TenuVaultDesktopPractical guide
Deploy TenuVault with Intune
Deploy TenuVault with Intune by uploading its Windows x64 MSI as a line-of-business app and assigning it to admin devices. The MSI installs per machine and never updates itself, so distribute each approved new MSI through Intune. Each admin still signs in and selects storage on first launch.
Can Intune install the admin app for my team?
Microsoft documents Windows line-of-business app deployment from MSI packages. Use that native route to distribute the TenuVault installer to the admin device group. Installation and first-run configuration are separate tasks: delivering the app does not grant tenant roles, consent permissions or choose the shared backup account.
Keep the rollout scoped to the administrators who need the app. Record the approved package, target architecture and owner of future updates. Start with a pilot device that represents the managed workstation setup, then verify sign-in and storage before expanding the app assignment.
How do I deploy TenuVault with Intune?
1. Download TenuVault-<version>-win-x64.msi from the official releases page linked in the deployment documentation. Use the approved version from your change record. The MSI is x64 only; Arm64 devices use the documented Arm64 setup program and need a separate deployment decision.
2. In the Intune admin center, open Apps, Windows, Create. Choose Line-of-business app and upload the MSI. Complete the app information, then assign it to the admin device group as Required or Available for enrolled devices according to the team's distribution procedure.
3. Verify installation on the pilot. The documented MSI installs per machine without prompts and creates a desktop shortcut. Intune reads its product code and version and installs silently. Check the actual installed version and launch under the administrator's normal user account before expanding the assignment.
How do I control updates on admin devices?
TenuVault installed from the MSI never updates itself. Keep responsibility for new versions in your Intune deployment process and pilot each approved MSI before broader distribution. Do not wait for the app's normal updater to maintain a centrally installed MSI version.
For installations using the normal automatic updater, the documented Windows policy is a DWORD named DisableAutoUpdate set to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\TenuVault or HKEY_CURRENT_USER\SOFTWARE\Policies\TenuVault. Choose the device-wide key when the policy should apply to every user on the workstation.
The deployment docs provide an Intune platform script for the device-wide value. Run it without logged-on credentials and in a 64-bit PowerShell host. A 32-bit host writes under WOW6432Node, where TenuVault does not see the policy. Follow the documented script rather than recreating it from an abbreviated registry note.
TenuVault reads the policy on startup, so restart it after delivery. With the policy applied, automatic update checks and downloads stop and Settings, Updates shows that the organization manages updates. Removing the value or setting it to 0 reverses that policy for installations that support automatic updating.
What must each admin configure after installation?
4. Reuse the existing tenant app registration and give admins its tenant ID and client ID. Each person signs in with their own account and needs the relevant Intune role. Keep consent and role decisions in the tenant onboarding process instead of creating a registration for every installed workstation.
5. Select backup storage on first launch. Pro and MSP include the organization's own Azure storage account, which lets admins share the same backups. Current Azure backups are plain JSON protected by Azure encryption at rest and roles. Device and network-share backups stay encrypted and need a recovery key for another computer.
6. Agree the schedule runner and retention setting across the team. These remain per computer, so deploying the same MSI does not copy them. Two desktop schedules can create duplicate runs, and the shortest retention setting can delete eligible shared backups. Check the pricing page for tenant and installation coverage.
How do I try it on my tenant?
Assign the MSI to one approved admin device, confirm the installed version and complete sign-in with the existing registration. Check shared backup visibility and the update route, then restart the app and verify the managed setting when using policy. Record those results before broadening assignment or shipping the next approved package.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does an MSI installation update itself?+
No. TenuVault installed from the MSI never updates itself. Deploy each approved new MSI version through Intune.
Is the MSI available for Arm64?+
The documented MSI is x64 only. The documentation points Arm64 devices to the Arm64 setup program.
Does deploying the app configure each admin?+
No. Each admin still signs in and chooses storage. Sign-ins, backup keys and settings belong to the user account on that device.