TenuVaultDesktopPractical guide
Keep an Intune golden configuration
Keep an Intune golden configuration by saving an approved version, documenting customer differences and reviewing changes before deployment. My baselines maintains your own Settings Catalog baseline on Pro and MSP. Governance Golden standards adds versioned customer standards and overlays on MSP.
Can a native Intune export be my standard?
A Settings Catalog JSON export is useful source material for a standard. A folder of exports still needs version ownership, a reason for each change and a decision about how each customer differs. Record those decisions before treating the current state of one tenant as the configuration every customer should receive.
Choose whether you are maintaining one organization baseline or a standard adopted across customers. Keep the approved source separate from the evidence collected from tenants. A customer exception should explain a deliberate difference, with an owner and review date, rather than silently changing the shared source.
How do I keep an Intune golden configuration?
1. Open Frameworks and choose My baselines. Start from a platform under OpenIntuneBaseline using Customize, or choose Company baseline from a backup. The backup route requires a complete successful backup with every Settings Catalog file readable. Only Settings Catalog policies become part of this baseline.
2. Review what was retained. A baseline from backup removes IDs, assignments and scope tags. Secret values are never stored, and settings with secrets or tenant-specific reusable references are marked not portable. Remove those settings before deployment. Keep any manual setup needed for the customer in the change record.
3. Edit the baseline settings, then save with a change note. Each save creates a new version; earlier versions remain unchanged in History. Use a note that explains the operational reason and expected effect, so another administrator can decide whether the new version belongs in a particular tenant.
How do I deploy a reviewed baseline version?
4. Compare the saved version with the tenant or a framework before deployment. Tenant comparison can use the latest complete backup or a live read. Framework comparison uses the baseline, not live tenant evidence. Anything dependent on assignments or absent policy types stays unknown rather than becoming a claimed match.
5. Select Deploy and inspect the planned target. A same-name policy, ignoring its version suffix, is updated in place and keeps assignments and scope tags. Other policies are created unassigned with the Default scope tag. This matching behavior differs from Sync, so read the actual plan before approval.
Deployment uses a reviewed change set with a backup before writes, read-back verification and rollback as another reviewed change set. Assignments are never written. A change set contains at most 25 policies. Approve a version for a named target instead of assuming a saved baseline has already changed any tenant.
How do I maintain customer standards on MSP?
In Governance, open Golden standards and publish a standard from Settings Catalog exports or the latest OpenIntuneBaseline release for a platform. Record the key, name, source and change notes. Use parameters for tenant-specific values and bind tenant references to reference parameters. Published versions are immutable.
For a customer adoption, set parameters and choose whether each policy creates a new policy or updates an existing policy ID. Keep the customer Overlay separate from the base. Save configuration, preview effective settings and assess deviation. Create a change set only when the preview is ready, then review, approve and apply.
A new published version does not change customers automatically. Each customer keeps its adopted version until you adopt a newer one. Document customizations in Governance, and resolve baseline update conflicts deliberately. This makes a customer exception visible without redefining the standard for everyone.
How do I try it on my tenant?
Create one small baseline from an approved successful backup. Save a second version with a clear change note, compare the versions and inspect a deployment plan before writing. On MSP, try a customer overlay and inspect its effective settings. Download TenuVault and check the plan table before selecting your standard-management workflow.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Are My baselines and free Custom Baselines the same?+
No. My baselines provides versioned editing and reviewed deployment on Pro and MSP. The imported Custom Baselines comparison framework remains free.
Does publishing a standard update customers?+
No. Customers keep their adopted version until a newer version goes through adoption and the reviewed change flow.
Can a baseline comparison prove device enforcement?+
No. It compares configuration within its scope. Baselines contain no assignments, and dependent findings remain unknown.