# Intune Backup and Restore for Windows and macOS | TenuVault Back up and restore Microsoft Intune configuration with a desktop app for Windows and macOS. Detect drift, deploy OpenIntuneBaseline and start free. Canonical: https://www.tenuvault.com/ [**CIS**CIS Benchmarks Certified for Assessment and Remediation](#frameworks) # Intune _backup and restore_ with hardened _baselines_ built in A desktop app for Intune admins and [MSPs](https://www.tenuvault.com/solutions/msps), on Windows and macOS. It signs in as you, and your configuration never passes through a TenuVault server. [Download for Windows](https://www.tenuvault.com/download/windows)[![Get it from Microsoft](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fmicrosoft-store-badge.png&w=1920&q=75)](https://apps.microsoft.com/detail/xpfp6qq47l0gdk?cid=website-hero) [Download for Mac](https://www.tenuvault.com/download/mac-arm64) For Apple silicon Macs.Intel Mac? [Get the Intel build](https://www.tenuvault.com/download/mac-x64) Free to download. Every new tenant starts with 14 days of Pro, with no card and no email.Prefer a walkthrough? [Book a demo](https://cal.com/ugur-koc/tenuvault-demo) ![TenuVault Desktop dashboard for the Contoso tenant with backup coverage, drift and license status](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Fdashboard-light.webp&w=3840&q=75) Every tenant in one app Switch between tenants in one window. Pro includes two tenants, MSP starts at five. [Learn more](https://www.tenuvault.com/pricing) Drift detection See what changed between backups, down to the setting. Revert changes in place on Pro. [Learn more](https://www.tenuvault.com/intune-drift-detection) Sync between tenants Copy selected policies from one tenant to others, one way and only when you start it. Each target is reviewed against its live state, backed up first and can be rolled back. Pro and MSP. [Learn more](https://www.tenuvault.com/guides/copy-intune-policies-between-tenants) Change alerts Teams, email or webhook alerts for failed backups and policy changes. Pro and MSP. [Learn more](https://www.tenuvault.com/intune-alerts) Backups on a schedule Every policy with its assignments, encrypted on this device or kept in your own Azure storage on Pro. [Learn more](https://www.tenuvault.com/intune-backup) Restore what you need Restore any item as an unassigned copy, or in place with its assignments on Pro. [Learn more](https://www.tenuvault.com/intune-restore) Every policy type Settings Catalog, device configurations, compliance, scripts, Administrative Templates and more. [Learn more](https://www.tenuvault.com/intune-backup) OpenIntuneBaseline built in A backup runs first, new policies start unassigned and every run can be undone. Compare and validate it too. [Learn more](https://www.tenuvault.com/openintunebaseline) - [Backup, restore and drift](https://www.tenuvault.com/intune-backup) Scheduled, encrypted backups. Restores with their assignments. Drift between backups, down to the setting. - [OpenIntuneBaseline, end to end](https://www.tenuvault.com/openintunebaseline) Deploy for Windows, macOS, Windows 365 and BYOD, compare with newer versions and validate every setting. New policies start unassigned and every run can be undone. Drift fixes on Pro. - [Sync between tenants](https://www.tenuvault.com/guides/copy-intune-policies-between-tenants) Copy selected policies from one tenant to others, reviewed per target and reversible, or promote tested settings from Dev to Prod. Pro and MSP. - [Change alerts](https://www.tenuvault.com/intune-alerts) Teams, email or webhook alerts when policies are created, changed, deleted or unassigned. The Azure watcher keeps checking while your computer is off. Pro and MSP. - [CIS Benchmarks Certified](#frameworks) Assessment and remediation for the certified Windows 11, Microsoft Defender and macOS benchmarks. Available in Pro and MSP. ![CIS SecureSuite Member](https://www.tenuvault.com/_next/image?url=%2Fbadges%2Fcis-securesuite-membership.png&w=256&q=75) Sign in with your own admin account , encrypt backups on this device or keep them in your own Azure storage , and every change carries your name. In numbers ## Built for Intune admins who keep their configuration in-house - 1,000+ Downloads - 40 Intune object types in a backup, with assignments where Intune has them - 9 Frameworks to compare your Intune settings with, included in Community OpenIntuneBaseline, built in ## The community baseline, _three_ workflows away OpenIntuneBaseline is the open Intune baseline by SkipToTheEndpoint and contributors. It stays independent and works with any tool. TenuVault loads the latest version from GitHub and helps you deploy it, keep it current and check it for drift. 