TenuVaultDesktopComparison
Microsoft Tenant Configuration Management or an Intune backup
Tenant Configuration Management (TCM) is Microsoft's own way to take JSON snapshots of tenant configuration and monitor it for drift, across workloads that include Intune. It comes with Microsoft Entra ID P1 or P2, and for drift alerts it may be all you need. It is not a backup: snapshots are deleted after seven days and nothing in TCM restores a policy. This page compares it with an Intune backup.
At a glance
- The Tenant Configuration Management APIs in Microsoft Graph became generally available in March 2026. Microsoft Entra Tenant Governance shows them as configuration management.
- TCM supports 68 Intune resource types, and 62 of them capture assignments. Its Intune list has no apps, PowerShell or shell scripts and no remediations.
- A TCM snapshot is kept for at most seven days and then deleted automatically, and a tenant can extract at most 20,000 resources per month across all snapshots.
- TCM monitors run every six hours, with up to 30 monitors and 800 monitored resources per day per tenant. They only report drift.
- TCM has no restore or apply action. Microsoft says to fix drift with the admin center, PowerShell or Microsoft Graph.
- Basic TCM capacity comes with Microsoft Entra ID P1 or P2. Entra ID Free gets none.
What TCM does well
TCM is built into Microsoft's platform, so there is nothing to install, and its monitors compare the tenant with a baseline you define every six hours. One mechanism covers Intune and other workloads, which no Intune-only tool does.
If your goal is to be told within hours that a monitored setting changed, and you already have Entra ID P1 or P2, a TCM monitor is a reasonable first step and costs nothing extra.
Side by side
| Question | Tenant Configuration Management | TenuVault |
|---|---|---|
| Cost | Included with Entra ID P1 or P2; Entra ID Governance adds capacity | Community is free for one tenant; Pro and MSP are paid |
| Intune coverage | 68 resource types; no apps, scripts or remediations | 40 Intune object types in nine areas, with their assignments where Intune has them |
| Other workloads | Yes, beyond Intune | No; Intune only |
| Assignments | Captured for 62 of the 68 types | Saved with each object where Intune has them |
| How long copies are kept | At most seven days, unless you download and store them | Up to 30 days on Community; 7 to 365 days or forever on Pro and MSP |
| Limits | 20,000 resources per month; 800 monitored resources per day; up to 200 resource instances per monitor baseline | No TenuVault quota; Microsoft Graph throttling applies |
| Drift | Monitors compare the tenant with a baseline every six hours | Compares any two complete backups, every item and setting |
| Restore | None; fix drift yourself | An unassigned copy on every plan; in place with assignments on Pro and MSP |
| Where the data is | In Microsoft's service, until it expires | Encrypted on your computer or in your own Azure storage |
| How you use it | Microsoft Graph APIs and the Entra admin center | A desktop app for Windows and macOS |
Where TCM stops
These limits are documented by Microsoft, and they follow from what TCM is for: drift monitoring, not recovery.
- Snapshots are deleted after seven days. To keep a history, you have to download each snapshot and store it yourself, and a tenant sees at most 12 snapshot jobs.
- Monitors report drift; they do not put anything back. You fix a drifted setting by hand or with your own script.
- Apps, PowerShell and shell scripts and remediations are not in its Intune resource list.
- Updating the baseline of a monitor deletes that monitor's earlier results and detected drifts.
- Resolved drifts are deleted 30 days after they are resolved, so TCM is not a long-term change record.
What TenuVault adds, and what it does not
TenuVault keeps restorable copies of 40 Intune object types in nine areas, with their assignments where Intune has them, for as long as your plan's retention allows. Drift detection compares two complete backups and lists every added, changed and deleted item down to the setting, on every plan. Community restores one item at a time as a new, unassigned copy. Pro and MSP add restoring many items at once, replacing items in place, recreating deleted items under their original names and restoring assignments.
It does not replace TCM for other workloads. TenuVault backs up Intune configuration only. Entra objects such as groups and Conditional Access policies are not in its backups. Its drift detection runs when you compare backups, not every six hours on its own; on Pro, notifications can report drift and Intune audit log changes.
When you do not need TenuVault
TCM on its own is enough when:
- You want to be alerted to drift in a set of important settings, and you fix drift by hand.
- You need one monitoring mechanism across Intune and other workloads.
- You already script Microsoft Graph and download TCM snapshots into storage you keep, and you have tested rebuilding a policy from one.
Using both
TCM and an Intune backup answer different questions. TCM tells you within hours that a monitored setting no longer matches your baseline. A backup lets you see the full previous version weeks later and put it back. Running a TCM monitor for alerts and TenuVault for restorable history is a reasonable combination.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is Tenant Configuration Management a backup of Intune?+
No. TCM takes JSON snapshots and monitors drift, but snapshots are deleted after at most seven days and TCM has no restore or apply action. Download and store snapshots yourself if you want to keep them.
Can Tenant Configuration Management restore an Intune policy?+
No. TCM monitors run in monitor-only mode, and Microsoft says to fix drift with the admin center, PowerShell or Microsoft Graph.
Which Intune objects does Tenant Configuration Management cover?+
68 Intune resource types, including compliance policies, many device configuration types, settings catalog policies, app configuration and app protection policies. Its list has no apps, PowerShell or shell scripts and no remediations. 62 of the 68 types capture assignments.
Does Tenant Configuration Management cost extra?+
No, within its base capacity. Basic capacity comes with Microsoft Entra ID P1 or P2, and Entra ID Governance licenses add more. Entra ID Free gets none.