TenuVaultDesktopComparison
Intune audit logs or a backup
Intune audit logs record who changed what, and when. They are essential for investigating a change, and nothing replaces them for that. They are not a backup: an audit event describes a change, not the whole policy, so a deleted policy cannot be recreated from the log alone. This page compares the two.
At a glance
- An Intune audit event records the actor, the activity, the time, the result and the resources it changed, with their modified properties.
- The modified properties have fields for old and new values, but an event does not hold the full policy.
- The admin center shows audit logs for up to the previous year, and Microsoft Graph returns two years of audit events.
- Sending audit logs to a storage account, Event Hubs or Log Analytics through diagnostic settings keeps them longer, with an Azure subscription.
- TenuVault's own audit log records only what TenuVault did. It does not replace the Intune audit log.
Side by side
| Question | Intune audit logs | TenuVault backup |
|---|---|---|
| Who made a change | Yes, with the time and result | No; a backup is a copy, not a record of who |
| Full policy content | No; the changed properties of each event | Yes, every object with its settings and assignments |
| Recreate a deleted policy | Only by rebuilding it by hand from events and notes | Restore from the last backup before the delete |
| How long it is kept | Up to a year in the admin center, two years through Graph, longer with diagnostic settings | Up to 30 days on Community; 7 to 365 days or forever on Pro and MSP |
| Cost | Part of Intune; longer retention needs Azure resources | Community is free for one tenant; Pro and MSP are paid |
What audit logs are for
Use the audit log to answer who changed a policy, when and with what result. For an investigation or a change review, it is the primary record, and it covers changes from every admin and tool, including TenuVault.
If you need the history for longer than Microsoft keeps it, send the AuditLogs category to Log Analytics, a storage account or Event Hubs through Intune's diagnostic settings.
Why an audit log cannot restore a policy
An audit event describes a change: the activity and the properties it touched. To recreate a deleted policy from the log, you would need every event since the policy was created, every one of them complete, and then rebuild the policy by hand in the right order. In practice the log tells you what to rebuild, and your notes or an export tell you how.
A backup holds the whole object as it was at a point in time, with its assignments, so a restore does not depend on piecing events together.
How TenuVault uses the audit log
TenuVault keeps its own audit log of what it did for a tenant, such as backups, restores, reverts and deployments, with the admin who did it. It does not show changes made in the Intune admin center or by other tools.
On Pro, Intune change watching reads the Intune audit log through Microsoft Graph and sends digests of what was created, updated, deleted, assigned or unassigned, with who did it, every 15 minutes by default while TenuVault runs.
When you do not need TenuVault
Audit logs on their own are enough when:
- Your question is always who changed something, not how to put it back.
- You have complete, current documentation of every policy and could rebuild any of them by hand in time.
- You keep your own exports for recovery and use the audit log to decide which one to use.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can I restore a deleted Intune policy from the audit log?+
Not directly. The audit log shows the deletion and the properties changed in earlier events, but not the full policy. You can use it to rebuild the policy by hand, or restore it from a backup made before the deletion.
How long are Intune audit logs kept?+
The Intune admin center shows up to the previous year, and Microsoft Graph returns two years of audit events. Send the logs to Log Analytics, a storage account or Event Hubs through diagnostic settings to keep them longer.
Do Intune audit logs show old and new values?+
Audit events list the modified properties, and Microsoft Graph has fields for each property's old and new value. They show the change, not the full policy before and after.
Does TenuVault replace the Intune audit log?+
No. TenuVault's audit log records only what TenuVault did. Use the Intune and Entra audit logs for changes made by anyone else.