TenuVaultDesktopTenuVault Desktop
See what changed in your Intune configuration
Intune drift detection in TenuVault compares your two newest complete backups to find added, changed and deleted items. It shows the setting differences so you can investigate the change and choose a supported recovery action.
At a glance
- TenuVault drift detection compares the two newest complete backups of a tenant, not the live tenant, so run a backup first to include the latest changes.
- Changed items show each changed setting with its old and new value; added and deleted items are listed separately.
- Drift findings export as JSON or CSV on every plan; one click revert of drifted policies requires Pro or MSP.
- A drift result shows that saved configuration changed; it does not prove the change was unauthorized or that devices applied it.
Compare configuration at the setting level
Drift detection requires two backups of the same tenant. Added and deleted policies are listed separately from changed policies, and changed items expose old and new values where supported.
A difference tells you that the saved configuration changed. It does not establish that the change was unauthorized, that it reached every device, or that an endpoint is compliant.
Keep your evidence current
The comparison can only see changes captured in the snapshots. Run a fresh backup when investigating an incident and inspect backup completeness before interpreting the report.
Schedule weekly backups on Community or daily backups on Pro and MSP. Authentication, permissions, storage and an awake computer remain prerequisites. Choose a schedule that fits your recovery requirements.
Export findings and review a response
Export drift findings as JSON or CSV for a change ticket or investigation. Community can restore a previous item as a copy; Pro and MSP add supported in-place reversion.
Review what the recovery operation will change and whether assignments or dependencies need attention. Use a pilot group or an unassigned copy to validate the result before expanding a rollout.
Validate a baseline separately
Backup drift compares your saved tenant configuration across time. OpenIntuneBaseline validation instead compares deployed policies with a selected upstream baseline version.
Use the workflow that matches the question: what changed in the tenant, or where configuration differs from the baseline. Neither workflow claims framework certification or device enforcement.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
How does TenuVault detect Intune configuration drift?+
TenuVault compares the two newest complete backups of an Intune tenant and lists added, modified and deleted items. Backups that failed, completed with warnings or are incomplete are skipped, because missing items would otherwise appear as deleted.
Does Intune drift detection in TenuVault check the live tenant?+
No. TenuVault compares saved backups, not the live Intune tenant. Run a fresh backup before you investigate so the comparison includes the latest changes.
Can I revert an Intune change that drift detection found?+
Yes. On every TenuVault plan you can restore the previous version of an Intune item as a copy. Pro and MSP add one click revert, which puts the drifted policy back to its backed-up version in place.
Is drift detection included in TenuVault Community?+
Yes. TenuVault Community compares backups and shows Intune drift with setting diffs for one tenant. Community schedules weekly backups, so drift is found at most as often as backups run unless you start one manually.
How is backup drift different from OpenIntuneBaseline validation?+
Backup drift compares your saved Intune configuration across time. OpenIntuneBaseline Policy Validation compares deployed policies with a selected upstream baseline version. TenuVault offers both, and neither proves device enforcement or compliance certification.