Microsoft Entra ID: Restore Intune

Who can use this feature

Anyone with these permissions: Restore resources

Restoring Intune objects from a snapshot puts a deleted or overwritten policy, script, or app back the way it was, with its settings and the groups it was assigned to. Intune has no recycle bin, so without a snapshot, an object like that can only be rebuilt by hand.

This article explains how to restore Intune objects from a Microsoft Entra ID snapshot, how to bring a deleted group back with its Intune assignments, and how to finish the follow-up actions a restore leaves in Intune.

Restore Intune objects

You can browse a Microsoft Entra ID snapshot and start a restore from the SaaS inventory.

Before you start

Before you restore Intune objects, make sure:

The tenant is connected as a Microsoft Entra ID restore tenant with Include Intune checked, which lets Eon write Intune policies, scripts, and apps. For instructions, see Microsoft Entra ID: Connect Restore Tenants. For a restore tenant that’s already connected, update its permissions with Include Intune checked.
The snapshot you restore from backed up Intune. A snapshot taken without the Intune permissions on the source tenant shows a “Not backed up” notice in its Intune section instead of the objects.

Select the objects to restore

In the SaaS inventory, open the Microsoft Entra ID directory for your tenant, then select the snapshot you want to restore from.
Open the Intune section. Its lists follow the Intune admin center, under Devices, Apps, Endpoint security, and Tenant administration.
Select the objects you want to restore. To find a policy by a setting it configures, search for the setting’s name, such as bitlocker.

Objects Microsoft provides in every tenant, such as built-in scope tags and Intune roles, carry the tag Microsoft default and can’t be selected, because a restore never writes them. Intune role assignments don’t have a list of their own: open them from their role.
Click Restore. The Restore Entra ID entities dialog opens.

Review what else the restore writes

Select the Entra ID restore account to restore through. Eon selects it for you when the tenant has only one.
Read the Also affected list.
- Dependencies: The filters, scope tags, notification templates, compliance scripts, certificate profiles, apps, roles, and policy-set items your selection uses. Each one is restored only if it’s missing. One that still exists is left unchanged, even if it changed since the snapshot. To set it back too, add it to the selection.
- Groups: The groups the selected objects were assigned to in the snapshot. A group that was permanently deleted comes back with a new ID only when you restore it, and only the objects restored together with it are assigned to it again.
To add every listed object to the restore, click Add all.

Choose whether to restore assignments

To set each object’s assignments back to the snapshot’s, select Restore assignments. Groups assigned since the snapshot are removed.
To restore configuration without changing assignments, clear Restore assignments. A recreated object comes back unassigned, and one that still exists keeps the assignments it has now. A filter the object uses only through an assignment isn’t restored with it.

With Restore assignments selected, assigned policies, scripts, and apps take effect on devices as soon as Eon writes them.

Start the restore

To check what the restore would change before Eon writes anything, click Preview changes. The preview runs as a job that writes nothing to the tenant, and its restore report lists what would change. Preview changes is available only when the selection holds just Conditional Access and Intune objects, so remove any users, groups, and apps from the selection to preview it. The dialog closes and your selection stays in place. Once you’ve read the preview’s report, add back any users, groups, or apps you removed for the preview, then click Restore again and repeat the previous steps.
To restore, click Restore.

Eon starts a restore job and handles each selected object this way:

Objects that still exist: Eon updates each one to its snapshot configuration, writing only the settings that differ. The object’s note in the restore report names those settings.
Deleted objects: Eon recreates each one with a new ID, and rewrites the references other objects hold to it. Eon adds a marker to the copy’s description, so a later restore of the same object finds that copy and updates it instead of creating another one.
Assignments: With Restore assignments selected, Eon replaces each object’s assignments with the snapshot’s, and the note says which groups it added and removed.
Dependencies that changed: A dependency that still exists but differs from the snapshot is left unchanged, with a note saying what changed. To set it back, restore it with the rest of your selection.

For what each outcome looks like in the report, see Read the restore report. For the full list of what an Intune restore can and can’t bring back, see Restore support notes in Microsoft Entra ID Support.

Restore a deleted group with its Intune assignments

Intune removes a group’s assignments when the group is permanently deleted. Restoring the group together with the Intune objects that were assigned to it puts those assignments back on the recreated group. A group deleted only to the Microsoft Entra ID recycle bin keeps its Intune assignments.

In the snapshot, select the group under Directory → Groups, and the Intune objects that were assigned to it. The Also affected list in the Restore Entra ID entities dialog names those objects, and Add all adds them to the restore.
Select the Entra ID restore account, and make sure Restore assignments is selected.
Click Restore.

Eon recreates the group with a new ID and assigns the restored Intune objects to it. Preview changes isn’t available for this selection, because it includes a group.

When you restore the group without those objects, its entry in the restore report lists them under the follow-up action “Assign the restored group in Intune”. To finish, assign the group to them in Intune, or restore them with Restore assignments selected.

Finish the follow-up actions in Intune

Some of what an Intune object needs can’t be written back from a snapshot. The restore report lists each of these as a follow-up action on the object it belongs to:

Enter a secret value again in Intune: Secret values, such as custom OMA-URI setting values and a Wi-Fi profile’s pre-shared key, are withheld from the snapshot, so a recreated profile comes back without them. Enter the values in the profile in Intune.
Import the ADMX file again in Intune: A deleted imported ADMX file can’t be uploaded again from the snapshot. Import the ADMX and ADML files in Intune, then restore the administrative templates that use them.
Upload the app package again in Intune: Microsoft Graph never returns an app’s package, so the snapshot doesn’t hold it. Upload the package in Intune. The app’s assignments wait until a package is published.
Recreate the role assignment on its role: The role assignment now grants a different role than in the snapshot, and a restore doesn’t move a live assignment to another role. Delete the assignment in Intune, then restore it again to recreate it on its snapshot role.
Restore the group, then this object’s assignments: A group the object was assigned to was permanently deleted and wasn’t part of the restore. Restore the group, then restore the object with Restore assignments selected.
Restore again with assignments: A policy set’s items were left unchanged, because the set is assigned and changing them would take effect on its groups. To write them, restore the policy set again with Restore assignments selected.
Assign the restored group in Intune: A restored group’s Intune assignments are gone. Assign the group to the Intune objects listed, or restore them with Restore assignments selected.

The report also notes every recreated script. Devices run a script once per script ID, so a recreated script runs again on every device it’s assigned to.

For how follow-up actions are grouped in the report, see Read the restore report.