# Onboard an Intune tenant with a baseline | TenuVault Onboard an Intune tenant with a baseline using an approved source or OpenIntuneBaseline. Review customer differences, back up first and verify assignments. Canonical: https://www.tenuvault.com/guides/onboard-an-intune-tenant-with-a-baseline Practical guide # Onboard an Intune tenant with a baseline Onboard an Intune tenant with a baseline by choosing an approved configuration source, reviewing the customer target and separating policy creation from assignment. Use Sync for selected policies from your standard tenant, or the OpenIntuneBaseline workflow for its baseline packs. Take a backup before customer changes. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Can I use native Intune policies for customer setup? Intune lets administrators create policies and import exported Settings Catalog JSON. That gives a new customer a way to start from existing configuration. The onboarding procedure still needs to decide which settings fit the customer, what already exists and how the policies will be assigned. A baseline is a starting configuration, so agree on the customer requirements before importing anything. Identify the supported platforms, existing management policies, operational exceptions and administrator responsible for targeting. Keep device migration in a separate plan if the customer is also moving between tenants. - [Microsoft Learn: Settings Catalog policy export and import](https://learn.microsoft.com/en-us/intune/intune-service/configuration/settings-catalog) ## How do I onboard an Intune tenant with a baseline? 1\. Connect the customer tenant and configure backup storage. Follow the backup setup guide to verify a first backup before making changes. Even a new tenant may contain enrollment settings or policies created during preparation. Record what exists instead of assuming the destination is empty. 2\. Choose the source. Use OpenIntuneBaseline when you want to review and deploy that project's platform configuration. Use Sync when your organization has already approved selected policies in a source tenant. Keep the baseline origin and the customer decision in the onboarding record so the next administrator can explain it. 3\. Check the plan for the selected path. Community Free includes OpenIntuneBaseline deployment, comparison and validation. Pro adds baseline management that creates only what is missing. MSP includes bulk restore and baseline rollout across tenants. Sync between several customer targets needs MSP for every participating tenant. | Source | Use when | Review focus | | --- | --- | --- | | Sync | Selected policies already approved in a source tenant | Live customer state, same-name policies and secrets | | OpenIntuneBaseline | Starting from a platform baseline pack | Platform fit, existing policies and validation | ## How do I use an approved source tenant? 4\. Open Sync, select the source and choose the supported policies, up to 25 per sync. Select the new customer target and review its live state. Read each Create, Update and same-name warning before approval. A same-name policy in the customer is not automatically linked to the source. Keep Back up first selected and check that the target backup scope covers the policy types you intend to change. Resolve blocked results before proceeding. Newly created policies are unassigned, existing assignments stay as they are, and masked secrets must be entered separately in the customer tenant. After application, inspect each verified result in the target and record any failed or uncertain operation before retrying. Keep the operating computer and backup storage available for rollback. Sync is started manually, so the customer will not receive later source edits until you review another sync. ## How do I start with OpenIntuneBaseline instead? Open the OpenIntuneBaseline section and review the platform pack that fits the customer. Use New Deployment for a fresh installation and review the existing-deployment workflow when the customer already has baseline policies. Follow the documented review, deployment and validation steps for that route. Do not treat every recommended setting as suitable for every customer. Review authentication, application compatibility and support requirements with the customer owner. Document deliberate changes so a later baseline review can tell an approved customization from an accidental deviation. The baseline comparison and validation results support that conversation. After deployment, inspect created configuration and assignments before exposing production devices. Keep a small pilot group and an observation period in the customer rollout procedure. A baseline can be configured correctly and still need customer-specific testing before wider assignment. ## What should I hand over after onboarding? Record the source version or selected source policies, backup timestamp, created policy identities, exceptions and targeting owner. Include the schedule owner and a restore-drill date. For an MSP, add the customer to the operational review routine so a completed onboarding does not become an unmaintained configuration. Try it on your tenant with a small unassigned selection before onboarding a full customer. Compare the resulting policies with the approved source, review recovery steps and record the outcome. Download TenuVault, then use the existing baseline comparison and migration guides for the adjacent tasks. - [OpenIntuneBaseline workflows](https://www.tenuvault.com/openintunebaseline) - [Choose a baseline source](https://www.tenuvault.com/guides/openintunebaseline-vs-microsoft-security-baselines) - [Plan the wider tenant migration](https://www.tenuvault.com/guides/intune-tenant-to-tenant-migration) - [Verify the first backup](https://www.tenuvault.com/guides/intune-backup-setup) - [Include Autopilot profiles in the onboarding backup](https://www.tenuvault.com/guides/back-up-intune-autopilot-profiles) - [Download TenuVault](https://www.tenuvault.com/download) - [Compare plans and features](https://www.tenuvault.com/pricing) ## Read the technical guides - [Onboard an Intune tenant with a baseline documentation](https://docs.tenuvault.com/baselines/quick-start/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Is OpenIntuneBaseline deployment included in Community Free? A: Yes. The pricing page includes deployment, comparison and validation. Paid baseline management and multi-tenant rollout have separate plan scope. ### Q: Does Sync assign the new customer policies? A: No. New policies are unassigned. Review and implement customer targeting separately. ### Q: Will later source changes reach the customer automatically? A: No. Sync is one way and runs only when started. Review another sync for later source changes. ## Related guides - [OpenIntuneBaseline](https://www.tenuvault.com/openintunebaseline) - [OpenIntuneBaseline vs Microsoft security baselines](https://www.tenuvault.com/guides/openintunebaseline-vs-microsoft-security-baselines) - [Recheck CIS compliance in Intune](https://www.tenuvault.com/guides/recheck-cis-compliance-in-intune) - [SOC 2 Intune evidence](https://www.tenuvault.com/guides/soc-2-intune-evidence) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)