TenuVaultDesktopProtect every policy, on a schedule
Backup
01
Settings Catalog, device configurations, compliance, scripts, Administrative Templates and more, with assignments. Encrypted on this device, or in your own Azure storage on Pro.
NewAdministrative Templates included in backups by default
Intune backup that never leaves your machine
Back up, restore and watch for drift in Microsoft Intune from a desktop app that signs in as you. Your configuration never passes through a TenuVault server.
Free for one tenant. Pro and MSP free for 30 days. Installers are coming soon; the buttons open the repository.
Sign in with your own admin account , keep backups encrypted on this device or in your own Azure storage , and every change carries your name.
Everything an Intune admin needs to sleep well
Backup, restore, drift detection and OpenIntuneBaseline in one desktop app.
Put back exactly what you need
Restore
02
Restore any item as a separate copy. Pro replaces policies in place and restores assignments. Cross tenant copies arrive unassigned.
Know exactly what changed
Drift Detection
03
Compare your live tenant against a backup and export the drift as JSON or CSV. The audit log on Pro shows who changed it.
Start from a reviewed baseline
OpenIntuneBaseline
04
Quick Start deploys reviewed OpenIntuneBaseline packs, created unassigned. Frameworks compares your Settings Catalog configuration with framework controls. The Windows pack is free.
Your data, your keys, built for locked down tenants
When Conditional Access or policy rules out third party portals, TenuVault Desktop still fits. It is a public client in your own tenant, with no secret.
Only license checks go to tenuvault.com. Tenant configuration, backups and your Microsoft access token never do.
- MFA and Conditional Access apply, exactly like the Intune portal
- Every change is attributed to you in Entra and Intune audit logs
- Restrict sign in to one security group with the -AllowedGroupId setup script parameter
Encryption at restAES-256
Tenant data on our servers0 bytes
Key protected byDPAPI or Keychain
Client secretsNone
Light or dark, it follows your desktop
A calm, native feeling app for the tool you open when something went wrong.
Start free, grow per tenant
Community is free for one tenant. Pro and MSP add more tenants, daily backups, Azure storage and the audit log, free for 30 days. Prices in EUR, excluding VAT.
Community
For admins who want a real safety net for one tenant.
Free
Forever. No license key, no account.
DownloadPro
For organizations that must recover fast and control change.
€49per month
2 tenants, billed monthly.
Start 30 day free trialMSP
For service providers and organizations with 3 or more tenants.
from€117per month
Per tenant, from 3 tenants. The price per tenant falls as you add more.
Start 30 day free trialCompare every featureAlready a customer? Manage your subscription
Frequently asked
Does any tenant data reach TenuVault servers?+
No. Tenant data and your Microsoft access token never reach a TenuVault server. The app talks to Microsoft for sign in, Microsoft Graph and Azure. License checks go to tenuvault.com and can include a Microsoft ID token as proof of the tenant; it is verified and never stored.
Which permissions does the app registration need?+
Delegated Microsoft Graph permissions for Intune configuration, apps, scripts and RBAC, plus Azure Storage only if backups go to your own storage account. The setup script lists and grants them. See the full list in the Trust Center.
What is free in Community?+
One tenant with manual and weekly backups, 30 days of history, restoring single items as copies, drift detection and the OpenIntuneBaseline Windows pack. No license key and no account needed.
Can I restore into a different tenant?+
Yes, with MSP. Cross tenant copies are created unassigned and require reviewed target dependencies, so nothing is pushed to devices by surprise.
Get started in minutes
- 1
Install the app
Installers for Windows and macOS are coming soon.
- 2
Create the app registration
An admin runs New-TenuVaultDesktopApp.ps1 once to create it and grant consent.
- 3
Assign roles
Admins who use the app need an Intune role, for example Intune Administrator.
- 4
Sign in and back up
Community works without a key. Paste a Pro or MSP key on the License page.
Take your first backup today
Install, run the setup script, sign in. Your first backup is a few minutes away.
