TenuVaultDesktopPractical guide
Share Intune backups between admins
Share Intune backups between admins by selecting the same Azure storage account on each administrator's computer. Each admin signs in with their own account through the tenant's existing app registration. Azure backups are plain JSON protected by Azure encryption at rest and role assignments, with no recovery key to share.
Can separate Intune admins use the same configuration?
Intune administrators can work on the same tenant according to their assigned roles. Native access to live policies does not establish a shared TenuVault backup location, recovery procedure or schedule owner. Those choices need to be part of the team setup so another admin can recover configuration when the usual operator is unavailable.
This guide covers adding another admin to an existing backup setup. Use the Azure storage guide for initial account preparation and the general backup setup guide for the first backup. Agree who approves restores and who reviews failures before giving the team a shared location.
How do I share Intune backups between admins?
1. Reuse one app registration per tenant. Give the second admin the tenant ID and client ID, then have them sign in with their own account. The client ID is shared configuration, not a password. Each person needs an Intune role covering the policies they intend to read or restore.
2. Give the admin group Storage Blob Data Contributor and storage account read access, such as Reader, as described in the multiple-admin documentation. Check any sign-in restrictions and storage network rules. Agree membership of that group with the tenant owner, because storage access exposes backup content.
3. Install TenuVault on the second computer and select Connect your tenant. On Prepare, skip the setup script because the registration already exists. Continue to sign-in with the tenant and client IDs. Do not create another registration merely to add a colleague to the same tenant.
4. On Storage, choose Your Azure storage account, select the same account and run Check access. Existing backups appear in Backup & Restore. Pro and MSP include Azure storage, while Community Free includes encrypted local storage. Check installation coverage on the pricing page before adding more admin devices.
Who can read and change shared Azure backups?
Everyone with blob read access can read the plain JSON, including plain-text secret OMA-URI values captured for recovery. Azure encrypts the stored data at rest; TenuVault does not apply its device backup encryption to these files. A recovery key does not limit who can read an Azure backup.
Treat anyone who can write to the backup container as trusted like an Intune admin. A restore uses the content in storage, so a changed backup can change what a later restore writes. Keep blob roles restricted to the Intune admin group and maintain the documented storage recovery protections.
Device and network-share backups remain encrypted. Another computer needs the recovery key that made those files. Earlier Azure backups encrypted by older TenuVault versions also need their originating key on another computer. Newer plain Azure backups remain usable while an older encrypted backup needs a key import.
Which settings remain on each computer?
5. Assign one schedule owner or use the documented cloud backup option. Desktop schedules run independently while the app runs. Two admins enabling a daily schedule produce two backups per day. Sharing storage does not coordinate those schedules or copy notification preferences between computers.
6. Agree on Keep backups for on every computer. Each admin's retention setting acts on the tenant's shared backup location, so the shortest setting wins. Record the value in the team procedure and review it when someone joins or replaces an admin workstation.
Sign-ins, token caches, appearance, branding and other settings remain per computer. License sharing is a separate tenant action by the license holder. Keep the team handover focused on the existing registration, shared storage account, roles, schedule owner and agreed retention rather than copying a user profile.
How do I try it on my tenant?
Have a second authorized admin connect and inspect an existing backup without restoring it. Confirm the same backup timestamp and scope appear on both computers. Then run your approved restore drill from the second machine and retain the result, giving the team evidence that recovery works beyond the original workstation.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Do Azure backups need a shared recovery key?+
Current Azure backups do not. They are plain JSON protected by Azure storage controls. Older encrypted Azure backups still need the original recovery key.
Does the schedule follow the shared storage account?+
No. Desktop schedules stay on each computer. Agree one runner or use the documented cloud backup workflow.
Whose retention setting applies?+
Each computer applies its setting to the shared location. The shortest retention among the admins wins.