Backup, restore and drift detection for admins who cannot sign in to third party web apps, or whose Conditional Access policies block them.
Your Intune data and backups travel only between the app and Microsoft: sign-in, Microsoft Graph and Azure. TenuVault receives license checks only. To verify an organization license these include your Entra ID sign-in token, never a Graph access token or tenant data.
Delegated sign-in through an app registration in your own tenant, with no secret. MFA and Conditional Access apply, and every change is attributed to you in the audit logs.
Encrypted on your device with AES-256-GCM, the key protected by Windows DPAPI or the macOS Keychain, or stored in your own Azure storage account.
Getting the app approved internally? Visit the Trust Center and download the security and architecture overview.
Prices in EUR, excluding VAT. Your license key arrives by email after checkout.
For admins who want a real safety net for one tenant.
Forever. No license key, no account.
DownloadIncludes
For organizations that must recover fast and control change.
2 tenants, billed monthly.
Start 30 day free trialEverything in Community, plus
For service providers and organizations with 3 or more tenants.
Per tenant per month: €39 for tenants 1 to 24, €29 for tenants 25 to 99, €19 for tenants 100+. Minimum 3 tenants.
Start 30 day free trialEverything in Pro, plus
Already a customer? Manage your subscription
Installers for Windows (x64 or arm64, EXE or MSI for Intune deployment) and macOS (Apple silicon or Intel) are coming soon.
A Global Administrator, Privileged Role Administrator or Cloud Application Administrator with consent rights runs New-TenuVaultDesktopApp.ps1, also available in the app. It creates a single tenant public client in your tenant, requests the delegated permissions below and grants admin consent. Use -AllowedGroupId to limit sign-in to one group.
The admins who use the app need an Intune role, for example Intune Administrator. To keep backups in Azure they also need Storage Blob Data Contributor on the storage account.
The app works as Community without a key. For Pro or MSP, paste the license key from your purchase email on the License page. When a colleague has shared an organization license with your tenant, signing in is enough.
Redirect URIs: http://localhost and ms-appx-web://Microsoft.AAD.BrokerPlugin/<client id>.
| Permission | Used for |
|---|---|
User.ReadMicrosoft Graph | Sign in and read the signed-in admin's profile. |
Organization.Read.AllMicrosoft Graph | Tenant name and verified domains. |
Policy.Read.AllMicrosoft Graph | Requested by the setup script, not used by the current version. |
DeviceManagementConfiguration.ReadWrite.AllMicrosoft Graph | Back up and restore configuration, compliance, endpoint security and update policies. |
DeviceManagementApps.ReadWrite.AllMicrosoft Graph | Back up and restore apps, app protection and app configuration policies. |
DeviceManagementServiceConfig.ReadWrite.AllMicrosoft Graph | Back up and restore enrollment settings, branding and terms. |
DeviceManagementScripts.ReadWrite.AllMicrosoft Graph | Back up and restore PowerShell and shell scripts and remediations. |
DeviceManagementRBAC.ReadWrite.AllMicrosoft Graph | Back up and restore scope tags, Intune roles and role assignments. |
DeviceManagementManagedDevices.Read.AllMicrosoft Graph | Device counts and compliance rate on the tenant overview, and device clean-up rules. Device records are not stored. |
user_impersonationAzure Service Management | List your subscriptions and storage accounts when you pick backup storage. Read only. Optional. |
user_impersonationAzure Storage | Backups and the audit log in your own storage account. Optional. |
One tenant with manual and weekly backups of every Intune object type, 30 days of history, unlimited single item restores, drift detection and the Windows Quick Start. No license key and no account needed.
The app falls back to Community. Your backups stay where they are and remain readable; Pro and MSP features pause until you renew.
The app checks its license every few hours. After a successful check it keeps working offline for 14 days.
Up to 5 installations per licensed tenant. Deactivate an installation from the License page to free its slot.
The subscription quantity is the number of Microsoft Entra tenants the key can activate, at least 3. The price per tenant falls as you add tenants. Change the quantity in the customer portal at any time.
Yes. A Pro license is shared with the key holder's tenant by default, so other admins in that tenant only sign in. MSP keys share with a customer tenant only when you turn it on.
Manage invoices, payment details and your subscription in the customer portal. The trial ends without a charge if you cancel before it runs out.