On March 11, 2026, attackers who gained administrative access to Stryker’s environment used Microsoft Intune to send remote wipe commands to tens of thousands of employee devices. No malware was involved. Instead, they used native Intune controls exactly as they were designed to work, and employees in 79 countries came back to blank devices.
A wiped device can be recovered, but re-enrolling it and making it trustworthy again depends on the Intune policies that configure and secure it. Those policies need to be intact, and admins need confidence they haven’t been changed.
Microsoft Intune is Microsoft’s cloud-based endpoint management service, covering both mobile device management (MDM) and mobile application management (MAM). It decides how devices are configured and which apps they run. That makes it one of the most powerful admin consoles in the enterprise, and one of the most overlooked when it comes to protection. Intune is built to manage the live configuration for devices, and keeping restorable copies of earlier policy versions falls to the customer. When a policy is deleted, changed by an attacker, or pushed to the wrong group, teams without a backup must rebuild it by hand.
Today, Druva is introducing Druva Microsoft Intune Protection. It backs up Intune policies on a schedule, stores them outside the Microsoft tenant in the Druva Resilience Cloud, and restores individual policies in place when something goes wrong. Here’s what’s included:
- Automated, scheduled backups of Intune device policies, app policies, endpoint security policies, and role scope tags, with flexible retention and unlimited storage
- Record comparison to see identify configuration drift
- Record-level search and JSON download across snapshots, for investigations and audits
- Granular, in-place restore of individual policies to a known-good version
- Role-based access control for cloud and workload admins, with OAuth-based app authorization
Why it matters: Intune is a control plane, and attackers know it
Intune relies on Microsoft Entra ID for identities and groups, and works with Entra ID Conditional Access to decide who can reach company resources. That integration has a flip side. An attacker who compromises an Entra ID account with an admin role such as Intune Administrator or Global Administrator can change configuration profiles, loosen compliance policies, weaken security baselines, alter app deployments, and wipe devices from within Intune.
Not every incident is an attack. An admin assigns a configuration profile to the wrong group. A teammate edits a compliance policy that Conditional Access depends on, and employees are locked out of Outlook and Teams. A baseline update quietly lowers BitLocker encryption strength or pushes back an OS patch deadline, and nobody notices until the next audit.
Every one of these incidents starts with the same question: what did the policy look like before? Without native version history, undo, or restore actions, answering that question is difficult. The closest native option is exporting Settings Catalog policies to JSON one at a time, which only helps if someone did it before the change. Many teams fill the gap with custom PowerShell scripts against Microsoft Graph, but those scripts take ongoing IT effort to maintain and can break when APIs change.
Under Microsoft’s Shared Responsibility Model, Microsoft secures the Intune service and keeps it running. Customers are responsible for their own configurations and data, including how they recover them. For organizations with hundreds of policies and app configurations, rebuilding from memory can take days or weeks.
Druva Microsoft Intune Protection: A way back to known-good policy
Druva Microsoft Intune Protection gives IT and security teams an independent copy of their Intune configuration and a fast way to restore it. Backups are stored in the Druva Resilience Cloud, air-gapped from the Microsoft tenant, so the recovery points sit outside the environment an attacker or a bad change can reach.
Back up Intune policies automatically
Druva connects to Intune through an authorized app and backs up policies on a schedule. Coverage includes device policies, app policies, endpoint security policies, and role scope tags. With flexible retention and unlimited storage, teams can keep long-term baselines without managing capacity, and there are no scripts to write or maintain.
Compare records across snapshots
Admins select a record and compare it with an earlier snapshot to see which attributes changed. The result is a clear history of configuration updates that teams can use for troubleshooting, security reviews, and audits.
Find and restore records quickly
When an item is deleted, admins can search for it by name across hundreds of thousands of records, find the right snapshot, and restore it in a few clicks. Records can also be downloaded as JSON, giving security and compliance teams evidence for investigations and audits.
Restore the policy that broke, in place
Admins pick the affected policy and a recovery point, then restore it in place, while the rest of the Intune environment keeps running. There’s no tenant-wide rollback and no rebuilding from scratch.
Control who can act
Druva supports role-based access control for cloud and workload administrators and connects to Intune through an OAuth app authorization workflow. Backup and restore actions stay with the people who should have them.
Identity, devices, and policy recover together
The Stryker attack shows why Intune can’t be recovered in isolation. After a mass wipe, getting people back to work takes three things: trusted identities in Entra ID, Intune policies to secure re-enroll devices, and the files that lived on those devices. Restoring one without the others leaves the business waiting.
Druva protects all three on one platform. Druva for Microsoft Entra ID restores users, groups, and Conditional Access policies. Druva Microsoft Intune Protection restores the Intune policies assigned to those users and groups, including the compliance policies that Conditional Access uses to make access decisions. Druva endpoint backup restores user data to rebuilt devices. IT and security teams work from one platform instead of three tools and a folder of scripts.
Intune also shapes access to the rest of the Microsoft estate. Its compliance results feed the Entra ID Conditional Access policies that decide which users and devices can access Microsoft 365 files, Copilot chats, and Azure workloads. Druva already protects Microsoft 365, Microsoft 365 Copilot Chat, Azure VMs, Azure SQL, Azure Blob, and Azure Files. With Intune added, the data and the access policies around it can be recovered by the same team, on the same platform.
Final thoughts: Protect the rules, not just the devices
Intune holds the rules that make every managed device trustworthy. Those rules can be deleted, tampered with, or changed by mistake, and under the shared responsibility model, keeping a copy to roll back to is the customer’s job. Druva Microsoft Intune Protection keeps that copy outside the tenant and restores it when needed. It works alongside the identities, endpoints, and Microsoft 365 data Druva already protects, all through its fully managed Resilience Cloud.