# Deploy TenuVault with Intune | TenuVault Deploy TenuVault with Intune using the Windows x64 MSI. Pilot installation, control the update route and prepare each administrator's sign-in and storage. Canonical: https://www.tenuvault.com/guides/deploy-tenuvault-with-intune Practical guide # Deploy TenuVault with Intune Deploy TenuVault with Intune by uploading its Windows x64 MSI as a line-of-business app and assigning it to admin devices. The MSI installs per machine and never updates itself, so distribute each approved new MSI through Intune. Each admin still signs in and selects storage on first launch. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Can Intune install the admin app for my team? Microsoft documents Windows line-of-business app deployment from MSI packages. Use that native route to distribute the TenuVault installer to the admin device group. Installation and first-run configuration are separate tasks: delivering the app does not grant tenant roles, consent permissions or choose the shared backup account. Keep the rollout scoped to the administrators who need the app. Record the approved package, target architecture and owner of future updates. Start with a pilot device that represents the managed workstation setup, then verify sign-in and storage before expanding the app assignment. - [Microsoft Learn: Windows line-of-business app deployment](https://learn.microsoft.com/en-us/intune/intune-service/apps/lob-apps-windows) ## How do I deploy TenuVault with Intune? 1\. Download TenuVault-<version>-win-x64.msi from the official releases page linked in the deployment documentation. Use the approved version from your change record. The MSI is x64 only; Arm64 devices use the documented Arm64 setup program and need a separate deployment decision. 2\. In the Intune admin center, open Apps, Windows, Create. Choose Line-of-business app and upload the MSI. Complete the app information, then assign it to the admin device group as Required or Available for enrolled devices according to the team's distribution procedure. 3\. Verify installation on the pilot. The documented MSI installs per machine without prompts and creates a desktop shortcut. Intune reads its product code and version and installs silently. Check the actual installed version and launch under the administrator's normal user account before expanding the assignment. ## How do I control updates on admin devices? TenuVault installed from the MSI never updates itself. Keep responsibility for new versions in your Intune deployment process and pilot each approved MSI before broader distribution. Do not wait for the app's normal updater to maintain a centrally installed MSI version. For installations using the normal automatic updater, the documented Windows policy is a DWORD named DisableAutoUpdate set to 1 under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\TenuVault or HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\TenuVault. Choose the device-wide key when the policy should apply to every user on the workstation. The deployment docs provide an Intune platform script for the device-wide value. Run it without logged-on credentials and in a 64-bit PowerShell host. A 32-bit host writes under WOW6432Node, where TenuVault does not see the policy. Follow the documented script rather than recreating it from an abbreviated registry note. TenuVault reads the policy on startup, so restart it after delivery. With the policy applied, automatic update checks and downloads stop and Settings, Updates shows that the organization manages updates. Removing the value or setting it to 0 reverses that policy for installations that support automatic updating. ## What must each admin configure after installation? 4\. Reuse the existing tenant app registration and give admins its tenant ID and client ID. Each person signs in with their own account and needs the relevant Intune role. Keep consent and role decisions in the tenant onboarding process instead of creating a registration for every installed workstation. 5\. Select backup storage on first launch. Pro and MSP include the organization's own Azure storage account, which lets admins share the same backups. Current Azure backups are plain JSON protected by Azure encryption at rest and roles. Device and network-share backups stay encrypted and need a recovery key for another computer. 6\. Agree the schedule runner and retention setting across the team. These remain per computer, so deploying the same MSI does not copy them. Two desktop schedules can create duplicate runs, and the shortest retention setting can delete eligible shared backups. Check the pricing page for tenant and installation coverage. ## How do I try it on my tenant? Assign the MSI to one approved admin device, confirm the installed version and complete sign-in with the existing registration. Check shared backup visibility and the update route, then restart the app and verify the managed setting when using policy. Record those results before broadening assignment or shipping the next approved package. - [Prepare Intune backup operations](https://www.tenuvault.com/intune-backup) - [Set up the first backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Prepare shared Azure backups](https://www.tenuvault.com/guides/intune-backup-to-azure-storage) - [Download TenuVault](https://www.tenuvault.com/download) - [Compare plans and features](https://www.tenuvault.com/pricing) ## Read the technical guides - [Deploy TenuVault with Intune documentation](https://docs.tenuvault.com/deploy/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does an MSI installation update itself? A: No. TenuVault installed from the MSI never updates itself. Deploy each approved new MSI version through Intune. ### Q: Is the MSI available for Arm64? A: The documented MSI is x64 only. The documentation points Arm64 devices to the Arm64 setup program. ### Q: Does deploying the app configure each admin? A: No. Each admin still signs in and chooses storage. Sign-ins, backup keys and settings belong to the user account on that device. ## Related guides - [Intune backup tool](https://www.tenuvault.com/intune-backup) - [Does Microsoft Intune have a built-in backup?](https://www.tenuvault.com/guides/does-intune-have-backup) - [Download Intune PowerShell scripts](https://www.tenuvault.com/guides/download-intune-powershell-scripts) - [Encrypt Intune backups](https://www.tenuvault.com/guides/encrypt-intune-backups) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)