TenuVaultDesktopPractical guide
Intune backup retention
Intune backup retention should cover the time your team may need to recognize and reverse a bad change. Community Free includes 30 days of backup history; Pro and MSP provide custom retention. Agree the value across administrators because each computer applies its setting to the tenant's shared backup location.
Can native policy exports provide retained history?
You can keep dated Settings Catalog exports in a controlled location and manage their lifetime through your own process. That requires someone to maintain collection frequency, naming, access and deletion. A file that remains in a folder is useful only if you can identify its tenant, collection time and intended recovery scope.
Choose a retention period from an operational question: how far back might the team need a usable configuration? Consider delayed incident discovery, change review intervals and the time needed to validate a replacement policy. Record that decision with the backup schedule rather than choosing a number solely to reduce storage.
How do I set Intune backup retention?
1. Review the pricing page. Community Free includes 30 days of backup history. Pro adds daily schedules and custom retention, and MSP includes Pro features. On Community, a longer setting or Forever still counts as 30 days for that tenant. Do not use a paid-plan setting as evidence of Community coverage.
2. Open Settings and go to Background runner. Under Keep backups for, choose 7, 14, 30, 60, 90, 180 or 365 days, or Forever. The default is 30 days. This computer-wide setting applies to its tenants; the Schedule tab's Kept for field shows what applies to the selected tenant.
3. Record the selected value on every computer using a shared storage account. Retention acts on backups made by other admins too. The shortest setting wins, so a second admin keeping 14 days can remove eligible shared backups even when the schedule owner intended a longer history.
When does TenuVault remove old backups?
Cleanup runs at the end of a backup that saved every selected policy. A failed backup or one that left policies unsaved deletes nothing. The backup that just completed is never deleted. Review the backup log if older history remains instead of assuming the chosen age is an immediate deletion deadline.
A backup that excludes some types does not remove the newest complete copy of those types. For example, a configuration-only run must not age out the newest complete app backup merely because apps were excluded today. A run with warnings does not count as a complete newest copy for this protection.
Unreadable or damaged device files can pause retention. Resolve the key or file problem and check the next backup log. Storage immutability and legal holds can also prevent removal. Retention deletes backup folders; it does not delete audit log events. Keep those lifetimes separate in the operating procedure.
How does retention work with cloud backup identities?
Azure backups made by Backup Reader or cloud backups delete nothing because those identities have no delete permission. The next backup made with an administrator's own sign-in applies retention to the tenant's backups. If a tenant uses only cloud runs, include an occasional desktop sign-in backup in the maintenance routine.
Do not replace this behavior with a simple age-based storage lifecycle rule. The documentation warns that such a rule lacks the app's retention protections and can delete every old backup after cloud collection stops long enough. Any independent storage cleanup policy needs a deliberate recovery review.
Changing a tenant's storage location sends new backups to the new destination. Existing backups stay in the previous location and are listed while that location is selected. Include both locations in a transition record so a retention discussion does not accidentally overlook the older recovery history.
How do I try it on my tenant?
Choose an approved retention value, inspect Kept for and run a complete backup. Review the result and cleanup log, then confirm that the backups you expect remain listed. Repeat the check from another admin computer when using shared storage. Keep an independent recovery drill in the calendar, because an age setting does not prove restorability.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can Community Free keep a year of history?+
Community Free includes 30 days of backup history. Longer settings, including Forever, count as 30 days for Community tenants.
Why are expired cloud backups still present?+
Cloud and Backup Reader identities in Azure cannot delete. A later desktop backup using an administrator's own sign-in applies retention.
Does each admin control only their own backups?+
No. Retention applies across the tenant's storage location. Agree one value because the shortest setting among administrators wins.