How to Make an Automatic Backup of Microsoft Intune?

In an increasingly digitisation-driven world, managing corporate devices and applications has become a key priority for many organisations. Microsoft Intune has established itself as a powerful tool for managing mobile and desktop devices, simplifying the work of IT administrators and ensuring the security of corporate data. However, it is essential to understand the importance of regularly backing up data on Intune so that configurations and profiles can be easily restored in the event of analysis, data loss or migration needs.

In this article, we will explore the process of backing up Microsoft Intune and automating it with a task scheduler to ensure data security.

WARNING: This guide is provided for information purposes only and does not guarantee the completeness, accuracy or validity of the information provided. You are responsible for your own actions and decisions based on the information contained in this article. Before implementing any backup solution or changing the configuration of Intune, it is recommended that you consult Microsoft’s official guidelines and carefully consider the implications for your organisation. Use of the tools and procedures described in this guide is at your own risk. We are not liable for any damage or loss resulting from the use or interpretation of the information contained herein.

 

Why Make a Backup of Microsoft Intune?

Before going into the details of the backup process, it is important to understand the importance of this practice. Here are some key reasons why it is essential to back up Microsoft Intune on a regular basis:

1. Data Protection: Company data on Intune is vital and may include sensitive information. Making regular backups helps protect this data from accidental loss or damage.
2. Quick Restore: In the event of data loss or system failure, having a backup allows you to quickly restore configurations and profiles without having to recreate them from scratch.
3. Regulatory Compliance: Many regulations and industry standards require secure storage of corporate data. Backing up Intune can help meet these regulatory requirements.

 

Depositing the Backup on a Windows Server

A key consideration when planning a backup is the choice of location for storing backup data. For this guide, a Windows server will be used. It is necessary to ensure that the server has adequate storage space to hold all Microsoft Intune backup data. In addition, it is important to verify that the server is appropriately configured to allow access to Microsoft Intune’s infrastructure.

 

Using a Certificate for Intune Backup

To ensure data security during the backup process, it is advisable to use a certificate. An SSL (Secure Sockets Layer) certificate can encrypt data during transfer, preventing unauthorised third parties from accessing it.

ATTENTION: For this guide we will use a Self-Signed certificate, you are free to choose the one you consider most secure for your working environment.

 

Requirements

1. Microsoft 365 Subscription (With Admin Right)
2. Windows Server 2016 and later (With Admin Right)
3. Powershell 7

 

1. Acquisition of the Certificate

First of all, a valid SSL certificate must be acquired from a reputable certificate authority.

For this guide we will create an adhoc one with the help of this script: Create-SelfSignedCertificate.ps1

On the Windows Server, download the script.

Open a powershell as administrator, locate the share where the script is located and run the following command:

.\Create-SelfSignedCertificate.ps1 -CommonName "MyCert" -StartDate 2015-11-21 -EndDate 2017-11-21

Changing the name of the certificate and the start and end date.

The certificate will automatically be exported to the folder where the script is located.

2. Creating an Azure app registration

Go to https:\\entra.microsoft.com and go to App Registration

Click on New Registration

 

Fill in the name and press Register

 

Once the application has been created, please note that in the Overview screen, Application ID and Tenat ID will be needed later.

Go to the Certificates & Secrets section.

Upload the previously created certificate (Public Part)

 

Go to the API Permissions section and grant permissions as follows

 

3. Importing the Certificate on the Server

Go to the Windows server where you want to deposit the backup

Press the start key, launch run.exe and type certmgr.msc

Right-click on Personal, all tasks and click on Import

 

Click Next

 

Click Browse

Importing the private key

Click Next

 

Enter the certificate password

 

Place it in the Personal folder

 

Click Finish

 

 Now in Trusted Root Certification Authorities, right click, All Task, Import

Click Next

Click Browse

Import the .cer

Click Next

Click Next

Click Finish

4. Importing Modules

The following three modules will be needed to run the backup script:

• Microsoft.Graph
• Microsoft.Graph.Intune
• IntuneBackupAndRestore

Attention: the Powershell modules required for the script to function may change over time due to possible updates by Microsoft.

