TenuVaultDesktopPractical guide
Intune backup vs Windows Backup for Organizations
Windows Backup for Organizations, now called Windows settings backup and restore, backs up a user's Windows settings and Microsoft Store app list so they can be restored on a new device. An Intune configuration backup saves your tenant's policies, profiles, scripts and assignments, and apps when you include them, so administrators can recover them. They protect different things, so an organization that wants both device settings and tenant configuration recoverable needs both.
At a glance
- Microsoft renamed Windows Backup for Organizations to Windows settings backup and restore.
- It backs up Windows settings and the list of installed Microsoft Store apps, not Intune configuration.
- Apps themselves are not backed up, and Microsoft recommends OneDrive for user data.
- It needs a settings catalog policy that turns on Enable Windows backup, plus the tenant-wide Windows Backup and Restore enrollment setting that shows the restore page on Microsoft Entra joined devices.
- An Intune configuration backup protects administrator configuration such as policies, scripts and assignments.
Two features with similar names
The word backup covers very different jobs in Microsoft 365. Windows settings backup and restore protects the end user's experience on a device. An Intune configuration backup protects the administrator's work in the tenant. Confusing them leads to a gap: a tenant can have settings backup turned on for every device and still have no way to bring back a deleted compliance policy.
Microsoft introduced the feature as Windows Backup for Organizations. It entered public preview in Intune in August 2025 and became generally available in November 2025. Microsoft Learn now calls it Windows settings backup and restore, and states that starting with Windows 11, version 26H2, Windows settings backup will be enabled by default for eligible devices.
Side by side comparison
The table compares the two using Microsoft's documentation for Windows settings backup and restore and TenuVault's documentation for the Intune side. Where Microsoft's pages do not state a detail, the table says so.
| Windows settings backup and restore | Intune configuration backup (TenuVault) | |
|---|---|---|
| What it protects | Windows settings and the list of installed Microsoft Store apps for a user | Intune configuration: 39 object types including policies, profiles, scripts and assignments; scheduled backups default to everything except apps, and apps are included when you choose them |
| What it does not protect | Apps themselves, user files and Intune configuration; it is not a full system image | Devices, user data, app installer files, certificates with private keys and Apple tokens |
| When restore happens | On a Microsoft Entra joined device during enrollment | When an administrator restores items to the tenant |
| Who controls it | Administrators: a settings catalog policy with Enable Windows backup, and the tenant-wide Windows Backup and Restore enrollment setting | Intune administrators, through their own delegated sign-in |
| Where data lives | Not stated on the Microsoft pages cited here | Encrypted on the admin's device, or in your own Azure storage account on Pro and MSP |
| Licensing | Not stated on the Microsoft pages cited here; check current prerequisites on Microsoft Learn | Community free for one tenant; Pro covers two tenants; MSP covers more |
| Who it is for | Organizations replacing or resetting Windows devices | Intune administrators and MSPs who need to recover or copy configuration |
What Windows settings backup and restore does
Microsoft describes the feature as a way to streamline device transitions by preserving user settings and Microsoft Store app configurations. Its FAQ is explicit about scope: it backs up and restores Windows settings and the list of installed Microsoft Store apps only, and Microsoft recommends OneDrive to back up user data.
The Intune side has two parts. Microsoft's Intune page says you turn on the Enable Windows backup setting in a settings catalog policy, and set Show restore page to On under Devices > Enrollment > Windows Backup and Restore. The restore setting is tenant-wide and applies on Microsoft Entra joined devices during enrollment. The settings catalog notes that apps are not backed up or restored, and Intune's What's new entry describes it as restoring the user experience settings and configuration preferences, not a full system image.
In practice, it shortens the time it takes a user to feel at home on a replacement laptop. It does nothing for the policies that configured that laptop.
What an Intune configuration backup does
Intune itself has no native backup, recycle bin or version history for policies. An Intune configuration backup reads your tenant through Microsoft Graph and saves each object with its settings and, where Intune has them, its assignments, so you can restore a deleted policy, roll back a bad change or copy configuration to another tenant.
TenuVault backs up 39 Intune object types in nine areas, from settings catalog and compliance policies to scripts, remediations, update profiles, app protection, enrollment configurations, scope tags and Intune roles. Community restores one item at a time as an unassigned copy. Pro and MSP add replace in place, assignment restore and daily schedules, and MSP adds copies to other tenants.
It is not a device backup. Enrolled devices, their files and app installer binaries are outside its scope, which is exactly the territory where Windows settings backup and restore and OneDrive operate.
Setting up each one
Windows settings backup and restore is configured in Intune in two places: a settings catalog policy that turns on Enable Windows backup, and the tenant-wide Windows Backup and Restore enrollment setting that shows the restore page on Microsoft Entra joined devices during enrollment. Read Microsoft's prerequisites for supported Windows versions before you rely on it, and test it by enrolling a replacement device for a pilot user.
An Intune configuration backup needs an app registration or service identity with read access to Intune, a storage location you control and a schedule someone monitors. With TenuVault, you run the setup script for the app registration, choose encrypted local storage or, on Pro and MSP, your own Azure storage account, save the recovery key separately, and run and review a first backup. Then restore a test policy as a copy to prove the backup is usable.
Questions to ask when someone says we have backup
When a project plan or audit answer says the organization has backup, ask which of these it actually covers. The answers usually reveal which feature is meant and which gap remains.
- If an administrator deletes a compliance policy today, how do we get it back, and with which assignments?
- If a user's laptop is replaced, which settings and apps follow them, and where do their files come from?
- How long is each backup kept, and who can read it?
- When did we last restore something from it, and what did we record?
- Does it cover macOS, iOS and Android configuration as well as Windows?
Do you need both?
If you need to recover both, yes, because they fail in different incidents. A lost laptop is a Windows settings and OneDrive problem. A deleted compliance policy, an overwritten security baseline or a tenant migration is an Intune configuration problem. Neither feature covers the other's incident.
A third feature adds to the confusion. Microsoft Entra Backup and Recovery backs up Entra objects such as users, groups, applications and Conditional Access policies, keeps up to five days of history, and lists no Intune objects. Together the three cover the device experience, identity, and Intune configuration, with OneDrive covering user files.
- Device replaced or reset: Windows settings backup and restore, plus OneDrive for files.
- Entra user, group or Conditional Access policy deleted: Entra soft delete or Entra Backup and Recovery.
- Intune policy deleted or changed: an Intune configuration backup.
- Configuration needed in another tenant: an Intune configuration backup with cross-tenant copy.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is Windows Backup for Organizations the same as Windows settings backup and restore?+
Yes. Microsoft renamed Windows Backup for Organizations to Windows settings backup and restore. The feature backs up Windows settings and the list of installed Microsoft Store apps.
Does Windows Backup for Organizations back up Intune policies?+
No. It backs up Windows user settings and the Microsoft Store app list on devices. It does not back up Intune policies, profiles, scripts, apps or assignments.
Does Windows settings backup and restore back up apps or files?+
No. Microsoft states that apps are not backed up or restored, only the list of Microsoft Store apps, and recommends OneDrive for user data.
When does Windows settings backup and restore apply settings?+
During enrollment of a Microsoft Entra joined device. It needs a settings catalog policy that turns on Enable Windows backup and the tenant-wide Windows Backup and Restore enrollment setting with the restore page turned on. Microsoft states that starting with Windows 11, version 26H2, Windows settings backup will be enabled by default for eligible devices.
Do I still need an Intune backup if I use Windows settings backup?+
Yes, if you want to recover Intune configuration. Intune has no native backup or recycle bin for policies, and Windows settings backup and restore does not cover them.