Backup and restore

MDO backs up Intune policies to a storage account in your own Azure subscription, as plain JSON files. Set up storage first: see Storage setup.

What a backup contains

Category	Folder
Device configuration profiles	DeviceConfigurations/
Compliance policies	CompliancePolicies/
Settings Catalog policies, including Endpoint security policies built on Settings Catalog	ConfigurationPolicies/
Endpoint security policies built from the older templates (intents)	EndpointSecurity/
App metadata	Apps/

Each policy is one JSON file, with its assignments and the group names alongside. A run finishes complete when every category was read in full. It finishes partial if any category hit an error or was cut short by Graph, and failed if nothing could be written. The run’s metadata.json lists any errors.

Running a backup

• On a schedule. Once backups are enabled in the Storage wizard (step 4), MDO runs them on the cron schedule you set, in UTC. The default is daily at 02:00 UTC.
• On demand. Open Audit › Restore and click Backup now. You need the Owner or Admin role and a connected storage account.

Before MDO changes an app’s commands, detection or package, or deletes it, it also backs that app up to the same storage account (see Editing an app).

Backup history

The Backups tab lists each run with its start time, status, policy count, duration, what triggered it and its folder name. Click a run to see the counts per category and the list of policy files, with the size of each.

Backup format

Each run writes a folder named backup-YYYY-MM-DD-HHmmss/ (UTC) to your container:

backup-2026-10-06-020001/
├── metadata.json
├── DeviceConfigurations/
├── CompliancePolicies/
├── ConfigurationPolicies/
├── EndpointSecurity/
└── Apps/

Backups older than the retention period you set (90 days by default) are deleted at the end of each run.

---

Restoring a policy

Restore needs the Owner or Admin role.

Find the policy

On the Backup page:

• Find a policy in your backups searches every run by policy name.
• Recently deleted lists policies that disappeared from Intune, from MDO’s drift records.
• Or open a run on the Backups tab and pick policies from it.

Nothing is preselected.

Choose how to restore

The restore wizard asks:

1. Assignments: settings and assignments, settings only, or settings with groups you choose. Groups are matched by name in the tenant.
2. Name: keep the policy’s name or give it a new one.
3. For a policy that still exists in Intune: Overwrite it, Restore as a new policy, or Leave as is.

The review step uses a live read from Intune, so it reflects what is there now, not the last collection.

What happens

• Restore as a new policy, and any restore of a deleted policy, creates a new policy with a new ID. Intune has no undelete. MDO records which policy it came from, and drift and policy history show the link.
• Overwrite keeps the existing policy and its ID.

When the restore finishes, the Restores tab shows the outcome for each policy, and MDO starts a sync so the restored policies appear straight away. A restore writes to Intune but doesn’t take a fresh backup first. It relies on the backups you already have.

---

Troubleshooting backups

A run finished as “failed”

1. Open Storage and check that the connection shows as connected.
2. Click Retest connection in step 4.
3. If the test fails, check that the storage app has Storage Blob Data Contributor on the storage account. See the troubleshooting table in Storage setup.

A run finished as “partial”

Open the run and read its errors. A missing Graph permission names the permission, and the fix is the re-consent in Troubleshooting. The categories without errors are complete.

Storage space

MDO doesn’t cap the size of your container. Check the storage account’s Monitoring › Metrics in Azure for usage.