TenuVaultDesktopComparison
OpenIntuneBaseline by hand or with TenuVault
OpenIntuneBaseline (OIB) is a free, community-maintained set of Intune policies published as JSON files. You can import them yourself and compare them with your tenant by eye, and for a one-time start that is enough. It gets harder when a new OIB version comes out and you need to know which of your policies are outdated or have drifted. This page compares the two approaches.
At a glance
- OpenIntuneBaseline is published by SkipToTheEndpoint and contributors under the GPL-3.0 license. TenuVault downloads its files from the upstream GitHub repository and does not bundle them.
- Deploying new OIB policies, comparing deployed policies with an OIB version and validating them setting by setting are included in TenuVault Community.
- Updating outdated OIB policies in place, Fix drift and customizing your own baseline need Pro or MSP.
- TenuVault creates OIB policies unassigned, or assigned only to a pilot group you name, and never deploys the assignments stored in the OIB files.
- Every TenuVault deployment can be undone per run, and in-place updates and drift fixes always back up the tenant first.
How the manual way works
OIB publishes a release per platform, such as Windows, macOS, Windows 365 and BYOD app protection. Doing it by hand usually means:
- Download the release and read which policies suit your licensing, for example whether Defender for Endpoint is your antivirus and whether Windows updates are managed by Autopatch.
- Import the policies one by one, with the Intune admin center's import where the policy type supports it, or with a Graph script for the rest.
- Assign them to a pilot group and widen the assignment as you gain confidence.
- When a new OIB version comes out, find which of your policies are older, compare each one with the new file and decide whether to update it or create the new version next to it.
- Check now and then that nobody has changed a deployed OIB policy, by opening it or by comparing an export with the OIB file.
Side by side
| Question | By hand | TenuVault |
|---|---|---|
| Cost | Free, plus your time | Deploy, compare and validate on Community; in-place updates and Fix drift on Pro and MSP |
| Choosing policies | You read the release and pick | Licensing questions filter out policies that do not suit the tenant |
| Importing | One policy at a time, in the admin center or by script | Selected policies in one run, unassigned or to a pilot group, with an optional backup first |
| Which version you deployed | Whatever you wrote down | The release and commit recorded on every deployment and validation run |
| Finding outdated policies | Compare names and versions by hand | Existing Deployment matches tenant policies by their OIB ID and version |
| Finding drift | Open each policy or diff exports | Policy Validation lists value mismatches, missing settings and extra settings per policy |
| Undo | Delete or edit what you imported | Undo per run: created policies are removed and updated ones put back |
| Several tenants | Repeat in each tenant | Also deploy to other connected tenants in one run, on MSP |
What TenuVault checks, and what it does not
Existing Deployment matches your tenant's policies to the selected OIB version by the OIB ID in the policy description, or by the policy name without its version for older deployments. It reports each policy as up to date, update available, new, newer than OIB or ambiguous. It does not compare settings; Policy Validation does that.
Policy Validation checks matched Settings Catalog and endpoint security policies, compliance policies, update rings, driver updates, Endpoint Analytics and Administrative Templates setting by setting. Other policy types are listed as not validated setting by setting.
Deprecated OIB policies that are still deployed are listed for review. TenuVault does not remove them.
When you do not need TenuVault
Doing it by hand is enough when:
- You imported OIB once as a starting point and now treat the policies as your own, without following new OIB versions.
- You use a handful of OIB policies and can compare them by eye.
- You already import OIB through your own pipeline and review the changes there.
When TenuVault saves you time
TenuVault is worth trying when:
- You want to follow new OIB versions and need to know which deployed policies are outdated.
- You need proof of which OIB release and commit you deployed and validated.
- You deploy OIB to several tenants, or want every run to be undoable.
- You customize OIB and want those customizations kept when you upgrade, which Pro and MSP support through My baselines.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can I deploy OpenIntuneBaseline without a tool?+
Yes. OIB publishes its policies as JSON files that you can import into Intune one by one, in the admin center where the policy type supports import or with a Graph script. You then assign and maintain them yourself.
Is TenuVault's OpenIntuneBaseline support free?+
Deploying new OIB policies, comparing deployed policies with an OIB version and validating them setting by setting are included in Community, which is free for one tenant. Updating outdated policies in place, Fix drift and your own customized baseline need Pro or MSP.
Does TenuVault assign OpenIntuneBaseline policies?+
New policies are created unassigned, or assigned only to a pilot group whose object ID you enter. Assignments stored in the OIB files are never deployed.
How do I find OpenIntuneBaseline policies that have drifted?+
By hand, open each deployed policy or compare its export with the OIB file. In TenuVault, Policy Validation compares each matched policy with the OIB version setting by setting and lists value mismatches, missing settings and settings only in the tenant.