to another machine is not a recovery method. ## How do I verify recovery after device loss? 4\. On an authorized second machine, install TenuVault and point it at the encrypted backup folder. Open Settings, Storage and recovery, then Import a recovery key. Import the key from the installation that made the files. Verify that the expected tenant backups can be opened before relying on the handover. An imported key becomes the key for new device backups. Existing keys are retained so earlier backups remain readable. Record the key handover and keep the recovery store current after a change. Do not leave the only usable copy of the recovery key on the computer whose loss you are planning for. Without the recovery key, loss of the originating machine or user profile can leave the encrypted files unrecoverable. TenuVault cannot decrypt them for you. Include key access in a restore drill rather than treating a successful backup as proof that a replacement workstation can use it. ## Are Azure backups encrypted with my recovery key? No. Current Azure backups are uploaded as plain JSON over HTTPS. Azure Storage encrypts data at rest, and role assignments govern who can read or alter the files. Pro and MSP include backups in your own Azure storage account. No TenuVault recovery key is needed for these current Azure backups. Anyone with blob read access can read their content, including plain-text secret OMA-URI values saved for recovery. Anyone who can write backup content must be trusted like an Intune admin because a restore uses that content. Restrict data roles and follow the documented storage recovery protections. Older Azure backups encrypted by earlier TenuVault versions remain encrypted. On another computer they still need the original recovery key. New backups are plain JSON even when the computer also holds an old encryption key. Keep this distinction in the recovery record when your history includes both formats. ## What should I do with exported backup ZIP files? Backup ZIP exports are not encrypted. Protect the destination and access to those files separately. Do not assume that exporting from an encrypted local backup preserves the local encryption around the resulting ZIP. Review the intended recipient and storage location before sharing an export. Try it on your tenant by backing up one approved test policy to encrypted device storage, saving the recovery key and opening that backup from another authorized machine. Then complete the restore drill. Record both the readable backup and key recovery result before trusting the process. - [Plan recoverable Intune backups](https://www.tenuvault.com/intune-disaster-recovery) - [Configure backup storage](https://www.tenuvault.com/guides/intune-backup-setup) - [Practice a restore drill](https://www.tenuvault.com/guides/intune-restore-drill) - [Understand Azure backup storage](https://www.tenuvault.com/guides/intune-backup-to-azure-storage) - [Download TenuVault](https://www.tenuvault.com/download) - [Compare plans and features](https://www.tenuvault.com/pricing) ## Read the technical guides - [Encrypt Intune backups documentation](https://docs.tenuvault.com/security/encryption/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does a network share remove backup encryption? A: No. Backups using the device storage workflow remain encrypted when its folder is on a network share. ### Q: Can the recovery key protect current Azure JSON? A: No. Current Azure backups use Azure storage encryption and access controls. The device recovery key does not gate access to those JSON files. ### Q: Are downloaded backup ZIP files encrypted? A: No. Apply appropriate storage and sharing controls to exports separately. ## Related guides - [Intune backup tool](https://www.tenuvault.com/intune-backup) - [Export Intune policies](https://www.tenuvault.com/guides/export-intune-policies) - [Intune backup Graph permissions](https://www.tenuvault.com/guides/intune-backup-graph-permissions) - [Intune backup retention](https://www.tenuvault.com/guides/intune-backup-retention) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)