1New DeploymentDeploy OpenIntuneBaseline policies to a tenant for the first time. - Windows, macOS, Windows 365 and BYOD app protection - Licensing aware: policies the tenant cannot use are filtered out - Policies already in the tenant are left out 2Existing DeploymentCompare the policies you deployed with the latest version.3Policy ValidationCheck deployed policies for drift, setting by setting. ![New Deployment in TenuVault Desktop listing OpenIntuneBaseline Windows policies, with new policies selected and policies already in the tenant left out](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Foib-new-select.webp&w=3840&q=75) - ### Unassigned by default New policies reach no device until you assign them, or go to one pilot group. - ### Backup first On by default once backup storage is set up: a full backup runs before anything changes, and if it fails, nothing is changed. - ### Undo per run Undo deletes what a run created and puts back what it updated. - ### Your own baselinePro Customize a platform into your own versioned baseline and compare it with newer OIB versions. OpenIntuneBaseline content: SkipToTheEndpoint and contributors, GPL-3.0. [View on GitHub](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline) · [Read the docs](https://docs.tenuvault.com/baselines/quick-start/) ## And the frameworks you report on Compare your Intune settings with independent, versioned framework mappings. Read-only, with PDF, CSV and JSON reports, included in Community. - NIST CSF 2.0 - NIST SP 800-53 Rev. 5 - NIST SP 800-171 - ASD Essential Eight - Cyber Essentials - ISO/IEC 27001:2022 - SOC 2 - BSI IT-Grundschutz - Def Stan 05-138 - [CIS Benchmarks in Pro and MSP](https://www.tenuvault.com/guides/cis-benchmarks-with-intune) A technical configuration comparison, not an audit, and it does not certify your tenant. Apart from the CIS certification of TenuVault described below, no publisher endorsement is implied. **CIS certification scope.** TenuVault is CIS Benchmarks Certified for Assessment and Remediation. The certification covers only the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 (Level 1), CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 (Level 1 and Level 2) and CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 (Level 1 and Level 2). TenuVault remediates only the recommendations it assesses automatically through Intune policy settings. It lists Manual and not assessed recommendations with their CIS guidance for manual action. CIS, CIS Benchmarks and CIS Controls are trademarks of the Center for Internet Security, Inc. ![Frameworks in TenuVault Desktop listing NIST, ASD Essential Eight, BSI IT-Grundschutz and other framework comparisons](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Fframeworks-light.webp&w=3840&q=75) ## From baseline to recovery, in one desktop app Deploy the baseline, protect it with backups, see what drifted and put back exactly what you need. ### Start from OpenIntuneBaseline New Deployment creates the OpenIntuneBaseline policies that suit the tenant, unassigned or for a pilot group. Existing Deployment compares what you deployed with the latest version, and Policy Validation checks every setting for drift. - Windows, macOS, Windows 365 and BYOD app protection (Community) - Update outdated policies and fix drift in place (Pro) - Deploy the same policies to more tenants, one after another (MSP) ### Protect every policy, on a schedule Settings Catalog, device configurations, compliance, scripts, Administrative Templates and more, with assignments. Encrypted on this device, or kept in your own Azure storage on Pro. - Manual and weekly backups, 30 days of history (Community) - Daily backups and backups to your own Azure storage (Pro) - AES-256 encryption on this device, key protected by DPAPI or Keychain ### Put back exactly what you need Restore any item as a separate copy. Pro replaces policies in place and restores assignments. Cross tenant copies arrive unassigned. - Restore single items as unassigned copies (Community) - Replace policies in place and restore their assignments (Pro) - Copy into another tenant, unassigned and with reviewed dependencies (MSP) ### Know exactly what changed Compare your two newest backups and see every added, changed and deleted item, with each changed setting. Export the drift as JSON or CSV. - Old and new value for every changed setting (Community) - Restore the previous version of an item as a copy (Community) - Revert changed items and recreate deleted ones in place (Pro) ### Start from OpenIntuneBaseline OpenIntuneBaseline ![The OpenIntuneBaseline section of TenuVault Desktop with New Deployment, Existing Deployment and Policy Validation](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Foib-home-light.webp&w=3840&q=75) 01 Deploy, compare and validate the community baseline for Windows, macOS, Windows 365 and BYOD. [Read the openintunebaseline