To install the modules, open Powershell and run the following script with administrative rights

#Checking for correct modules and installing them if needed
$InstalledModules = Get-InstalledModule
$Module_Name = "Microsoft.Graph"
If ($InstalledModules.name -notcontains $Module_Name) {
 Write-Host "Installing module $Module_Name"
 Install-Module $Module_Name -Verbose -Force -AllowClobber
}
Else {
 Write-Host "$Module_Name Module already installed"
} 

#Checking for correct modules and installing them if needed
$InstalledModules = Get-InstalledModule
$Module_Name = "Microsoft.Graph.Intune"
if ($InstalledModules.name -notcontains $Module_Name) {
 Write-Host "Installing module $Module_Name"
 Install-Module $Module_Name -Verbose -Force -AllowClobber
}
else {
 Write-Host "$Module_Name Module already installed"
} 

#Checking for correct modules and installing them if needed
$InstalledModules = Get-InstalledModule
$Module_Name = "IntuneBackupAndRestore"
if ($InstalledModules.name -notcontains $Module_Name) {
 Write-Host "Installing module $Module_Name"
 Install-Module $Module_Name -Verbose -Force -AllowClobber
}
else {
 Write-Host "$Module_Name Module already installed"
}

5. Modifying the Microsoft Graph Module

Navigate to the path $env:ProgramFiles\WindowsPowerShell\Modules\Microsoft.Graph.Intune if the modules were installed as AllUsers or to $HOME\Documents\WindowsPowerShell\Modules\Microsoft.Graph.Intune if the modules were installed as CurrentUser.

In the folder, rename the folder 6.1907.1.0 to 6.1907.1.0_old.

Download the following module:

Extract the contents and copy the folder to the path of the previous module:

Rename the folder to 6.1907.1.0

6. Backup Script

The Script will perform the following operations:

• Import of previously installed modules
• Creation of the Folder C:\Scripts\Intune_Backup\Date
• Connection to Microsoft Graph
• Starting the Backup
• Removal of folders older than 30 days in the Backup folder
• Disconnection from Microsoft Graph

Please note: the Powershell modules required for the script to function may change over time due to possible updates by Microsoft.

#Importing Module
Write-Host "Importing Module Microsoft.Graph"
Import-Module Microsoft.Graph

#Importing Module
Write-Host "Importing Module Microsoft.Graph.Intune"
Import-Module Microsoft.Graph.Intune

#Importing Module
Write-Host "Importing Module IntuneBackupAndRestore"
Import-Module IntuneBackupAndRestore

# Create a new folder with date in the given path
$path = "C:\Scripts\Intune_Backup\$(get-date -f yyyy-MM-dd)"
if (!(Test-Path $Path)) {
     New-Item -Path $Path -Force -ItemType Directory
} else {
    Write-Host "Path $Path already exists"
}

# Connect to Microsoft Graph
$tenant = "xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$authority = "https://login.windows.net/$tenant"
$clientId = "xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$Thumbprint = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Update-MSGraphEnvironment -AppId $clientId -Quiet
Update-MSGraphEnvironment -AuthUrl $authority -Quiet
Connect-MSGraph -CertificateThumbprint $Thumbprint -Quiet

# Start Backup
Write-Host "Starting Intune Backup"
Start-IntuneBackup -Path $path

# REMOVE OLD FOLDER
$limit = (Get-Date).AddDays(-30)
$trashpath = "C:\Scripts\Intune_Backup"

# Delete files older than the $limit.
Get-ChildItem -Path $trashpath -Recurse -Force | Where-Object { !$_.PSIsContainer -and $_.CreationTime -lt $limit } | Remove-Item -Force

# Delete any empty directories left behind after deleting the old files.
Get-ChildItem -Path $trashpath -Recurse -Force | Where-Object { $_.PSIsContainer -and (Get-ChildItem -Path $_.FullName -Recurse -Force | Where-Object { !$_.PSIsContainer }) -eq $null } | Remove-Item -Force -Recurse

Variables should be compiled in this way:

$tenant: Enter the Tenant ID of the created app registration

$clientId: Enter the Client ID of the app registration created

$Thumbprint: Enter the Thumprint of the imported certificate

Save and rename the script as IntuneBackup.ps1.

