TenuVaultDesktopPractical guide
How to update OpenIntuneBaseline without losing your changes
OpenIntuneBaseline publishes new releases per platform, and updating means bringing your deployed policies up to the new version without overwriting the settings you changed on purpose. Find which policies are outdated, read the release's changelog, then either create the new version next to the old one or update the existing policy in place. If you customized the baseline, compare three ways: the version you deployed, your tenant and the new release. TenuVault does each step, and backs up the tenant before it changes an existing policy.
At a glance
- OpenIntuneBaseline publishes releases per platform, tagged for example windows-v4.0, and keeps a changelog per platform.
- Updating a policy in place replaces its settings with the new version, so settings you changed yourself are overwritten unless you carry them over.
- TenuVault matches deployed OIB policies by the OIBID in the policy description first, then by the policy name without its version.
- Creating the new version alongside the old policy is available on every TenuVault plan; updating in place keeps assignments, filters and scope tags and needs Pro or MSP.
- TenuVault Pro and MSP can rebase a customized baseline onto a new OIB release: untouched OIB changes are taken over, your edits are kept and conflicts need your decision.
1. Find out what changed
Each OpenIntuneBaseline platform has its own releases and changelog. Read the changelog for the release you are moving to before touching the tenant: it explains new, changed and retired policies and why.
Then find which of your deployed policies are behind. In TenuVault, Existing Deployment compares the tenant with the selected OIB version and labels each policy Up to date, Update available, New, Newer than OIB or Ambiguous. Deprecated OIB policies that are still deployed, and older versions still deployed next to a newer one, are listed for review. TenuVault does not remove them for you.
2. Choose side by side or in place
There are two ways to bring an outdated policy up to date, and they suit different situations.
- Side by side is the cautious path: both versions exist for a while, so assign the new one to a pilot group and make sure the two do not target the same devices.
- In place is faster but replaces every setting in the policy, including any you changed yourself. Use it for policies you never customized, or carry your changes over as described below.
| Option | What happens | Plans |
|---|---|---|
| Create the new version alongside | The new version is created as a new policy and the old one stays unchanged, so you can pilot the new one and retire the old one later | Community, Pro and MSP |
| Update the existing policy in place | The policy's settings are replaced with the new version; assignments, assignment filters and scope tags stay | Pro and MSP |
3. Keep your own changes
Most tenants change a few baseline settings. To keep those decisions through an upgrade, compare three versions of each setting: the OIB version you originally deployed, what your tenant has now and the new OIB release. Settings only OIB changed can be taken over, settings only you changed should stay, and settings both changed need a decision.
TenuVault Pro and MSP do this in two places. In Changes, Baseline upgrades records an OIB deployment as an installed baseline and compares the deployed version, your tenant and the latest release. In My baselines, a customized OIB baseline offers OIB updates: Compare shows each setting three ways, and Create rebased version saves a new version on the latest release with your edits kept. Neither reads or changes the tenant until you deploy through a reviewed change set.
Document why you changed each setting. Governance in TenuVault records organization customizations with an owner and reason, so the next person upgrading knows a difference is deliberate.
4. Deploy safely and verify
Back up first. In TenuVault, in-place updates and drift fixes require backup storage and always back up the tenant first; for runs that only create new policies the backup is optional and on by default. Every deployment run can be undone. After the update, run Policy Validation to confirm the deployed policies match the new version setting by setting, except where you kept your own values.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
How do I know if my OpenIntuneBaseline is out of date?+
Compare your deployed policies with the latest release for each platform. OIB policies carry their version in their name, and newer ones an OIBID in their description. TenuVault's Existing Deployment does the comparison and marks each policy Up to date, Update available, New or Newer than OIB.
Will updating OpenIntuneBaseline remove my assignments?+
Not in TenuVault. Updating in place replaces the policy's settings and keeps its assignments, assignment filters and scope tags. Creating the new version alongside leaves the old policy untouched and creates the new one unassigned by default.
Will an update overwrite settings I changed?+
An in-place update replaces all settings of the policy with the new version, so yes, unless you carry your changes over. A three-way comparison of the deployed version, your tenant and the new release shows which of your edits to keep.
Can I go back to the previous OpenIntuneBaseline version?+
Yes, if you have a backup from before the update. TenuVault backs up before in-place updates and can undo a deployment run. You can also pin a platform to an earlier published release when you deploy.