guide](https://www.tenuvault.com/openintunebaseline) ### Protect every policy, on a schedule Backup ![Automatic backup schedule in TenuVault Desktop](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Fbackup-schedule-light.webp&w=3840&q=75) 02 Every policy type that matters, with assignments, encrypted on this device. [Read the backup guide](https://www.tenuvault.com/intune-backup) ### Put back exactly what you need Restore ![Backup timeline with the Restore tab in TenuVault Desktop](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Fbackup-history-light.webp&w=3840&q=75) 03 Restore any item as a copy, or in place with its assignments on Pro. [Read the restore guide](https://www.tenuvault.com/intune-restore) ### Know exactly what changed Drift Detection ![Drift detection comparing the two newest backups](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fscreens%2Fdrift-dark.webp&w=3840&q=75) 04 See what changed between backups, down to the setting. [Read the drift detection guide](https://www.tenuvault.com/intune-drift-detection) Plan your [Intune disaster recovery](https://www.tenuvault.com/intune-disaster-recovery) and configure [Intune change alerts](https://www.tenuvault.com/intune-alerts) before the next policy change. ## Your data, your keys, built for locked down tenants When Conditional Access or policy rules out third party portals, TenuVault Desktop still fits. It is a public client in your own tenant, with no secret. Only license checks and CIS Benchmarks downloads go to tenuvault.com. Tenant configuration, backups and your Microsoft access token never do. - MFA and Conditional Access apply, exactly like the Intune portal - Every change is attributed to you in Entra and Intune audit logs - Restrict sign in to one security group with the -AllowedGroupId setup script parameter [Visit the Trust Center](https://www.tenuvault.com/trust)[Permissions and data flows](https://www.tenuvault.com/trust#permissions) Device backup encryption**AES-256** Tenant data on our servers**0 bytes** Device key protected by**DPAPI or Keychain** Client secrets**None** ## One flat price, unlimited devices No per device pricing, on any plan. Community is free for one tenant and includes OpenIntuneBaseline for Windows, macOS, Windows 365 and BYOD. Pro includes two tenants, daily backups and your own Azure storage. Try it free for 14 days without email or a card. The new MSP offer includes five tenants. Prices in EUR, excluding VAT. ## Plans in EUR, excluding VAT | Plan | Monthly | Yearly | Tenants | | --- | --- | --- | --- | | Community Free | €0 EUR per month | €0 EUR per year | 1 included | | Pro | €49 EUR per month | €490 EUR per year | 2 included | | MSP | €99 EUR per month | €990 EUR per year | 5 included | ### MSP tenant bands | Tenants | Additional tenants per month | Additional tenants per year | | --- | --- | --- | | 1 to 5 | €0 EUR per tenant per month | €0 EUR per tenant per year | | 6 to 25 | €15 EUR per tenant per month | €150 EUR per tenant per year | | 26+ | €10 EUR per tenant per month | €100 EUR per tenant per year | MonthlyYearly2 months free ### Community Free For admins who want a real safety net for one tenant. Free Unlimited devices, no per device fees Forever. No paid license or TenuVault web account. [Download](https://www.tenuvault.com/download) Recommended ### Pro For organizations that must recover fast and control change. €49per month Excl. VAT, added at checkout. Business VAT IDs accepted. Unlimited devices, no per device fees 2 tenants, billed monthly. [Start free trial](https://www.tenuvault.com/trial?src=pricing) Every new tenant starts with 14 days of Pro. No card and no email. Afterwards, keep using TenuVault free on Community with one tenant. Need longer? Extend once in the app. Need a quote or invoice? [Get a yearly quote as a PDF](https://www.tenuvault.com/quote?plan=pro). Buy now Card, Apple Pay or Google Pay. Yearly plans can also be [paid by invoice](https://www.tenuvault.com/quote). ### MSP For service providers and organizations with 5 or more tenants. from€99per month Excl. VAT, added at checkout. Business VAT IDs accepted. Unlimited devices, no per device fees Includes 5 tenants. Add more with graduated pricing. [Start free trial](https://www.tenuvault.com/trial?src=pricing-msp) Every new tenant starts with 14 days of Pro. No card and no email. Afterwards, keep using TenuVault free on Community with one tenant. Buy now Card, Apple Pay or Google Pay. Yearly plans can also be [paid by invoice](https://www.tenuvault.com/quote). Trial MSP with 5 tenants (card required) **Buying through procurement?