TenuVaultDesktopComparison
Baseline exceptions in a spreadsheet or a register
Most tenants differ from their baseline somewhere on purpose: a setting a business app needs, a pilot, an older device group. Auditors and the next admin want to know which differences are deliberate, who decided them, why, and until when. Many teams keep that list in a spreadsheet or a wiki page. This page compares that with the Accepted deviations register in TenuVault Pro and MSP.
At a glance
- Intune has no register of approved exceptions to a baseline. A policy's description field can hold a note, but it has no owner, approval or expiry.
- A spreadsheet costs nothing and every auditor can read it, but nothing connects its rows to the tenant, so it goes stale when policies change.
- TenuVault's Accepted deviations register (Pro and MSP) lists documented customizations, hygiene findings a reviewer acknowledged or marked as a false positive, and on MSP approved exceptions to a golden standard.
- Each entry shows its setting, policy, owner or approver and reason, plus its decision date, evidence date and expiry where they are recorded. Expired entries sort first.
- The register is read-only: it records decisions and changes nothing in Intune. It exports to CSV or JSON and is part of the governance evidence pack.
- CIS Benchmark exclusions are kept on the CIS Benchmarks page with their own owner, reason and expiry, not in this register.
Side by side
| Question | Spreadsheet or wiki | TenuVault register |
|---|---|---|
| Cost | Free | Pro and MSP; approved golden-standard exceptions need MSP |
| Link to the tenant | None; rows name settings and policies as text | Entries point at a setting definition ID and a policy; links from a score gap or a hygiene finding fill them in |
| Owner, reason and expiry | Whatever columns you add | A customization needs an owner and a reason; an optional re-review date becomes its expiry |
| Expired exceptions | Someone has to check the dates | Sorted first and marked Expired |
| Approver | Whatever process you add | Golden-standard exceptions record an approver; customizations record an owner only |
| History of a decision | Depends on the sheet's version history | Customizations are versioned, and every change, including a new owner or retirement, is kept in the record's history |
| Evidence for an audit | Share or export the sheet | CSV or JSON export, and the evidence pack as one dated JSON file |
| What it can cover | Anything you write down | Differences from the installed baseline, reviewed hygiene findings and golden-standard exceptions |
How a spreadsheet register works
A typical sheet has one row per exception: the setting, the policy, the value the tenant uses instead, the reason, a compensating control, the owner, who approved it, the decision date and a review date. Someone reviews it on a schedule, often before an audit.
That is simple, and it works for any baseline or framework. Its weakness is that the sheet and the tenant are separate. When someone renames or deletes the policy, changes the value again, or a baseline update changes the setting, the row stays as it was, and nobody notices until the next review.
What the TenuVault register adds
In TenuVault, an exception starts where the difference is found. A gap in a baseline score or a hygiene finding has a link that opens the Customizations screen with the setting and policy filled in. You add the reason, the owner and, if you want one, a re-review date.
Accepted deviations then lists those customizations together with hygiene findings a reviewer acknowledged or marked as a false positive, and on MSP the exceptions approved when a golden standard was adopted for a customer. You can filter by kind or show expired entries only, and export what you see. Hygiene reviews, customizations and golden-standard exception decisions are also written to the TenuVault audit log.
What the register does not do
- It records decisions. It does not enforce them, change a policy or stop a drift from the documented value.
- Hygiene findings that were acknowledged or marked as a false positive have no expiry; they reopen when the evidence changes.
- Customizations have an owner but no separate approver field.
- CIS Benchmark exclusions live on the CIS Benchmarks page, not in this register.
- Native framework comparisons, such as NIST or ISO/IEC 27001, have no exceptions of their own.
- There is no PDF export of the register; it exports to CSV or JSON.
When you do not need TenuVault
A spreadsheet is enough when:
- You have a handful of exceptions and review them once or twice a year.
- Your organization already keeps exceptions in a governance, risk and compliance system that auditors expect to see.
- Your exceptions are mostly outside Intune configuration, such as process or identity controls.
When TenuVault saves you time
The register pays off when exceptions come out of findings you already work with: baseline scores, conflict and hygiene scans, or golden standards across customers. Each entry is recorded where the difference was found, and an expired decision shows up the next time you open the register instead of at the next audit.
You can use both. Export the register to CSV and attach it to the system or sheet your auditors already use.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does Intune have a way to record baseline exceptions?+
Not as a register. You can change values in a baseline policy and write a note in its description, but Intune records no owner, approval, reason field or expiry for the difference. Teams keep that in a spreadsheet, a wiki or a compliance system.
What should a baseline exception record include?+
The setting and policy, the value the tenant uses instead, the reason, any compensating control, the owner, the approver, the decision date and a review or expiry date. Without a review date, exceptions tend to outlive the reason for them.
Which TenuVault plan includes the Accepted deviations register?+
Pro and MSP. Exceptions approved while adopting a golden standard for a customer need MSP. Community does not include the Governance screens.
Can I export the register for an auditor?+
Yes, as CSV or JSON, filtered as shown. The governance evidence pack also includes it, in one dated JSON file with scores, hygiene findings and customizations. There is no PDF export of the register.
Are CIS Benchmark exclusions part of the register?+
No. CIS Benchmark exclusions are recorded on the CIS Benchmarks page, with their own owner, reason and expiry.