7. Task Scheduler

Having copied the script onto the Windows server, we proceed to automate the backup process.

Create a task scheduler, the user executing the task must have administrative rights.

Set as in the following screen

Set a daily schedule at the desired time:

 Set the action by entering the following strings:

Program/script

“C:\Program Files\PowerShell\7\pwsh.exe”

Add arguments (optional)

-ExecutionPolicy ByPass -File “$FilePath\IntuneBackup.ps1”

8. Output

The backup will be extracted in the path C:\Scripts\Intune_Backup (Editable), within dated folders where there will be an output of this type:

Within each folder

Within each type you will find the files and configurations that are part of it.

Compare & Restore

#We need the path to the .json file

$Ref = "C:\Backup\IntuneBackup\Device Configurations\Microsoft Defender AntiiVirus.json"

$Diff = "C:\Backup\IntuneBackup1\Device Configurations\Microsoft Defender AntiiVirus.json"

#Compare two backup files for changes

Compare-IntuneBackupFile -ReferenceFilePath $Ref -DifferenceFilePath $Diff

Now we can see what changes have been made.

But what if you don’t know where a change was made? Then you can also compare two complete backups. This works as follows

#Compare all files in two backup directories for changes

Compare-IntuneBackupDirectories -ReferenceDirectory 'C:\Backup\IntuneBackup' -DifferenceDirectory 'C:\Backup\IntuneBackup1'

So how does recovery work? A first variant would be full recovery. For this you use two CMDLETs. The first CMDLET “Start-IntuneRestoreConfig” restores the configuration and the second CMDLET “Start-IntuneRestoreAssignments” restores the assignment.

#Restore Intune Configuration

Start-IntuneRestoreConfig -Percorso 'C:\Backup\IntuneBackup1'

#If you wish to restore assignments for Intune configurations

Start-IntuneRestoreAssignments -Percorso 'C:\Backup\IntuneBackup1'

IMPORTANT: Restoring configurations will not overwrite existing configurations, but will create new ones. Restoring assignments may overwrite existing assignments.

You can also restore individual policies (the policy must not exist in the MEM portal). But be careful, first create a copy (new folder) of your complete backup. Navigate to the new folder and remove anything you do not wish to restore.

In the Intune portal, I remove the ‘Microsoft Defender AntiiVirus’ configuration profile (and yes, I noticed earlier that I had misspelled the name).

#We will now restore the configuration first.

Invoke-IntuneRestoreDeviceConfiguration -Percorso 'C:\Backup\IntuneBackup2'

The configuration is restored, but you noticed, the allocation is not restored. This is where the second CMDLET comes in.

#Now the assignment is restored.

Invoke-IntuneRestoreDeviceConfigurationAssignment -Percorso 'C:\Backup\IntuneBackup2'

You can also restore administrative templates, app protection policies, client apps, etc. with additional CMDLET. For example:

Invoke-IntuneRestoreDeviceCompliancePolicy

Invoke-IntuneRestoreDeviceCompliancePolicyAssignment

Invoke-IntuneRestoreClientAppAssignment

Invoke-IntuneRestoreAppProtectionPolicy

Invoke-IntuneRestoreAppProtectionPolicyAssignment

With exactly the same preparations as shown in the example above.

 

Backup execution

Once the backup service has been configured with the SSL certificate, you can start the backup process. Be sure to schedule backups according to your organisation’s needs and keep a copy of your backup data in a safe and accessible location.

 

Monitoring & Maintenance

After setting up the backup, regularly monitor the status of backups to ensure that they are performed correctly. Perform regular restore tests to ensure that data can be recovered if necessary.

Conclusions

Regularly backing up Microsoft Intune is a key activity to ensure the protection of company data and business continuity. By using an SSL certificate to encrypt data during transfer, you can further strengthen the security of the backup process. Be sure to configure the backup service correctly and monitor it regularly to ensure optimal operation. With a proactive approach to backup management, you can effectively protect your company data and ensure peace of mind for your organisation.