TenuVaultDesktopTenuVault Desktop
Restore Intune policies with a reviewed plan
Restore Intune policies from a TenuVault configuration backup to recover a changed or deleted policy. Choose the items, review their supported restore mode and dependencies, and confirm the operation before TenuVault writes to Intune.
At a glance
- TenuVault restores Intune configuration from its own encrypted backups, either as new copies or by replacing supported items in place.
- Community restores one item at a time as an unassigned copy with a [Restored] name prefix; existing policies never change.
- Pro and MSP add multi-item restores, replace in place and assignment restore; replace in place recreates deleted items under their original names with new IDs.
- MSP copies selected items into other connected tenants; those copies keep their original names, get the Default scope tag and are never assigned.
- Installer files, Apple enrollment tokens and secret material that Microsoft Graph does not return cannot be restored from any configuration backup.
Create a copy for controlled review
Community restores one supported item at a time as a separate copy. Copies remain unassigned, so you can inspect the recovered settings before deciding whether to target devices.
A copy does not replace the existing policy. Compare names, settings and dependencies, then remove the test copy or assign it through your usual change process.
Replace supported configuration in place
Pro and MSP can restore several items and replace supported existing configuration. Items that still exist can be updated, deleted items can be recreated where the type supports it, and matching items can be skipped.
Assignment restoration is an explicit option with type-specific limits. Recreated items can receive new IDs. Review the restore plan, target groups and filters before confirming a write.
Recover into another tenant
MSP supports copying selected configuration to another connected tenant. Cross-tenant copies arrive unassigned with the Default scope tag. Copy dependencies such as scope tags and assignment filters in the same restore; reviewed mappings to existing target objects are available only for apps and app categories. Recreate group targeting in the target tenant.
Configuration copying is one part of a tenant migration. It does not migrate enrolled devices or guarantee that application binaries, certificates and other external dependencies are present in the destination.
Prepare for partial operations and external artifacts
Inspect recovery readiness before an incident. The report distinguishes configuration that can be recreated from manual steps and artifacts that require separate recovery.
If a restore only partly succeeds, review the operation results and created IDs before retrying. Resolve dependencies and ambiguous writes rather than treating an incomplete operation as a successful recovery.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
How do I restore an Intune policy with TenuVault?+
Open Backup History in TenuVault, pick a backup from before the problem and select Restore from this backup. Choose the Intune items, pick Create copies (all plans; Community restores one item at a time) or Replace in place (Pro and MSP), check the labels on the Review step and confirm. TenuVault then writes to Intune and shows a result for each item.
What is the difference between Create copies and Replace in place?+
Create copies adds each restored Intune item next to the current one with a [Restored] name prefix and never changes existing items. Replace in place puts changed items back to the backed-up version, recreates deleted items under their original name and skips items that already match. Replace in place requires TenuVault Pro or MSP.
Does TenuVault restore Intune assignments?+
On Pro and MSP, the Restore assignments option applies the groups and filters recorded in the backup. When replacing in place, assignments added since the backup are removed. When replacing in place, Windows Autopilot profiles, Apple user enrollment profiles, terms and conditions and Intune roles must be restored with assignments off and reconciled in Intune.
Is the overwritten version of an Intune policy kept?+
No. A TenuVault replace in place does not keep the version it overwrites. Run a backup of the current Intune state first if you may want that version back; the restore confirmation reminds you of this.
What happens if an Intune restore is interrupted?+
TenuVault records every restore write in an encrypted journal. If a response from Microsoft Graph is lost, the write is marked uncertain and an identical write is blocked until you check Intune and confirm whether it was applied, which prevents duplicate objects.