Intune disaster recovery plan: a checklist for configuration recovery

Checklist: before an incident

Work through these items for every tenant you protect, and record the owner of each one in your recovery plan.

• Schedule backups: weekly on Community, daily on Pro and MSP. Confirm that scheduled runs actually complete on the admin computer.
• Save the recovery key in a password manager or another secure store, separate from the admin computer.
• Keep backups off the admin device: an Azure storage account on Pro and MSP, or a network share for encrypted local backups.
• Keep an independent copy of important backups: download the backup as a ZIP export and store it somewhere a storage administrator for the backup location cannot delete. ZIP exports are plain JSON and not encrypted, so protect them; TenuVault can import them later with Import backup ZIP. Copying encrypted Azure backup files to another storage account does not work, because each file is bound to its storage account and path.
• Open a recent backup in the restore wizard and review Recovery readiness. Record the items that need manual work.
• Record where app installers and Apple tokens come from and who can renew them.
• Keep the app registration, Intune roles and storage permissions documented and usable by more than one administrator.
• Consider Intune Multi Admin Approval, which Microsoft describes as requiring "that a second administrative account approves a change before the change is applied".
• Run a restore drill with Create copies and record the result.

• Microsoft Learn: Multi Admin Approval
• Set up and verify a backup schedule

Checklist: during an incident

Restore only what you have reviewed. A fast restore of the wrong scope creates a second incident.

• Find the cause first. Intune audit logs show who changed what; Microsoft states that you can "use Graph API to get two years of audit events". Remove compromised or unintended access before restoring.
• Take a backup of the current state. Replace in place does not keep the versions it overwrites.
• Pick the last backup from before the problem. Use View Changes or drift detection to see what changed between backups.
• Select the affected items and restore their dependencies, such as scope tags, assignment filters and categories, in the same selection.
• On Pro and MSP, decide on Restore assignments, and restore Windows Autopilot profiles, Apple user enrollment profiles, terms and conditions and Intune roles in a separate selection with assignments off. On Community, restore unassigned copies one at a time and assign them in Intune.
• Check the labels on the Review step, confirm, and resolve incomplete objects and uncertain writes before retrying.

• Microsoft Learn: Intune audit logs
• Intune drift detection

Checklist: after an incident

Recovery is complete when configuration, assignments and external artifacts are back and the evidence is recorded, not when the restore wizard finishes.

• Complete external artifacts: upload app installers again and renew Apple tokens. For profiles whose backup holds a masked OMA-URI value, take a new backup while the profile still exists, or re-enter the secret in Intune.
• Validate recovered settings and assignments, and account for new object IDs created by recreated items.
• Review Intune role memberships so the restore did not reinstate access you revoked.
• Observe device behavior separately. Assigned policies reach devices at their next check-in.
• Run a fresh backup of the recovered state.
• Record the timeline, the backup used, original and created IDs and manual steps. Update the plan and schedule the next drill.

Recovery scenarios and recommended actions

Match the incident to a workflow before you start writing to Intune. Plan availability is enforced in the app.

• How TenuVault backs up Intune
• Restore Intune policies

Define the scope and recovery requirements

Inventory the Intune configuration you need to recover and the time and data-loss limits your organization expects. Map those requirements to backup frequency, retention and the people who can run recovery.

A configuration backup does not recover enrolled devices, endpoint files or every application artifact. Keep the coverage and limitations attached to the plan so the incident team knows what needs a separate procedure.

• Configuration backup coverage

Keep files, keys and access recoverable

Document where backups are stored and how an authorized administrator can retrieve them if the usual computer is lost. Store the recovery key separately and verify the documented import procedure on an approved device.

Keep a usable app registration, admin roles and storage permissions available. Licensing checks, Microsoft authentication and network availability have their own requirements; offline verification does not make live tenant operations offline.

• Encryption and recovery key
• Security and access model

Review dependencies and external artifacts

Use recovery readiness to identify items that can be restored automatically, missing mappings and manual actions. Record installers, certificates and tokens that Microsoft Graph cannot export and define their separate recovery source.

For another tenant, both tenants need MSP. Check licensing, copy scope tags and assignment filters as dependencies, map apps and app categories, and plan to recreate group targeting. Cross-tenant copies remain unassigned until reviewed; restoring configuration does not enroll or migrate devices.

• Cross-tenant recovery
• Manual artifacts and restore limits

Exercise the plan and retain evidence

Start with a small unassigned policy-copy drill. If production recovery relies on replacement or assignment restoration, exercise those modes separately in an approved test scope.

Retain timestamps, app version, backup status, original and created IDs, setting comparisons and manual steps. Use the measured outcome to revise the plan; do not treat an export count as proof of full recovery.

• Run the restore drill

Recover, reconcile and validate

During an incident, select a verified backup, review the recovery plan and restore only the approved scope. Reconcile partial writes before repeating an operation.

Validate recovered settings and assignments, account for new object IDs and complete the external-artifact procedures. Observe intended endpoint behavior separately, then document remaining gaps and the next recovery test.

• Understand restore modes