** For yearly plans, create a PDF quote in a minute, order with your purchase order and pay by invoice and bank transfer. [Get a quote](https://www.tenuvault.com/quote) or [email us](mailto:support@tenuvault.com?subject=TenuVault%20Desktop%20invoice%20or%20quote%20request). Evaluate first with the [14 day trial](https://www.tenuvault.com/trial?src=pricing), no credit card needed. ## Unlimited devices on every plan. No per device pricing. TenuVault charges per tenant, with no fee for each additional device. Every managed device in a licensed tenant is covered, whether you manage 50 or 50,000. Price per device €0 Device limit None Example: Pro costs €49 per month for 5,000 devices, about €0.01 per device. Double the fleet and the price stays the same. ## Free Pro for nonprofits worldwide Eligible nonprofits receive Pro at no cost after individual verification. No payment card required. [Apply for free Pro](https://www.tenuvault.com/nonprofits) [Compare every feature](https://www.tenuvault.com/pricing)Already a customer? [Manage your subscription](https://polar.sh/ugurlabs/portal) ## Frequently asked ### Q: What is OpenIntuneBaseline, and who maintains it? A: An open Intune baseline for Windows, macOS, Windows 365 and BYOD, maintained by SkipToTheEndpoint and contributors under GPL-3.0. It is independent and works with any tool. TenuVault loads the latest version straight from [GitHub](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline). ### Q: Will a baseline deployment change my devices? A: Not until you assign the policies. New policies are created unassigned, or assigned only to a pilot group you enter, and policies already in the tenant are left out. A backup runs first unless you turn it off, and every run can be undone: undo deletes what the run created and puts back the previous version of what it updated. ### Q: Does any tenant data reach TenuVault servers? A: No. Tenant data and your Microsoft access token never reach a TenuVault server. The app talks to Microsoft for sign in, Microsoft Graph and Azure, and to GitHub for updates and OpenIntuneBaseline files. License checks go to tenuvault.com and can include a Microsoft ID token as proof of the tenant; it is verified and never stored. On Pro and MSP, CIS Benchmarks content also downloads from tenuvault.com. ### Q: Which permissions does the app registration need? A: Delegated Microsoft Graph permissions for Intune configuration, apps, scripts and RBAC, plus Azure Storage only if backups go to your own storage account. The setup script lists and grants them. See the [full list in the Trust Center](https://www.tenuvault.com/trust#permissions). ### Q: What is free in Community? A: One tenant with manual and weekly backups, 30 days of history, restoring single items as copies, drift detection, OpenIntuneBaseline for Windows, macOS, Windows 365 and BYOD and supported framework mappings except CIS, with PDF, CSV and JSON reports. No license key and no account needed. ### Q: Can I restore into a different tenant? A: Yes, with MSP. Cross tenant copies are created unassigned and require reviewed target dependencies, so nothing is pushed to devices by surprise. ### Q: Is TenuVault still a PowerShell script or a web portal? A: The first versions of TenuVault were a free PowerShell script and a hosted web portal. TenuVault Desktop, released in October 2026, is the current product for new users: a desktop app for Windows and macOS with a free Community plan and paid Pro and MSP plans. The web portal remains available for existing users. More answers on [billing](https://www.tenuvault.com/pricing#faq) and [security](https://www.tenuvault.com/trust#faq). ## Get started in minutes [Setup guide](https://docs.tenuvault.com/getting-started/)[Permissions and data flows](https://www.tenuvault.com/trust#permissions) 1. 1 ### Install the app Windows (EXE or MSI) or macOS, Apple silicon or Intel. 2. 2 ### Create the app registration An admin runs New-TenuVaultDesktopApp.ps1 once to create it and grant consent. 3. 3 ### Assign roles Admins who use the app need an Intune role, for example Intune Administrator. 4. 4 ### Sign in and back up Community works without a key. Paste a Pro or MSP key on the License page. 5. 5 ### Deploy the baseline Choose OpenIntuneBaseline in the sidebar and start a New Deployment. ## Take your first backup today Install, run the setup script, sign in. Your first backup is a few minutes away. [Download for Windows](https://www.tenuvault.com/download/windows)[![Get it from Microsoft](https://www.tenuvault.com/_next/image?url=%2Fdesktop%2Fmicrosoft-store-badge.png&w=1920&q=75)](https://apps.microsoft.com/detail/xpfp6qq47l0gdk?cid=website-cta) [Download for Mac](https://www.tenuvault.com/download/mac-arm64) For Apple silicon Macs.Intel Mac? [Get the Intel build](https://www.tenuvault.com/download/mac-x64) Free for one tenant, OpenIntuneBaseline included. [Try Pro free for 14 days](https://www.tenuvault.com/trial?src=cta), no card needed. [Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Read the docs](https://docs.tenuvault.com)