Microsoft Technical Takeoff: Windows and Microsoft Intune
Oct 24 2022 07:00 AM - Oct 27 2022 12:00 PM (PDT)

Automate (one example) a Microsoft Endpoint Manager (Intune) backup!



Dear Microsoft Intune Friends,


Before we start preparing, it is important for you to know that you have read the following article. In this article I explain how an Intune backup works. These preparations are important because this article builds on them.


Note: How to create a backup of your Microsoft Endpoint Manager (Intune) infrastructure!


I use an existing management system (Windows) as the platform for the following configuration example. I want to emphasize it again here, it is important that you have made the preparations (which are in the article above). For example, the Consent for the Intune management account is executed and also the PowerShell modules are installed. If all this is in place...Let us now start together.


I used the PowerShell ISE for this configuration. But you are also very welcome to use Visual Studio Code, just as you wish. Please start with the following steps to begin the deployment (the Hashtags are comments):


We need login information in the script. But we don't want to store this login information in plain text in the script. For this reason I create a file and put it in the directory C:\.


# Let's create the credential file
$credential = Get-Credential
$credential.Password | ConvertFrom-SecureString | Set-Content c:\encrypted_password.txt


Please create a PowerShell script file (for example: IntuneBackup.ps1) with the following content (between the equal signs). Save it on the C:\ drive. For the variable, replace the username with your Intune management account (which made the Consent).

$User = ""

$encrypted = Get-Content c:\encrypted_password.txt | ConvertTo-SecureString
$credential = New-Object System.Management.Automation.PsCredential($User, $encrypted)

#Populate Variables
$FilePath = "C:\Backup"

#Create New Folder According to date
$BackupFolder = New-Item -ItemType Directory -Path "C:\Backup\$((Get-Date).ToString('yyyy-MM-dd'))"

#Connect to Graph API to Backup Intune
Connect-MSGraph -credential $Credential

#Start Intune Backup
Start-IntuneBackup -Path $BackupFolder

#Clean Up Old Intune Backups
Get-ChildItem -Path $FilePath | where-object {$_.LastWriteTime -lt (get-date).AddDays(-90)} |Remove-Item -Force

Now we create a basic task in the task scheduler, select daily execution and include our script.



The result will be (after a few days) that the backups will be listed in your specified path.



After 90 days, the oldest backups are deleted by the script. You can customize the days for your needs.


If you ever need to compare or restore from a backup, please check out this article:


Of course, the whole thing can be extended, for example, with an automated notification. But this step I leave to you ;-).


I hope this article has given you a good foundation on how to automate your Intune Backup. Thank you for taking the time to read this article.


Kind regards, Tom Wechsler


P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github!

4 Replies

Hi Tom,

Just curious why you use a password in the script and not connecting to the graph api with azure app registration and an app secret?

Kind regards,


It depends I guess. When using application permissions you could sometimes end up with some weird errors.. Not saying that delegated permissions are better but :) until know i only have seen this API errors only with application permissions.. so that could be a good reason i guess ;) ?
Hi René, the customer wanted a local solution (everything on the management server). I had also thought of a "cloud solution". I will probably write another article about this ;-). What I want to mention is that the password is not directly in the script, that's what the intermediate step is for.
Greetings, Tom

Did any manage to run this in Cloud. I am trying to run in Azure Automation and copy to Blog storage. But having issues