Export Intune policies

Choose a format for the job

A policy export is useful when you want to read settings, keep a review copy or recreate selected configuration elsewhere. Start by deciding whether you need one Windows Settings Catalog policy or a wider record that includes compliance, scripts, enrollment and tenant settings. The file extension alone does not tell you whether those areas are covered.

A readable JSON file and a restorable backup are also different things. Record the source tenant, capture time, policy type and assignments alongside the settings. If your export leaves a dependency out, having the policy JSON does not recreate that dependency when you need it.

Export a native Windows Settings Catalog policy

In the Intune admin center, find the Windows Settings Catalog policy you want to preserve. Open its context menu and choose Export JSON. Keep the result with a note identifying the tenant and the reason you captured it, especially before making a planned change.

This is a per-policy export, not a complete export of every kind of Intune configuration. A Settings Catalog JSON file is not the input format for every other policy type. If your task includes scripts, compliance policies or tenant settings, list those separately instead of assuming the native policy export contains them.

• Microsoft: Windows Settings Catalog export and import

Capture the selected scope with TenuVault

In TenuVault, select the tenant and open Backup & Restore. Choose Run Backup. The Back up dialog starts from the tenant's saved backup choice; check it before choosing Start backup. Everything except apps is the default when no choice has been saved, so a backup is not automatically an export of all app details.

Everything includes the supported Intune types. Custom lets you expand areas and select individual types. TenuVault covers 40 Intune object types, with assignments where Intune has them. These include Settings Catalog and device configuration policies, compliance, scripts and remediations, updates, enrollment and tenant administration. Conditional Access is a separate opt-in service.

• Inspect the completed result and the types left out because access was denied.
• Record the scope as well as the date, so a later reader knows what the archive can answer.
• Keep installer files, Apple tokens and private keys separately; they are not downloaded as part of the policy backup.

Download the readable archive

Open Backup History, select the saved backup in Backup Timeline and choose Download in Backup Details. The archive contains the saved object files, metadata.json and a tenuvault-manifest.json identifying the source tenant.

The download fails if a file cannot be read rather than returning a partial ZIP. It is refused before starting when the files total more than 32 MiB or there are more than 5000 files. For an oversized backup, restore from Backup Details or capture a smaller scope rather than changing archive files to get around validation.

The ZIP is plain JSON even when the stored backup is encrypted. Restrict access and decide where the readable archive belongs before downloading it. For the steps that recover PowerShell and remediation bodies from these files, use the separate content-focused guide.

• Download Intune PowerShell and remediation script content

Keep the source snapshots current

Saving occasional exports leaves gaps between captures. Community supports manual and weekly desktop backups. Pro and MSP add daily schedules and cloud backups through Azure Automation. A desktop schedule needs the computer awake and TenuVault running; choosing Azure storage alone does not move the runner into Azure.

The tenant's saved backup choice controls automatic backups. Save a scope that covers the configuration you intend to preserve, then check the first scheduled result. Download a dated ZIP when you need a readable archive; the schedule creates backup snapshots, not an automatic stream of ZIP downloads.

• Schedule and verify Intune backups
• Back up Intune to Azure storage

Before you rely on the export

Open the archive and identify a policy you expected it to contain. Check both its settings and the assignment record, then verify that the source backup can be opened in TenuVault. A successful download proves that the saved files were readable, not that every external dependency is ready for recovery.

• Keep the dated original archive unchanged and use copies for inspection.
• Store the recovery key separately from the computer that holds encrypted backups.
• Practice restoring an unassigned policy copy before you need the archive during an incident.