TenuVaultDesktopComparison
Many Intune tenants, one at a time or side by side
An MSP that manages Intune for several customers usually works tenant by tenant in the Intune admin center. That works, and the admin center shows everything Intune can do. It cannot show the backup state of every tenant at once or run the same backup across them. This page compares that with TenuVault MSP, which keeps each tenant's sign-in and storage separate and adds views and actions across tenants.
At a glance
- The Intune admin center works on one tenant at a time. Checking ten customers means ten switches or sign-ins.
- Microsoft 365 Lighthouse lets CSP partners view device compliance and deploy baseline tasks across customer tenants, but Microsoft does not describe it as a backup or restore of Intune configuration.
- The Intune admin center has no backup, so there is no backup state to compare across tenants.
- TenuVault keeps an app registration, an admin sign-in, a backup schedule and a storage location for each tenant.
- The All tenants overview appears when two or more tenants are connected and shows sign-in, license, storage, schedule and last backup for each one.
- MSP adds actions across tenants: Backup Selected, Check all for drift, copies to other tenants when restoring and Also deploy to for OpenIntuneBaseline, plus portfolio views of baseline scores, hygiene and golden-standard adoption.
- Actions across tenants need MSP on every tenant they touch. Most pages still work on the one tenant selected in the sidebar.
Side by side
| Question | Admin center, tenant by tenant | TenuVault MSP |
|---|---|---|
| Backup state of every tenant | Not available; the admin center has no backup | All tenants overview with the last backup and schedule of each tenant |
| Back up several tenants | Run your own export in each tenant | Backup Selected backs up the selected tenants one after another |
| Drift across tenants | Compare by hand in each tenant | Check all compares each tenant's two newest backups |
| Copy a policy to other customers | Recreate it, or export and import it, in each tenant | Copy to other tenants when restoring, as unassigned copies with the Default scope tag |
| OpenIntuneBaseline in several tenants | Import it in each tenant | Also deploy to other tenants from one deployment |
| Devices, users and app installs | Everything Intune offers | Not managed; TenuVault works on configuration |
| Sign-in | Per tenant | Per tenant, through that tenant's own app registration |
| Cost | Included with Intune | MSP subscription priced per tenant |
How tenant-by-tenant work looks
Each customer has its own tenant, so an engineer signs in to it, or switches to it, and works there. Backups are whatever export each tenant has, often a script that someone runs per tenant. Checking whether every customer was backed up last night, or whether a policy changed in any of them, means opening each one.
With a few customers that is manageable, and it keeps each customer's access clearly separate. It becomes hard to keep up as the number grows, and gaps show up only when someone looks.
What TenuVault adds across tenants
The All tenants overview opens when TenuVault starts and shows one card per tenant: who is signed in, the license, where backups go, the schedule and the last backup, with an Action required badge on a failed one. On MSP you can select several tenants and back them up together, check drift across them, or restore a policy into other tenants as a copy.
MSP also has portfolio views that bring each tenant's own results into one table: baseline scores, hygiene findings and golden-standard adoption. Tenants that are not on MSP, or not signed in, are listed as not included rather than guessed.
What TenuVault does not do
- Each tenant needs its own TenuVault app registration and an admin who signs in to that tenant.
- Backup & Restore, Drift Detection, the Audit Log and most other pages work on the tenant selected in the sidebar.
- Copies into other tenants are never assigned and get the Default scope tag; app installer files are not copied.
- TenuVault backs up Intune configuration only. Entra objects such as groups and Conditional Access policies are not in its backups. It does not manage devices, users or app installs.
- Actions across tenants are refused if any selected tenant is not on MSP.
When you do not need TenuVault
Working tenant by tenant is enough when:
- You manage two or three customers and look at each of them every week anyway.
- Microsoft 365 Lighthouse already gives you the views across customers you need, and recovering Intune configuration is covered some other way.
- Each customer already has a backup you trust, and someone checks it.
- Your work across customers is mostly about devices and users, not Intune configuration.
When TenuVault saves you time
The overview pays off when the question is "which customers are not protected right now?" and the honest answer needs ten sign-ins. One screen shows failed and missing backups, and Backup Selected or Check all answers the follow-up for every selected tenant.
Backups stay per customer: backups are encrypted with AES-256-GCM on the admin's computer and kept in a local folder or network share, or on Pro and MSP in your own Azure storage account.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can the Intune admin center manage several tenants at once?+
No. The Intune admin center works on one tenant at a time; you switch tenants to work in another one. TenuVault MSP adds an overview and actions across connected tenants for backup, drift and baselines.
Does Microsoft 365 Lighthouse back up Intune policies?+
Microsoft does not describe a backup, restore or version history of Intune configuration in Lighthouse. It is a portal for CSP partners that shows device compliance and deploys baseline tasks across customer tenants, so it can sit next to a backup rather than replace one.
Which TenuVault plan works across tenants?+
The All tenants overview appears on any plan with two or more connected tenants, so Pro and MSP. Backup Selected, Check all for drift, copies to other tenants and Also deploy to need MSP on every tenant they touch.
Are customer backups kept separate in TenuVault?+
Yes. Each tenant has its own sign-in, schedule and storage location: a folder on the device or network share, or on Pro and MSP an Azure storage account you choose for that tenant. Backups are never sent to a TenuVault server.
Does copying a policy to another tenant keep its assignments?+
No. Copies restored into another tenant are never assigned and get the Default scope tag, because groups and scope tags differ per customer. Assign them in each tenant after review.