> This page is for Data Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # Microsoft Entra ID: Restore Intune Restoring Intune objects from a snapshot puts a deleted or overwritten policy, script, or app back the way it was, with its settings and the groups it was assigned to. Intune has no recycle bin, so without a snapshot, an object like that can only be rebuilt by hand. This article explains how to restore Intune objects from a Microsoft Entra ID snapshot, how to bring a deleted group back with its Intune assignments, and how to finish the follow-up actions a restore leaves in Intune. ## Restore Intune objects You can browse a Microsoft Entra ID snapshot and start a restore from the SaaS inventory . #### Before you start Before you restore Intune objects, make sure: * The tenant is connected as a Microsoft Entra ID restore tenant with **Include Intune** checked, which lets Eon write Intune policies, scripts, and apps. For instructions, see [Microsoft Entra ID: Connect Restore Tenants]. For a restore tenant that's already connected, [update its permissions] with **Include Intune** checked. * The snapshot you restore from backed up Intune. A snapshot taken without the Intune permissions on the source tenant shows a "Not backed up" notice in its **Intune** section instead of the objects. #### Select the objects to restore 1. In the SaaS inventory , open the Microsoft Entra ID directory for your tenant, then select the snapshot you want to restore from. 2. Open the **Intune** section. Its lists follow the Intune admin center, under **Devices**, **Apps**, **Endpoint security**, and **Tenant administration**. 3. Select the objects you want to restore. To find a policy by a setting it configures, search for the setting's name, such as `bitlocker`. Objects Microsoft provides in every tenant, such as built-in scope tags and Intune roles, carry the tag Microsoft default and can't be selected, because a restore never writes them. Intune role assignments don't have a list of their own: open them from their role. 4. Click **Restore**. The **Restore Entra ID entities** dialog opens. #### Review what else the restore writes 1. Select the **Entra ID restore account** to restore through. Eon selects it for you when the tenant has only one. 2. Read the **Also affected** list. * **Dependencies**: The filters, scope tags, notification templates, compliance scripts, certificate profiles, apps, roles, and policy-set items your selection uses. Each one is restored only if it's missing. One that still exists is left unchanged, even if it changed since the snapshot. To set it back too, add it to the selection. * **Groups**: The groups the selected objects were assigned to in the snapshot. A group that was permanently deleted comes back with a new ID only when you restore it, and only the objects restored together with it are assigned to it again. To add every listed object to the restore, click **Add all**. #### Choose whether to restore assignments * To set each object's assignments back to the snapshot's, select **Restore assignments**. Groups assigned since the snapshot are removed. * To restore configuration without changing assignments, clear **Restore assignments**. A recreated object comes back unassigned, and one that still exists keeps the assignments it has now. A filter the object uses only through an assignment isn't restored with it. > **Warning** > > With **Restore assignments** selected, assigned policies, scripts, and apps take effect on devices as soon as Eon writes them. #### Start the restore 1. To check what the restore would change before Eon writes anything, click **Preview changes**. The preview runs as a job that writes nothing to the tenant, and its restore report lists what would change. **Preview changes** is available only when the selection holds just Conditional Access and Intune objects, so remove any users, groups, and apps from the selection to preview it. The dialog closes and your selection stays in place. Once you've read the preview's report, add back any users, groups, or apps you removed for the preview, then click **Restore** again and repeat the previous steps. 2. To restore, click **Restore**. Eon starts a restore job and handles each selected object this way: * **Objects that still exist**: Eon updates each one to its snapshot configuration, writing only the settings that differ. The object's note in the restore report names those settings. * **Deleted objects**: Eon recreates each one with a new ID, and rewrites the references other objects hold to it. Eon adds a marker to the copy's description, so a later restore of the same object finds that copy and updates it instead of creating another one. * **Assignments**: With **Restore assignments** selected, Eon replaces each object's assignments with the snapshot's, and the note says which groups it added and removed. * **Dependencies that changed**: A dependency that still exists but differs from the snapshot is left unchanged, with a note saying what changed. To set it back, restore it with the rest of your selection. For what each outcome looks like in the report, see [Read the restore report]. For the full list of what an Intune restore can and can't bring back, see [Restore support notes] in *Microsoft Entra ID Support*. ## Restore a deleted group with its Intune assignments Intune removes a group's assignments when the group is permanently deleted. Restoring the group together with the Intune objects that were assigned to it puts those assignments back on the recreated group. A group deleted only to the Microsoft Entra ID recycle bin keeps its Intune assignments. 1. In the snapshot, select the group under **Directory** → **Groups**, and the Intune objects that were assigned to it. The **Also affected** list in the **Restore Entra ID entities** dialog names those objects, and **Add all** adds them to the restore. 2. Select the **Entra ID restore account**, and make sure **Restore assignments** is selected. 3. Click **Restore**. Eon recreates the group with a new ID and assigns the restored Intune objects to it. **Preview changes** isn't available for this selection, because it includes a group. When you restore the group without those objects, its entry in the restore report lists them under the follow-up action "Assign the restored group in Intune". To finish, assign the group to them in Intune, or restore them with **Restore assignments** selected. ## Finish the follow-up actions in Intune Some of what an Intune object needs can't be written back from a snapshot. The restore report lists each of these as a follow-up action on the object it belongs to: * **Enter a secret value again in Intune**: Secret values, such as custom OMA-URI setting values and a Wi-Fi profile's pre-shared key, are withheld from the snapshot, so a recreated profile comes back without them. Enter the values in the profile in Intune. * **Import the ADMX file again in Intune**: A deleted imported ADMX file can't be uploaded again from the snapshot. Import the ADMX and ADML files in Intune, then restore the administrative templates that use them. * **Upload the app package again in Intune**: Microsoft Graph never returns an app's package, so the snapshot doesn't hold it. Upload the package in Intune. The app's assignments wait until a package is published. * **Recreate the role assignment on its role**: The role assignment now grants a different role than in the snapshot, and a restore doesn't move a live assignment to another role. Delete the assignment in Intune, then restore it again to recreate it on its snapshot role. * **Restore the group, then this object's assignments**: A group the object was assigned to was permanently deleted and wasn't part of the restore. Restore the group, then restore the object with **Restore assignments** selected. * **Restore again with assignments**: A policy set's items were left unchanged, because the set is assigned and changing them would take effect on its groups. To write them, restore the policy set again with **Restore assignments** selected. * **Assign the restored group in Intune**: A restored group's Intune assignments are gone. Assign the group to the Intune objects listed, or restore them with **Restore assignments** selected. The report also notes every recreated script. Devices run a script once per script ID, so a recreated script runs again on every device it's assigned to. For how follow-up actions are grouped in the report, see [Read the restore report]. ## See also * [Microsoft Entra ID Support] * [Microsoft Entra ID: Restore Directory Objects] * [Microsoft Entra ID: Restore Conditional Access] * [Microsoft Entra ID: Connect Restore Tenants] [Microsoft Entra ID Support]: /data-protection/saas-workloads/microsoft-entra-id/microsoft-entra-id [Restore support notes]: /data-protection/saas-workloads/microsoft-entra-id/microsoft-entra-id#restore-support-notes [Microsoft Entra ID: Connect Restore Tenants]: /data-protection/saas-workloads/microsoft-entra-id/connections/connect-restore-tenants [update its permissions]: /data-protection/saas-workloads/microsoft-entra-id/connections/connect-restore-tenants#update-permissions [Microsoft Entra ID: Restore Directory Objects]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-directory-objects [Read the restore report]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-directory-objects#read-the-restore-report [Microsoft Entra ID: Restore Conditional Access]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-conditional-access