TenuVaultDesktopPractical guide
Watch Intune changes while your PC is off
To watch Intune changes while your PC is off, configure TenuVault’s Azure watcher in your own Azure subscription. This shipped PowerShell runbook uses a managed identity and scheduled audit checks. It runs hourly by default, with 15, 20 or 30-minute options, rather than delivering instant change alerts.
Why does desktop watching stop overnight?
The app watches while TenuVault is running and you are signed in. Switching the PC off, sleeping it or ending the sign-in stops those checks. Sending the destination to Teams or email does not change where the audit-reading process runs. Cloud storage alone also does not create a watcher.
Microsoft provides Intune audit logs and native routing to Azure Monitor. The TenuVault Azure watcher is a separate way to read scheduled changes and deliver selected notifications. Keep its setup, permissions, alert rules and health monitoring distinct from the backup schedule even if both use the same storage account.
How do I watch Intune changes while my PC is off?
1. Confirm Azure backup storage and the intended Teams, webhook or email destination. In Alerts, Set up alerts, choose Also from Azure, set up from TenuVault. Review the subscription, resource group, Automation account, region and failure-alert address.
2. Choose Check Azure. The read-only check confirms the subscription and storage context and reports what the current sign-in may do. Follow the setup instructions for an Azure owner or administrator where the app cannot complete the required provisioning.
3. Turn on alerts and verify the first watcher run. In-app handover requires fresh health evidence from the selected watcher showing that it read the required services and storage with the intended alerts and no error. Pasting setup details alone does not complete that verification.
Which Azure watcher schedule should I choose?
The watcher runs hourly by default. ScheduleIntervalHours makes it less frequent. The setup script’s ScheduleIntervalMinutes accepts 15, 20 or 30 for more frequent checks. The script spreads multiple hourly schedules across the hour, because a single Azure Automation schedule runs at most hourly.
Choose the cadence from your acceptable detection delay and Automation job usage. Rerunning the setup script without ScheduleIntervalMinutes returns it to one hourly schedule and removes the extra schedules. A successful deployment is not proof that the schedule you intended is active: inspect the configured cadence and a subsequent job.
How do I avoid gaps and duplicate alerts during handover?
Include Conditional Access in watcher setup before handing that service over. Otherwise the watcher can be healthy while Conditional Access alerts stop. Watcher email also has separate sender restriction and verification steps; it is not enabled merely by reusing a desktop email rule.
Once an Azure watcher owns change alerts, desktop polling stands down for both services. Update watcher writes the current alert rules for its next run; check that the card becomes Up to date. A short setup overlap can deliver duplicates, so downstream receivers should use the stable event IDs where available.
How can I try this on my tenant?
Download TenuVault and complete an approved watcher setup. Use one test-policy edit, verify the scheduled job and destination message, then repeat with the desktop app closed. Record the cadence, job result, event time and receipt time. This demonstrates your actual off-computer coverage rather than assuming it from the deployment screen.
Configure the independent Azure Monitor failure alert with AlertEmail unless you deliberately choose NoFailureAlert. A fresh heartbeat is useful health evidence, but a failed run may still write one. Review job failures as well as stale-heartbeat warnings. Keep an owner for subscription access, destination rotation, job costs and future watcher upgrades.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Has the Azure watcher shipped?+
Yes. The current documentation describes its in-app and script setup, runbook, alert-rule synchronization and health checks.
Is the cloud default every 15 minutes?+
No. Desktop watching defaults to 15 minutes. The Azure watcher defaults to hourly and supports 15, 20 or 30-minute scheduling through setup.
Does a healthy heartbeat prove every alert was delivered?+
No. Check job results, configured services, active rules and destination delivery as well. Independent job-failure monitoring covers failures that a stale check alone can miss.