Skip to content
TenuVaultDocs

Deploy TenuVault in your organization

Roll TenuVault out to your admins with Intune, control updates by policy and restrict who can sign in.

This page is for rolling TenuVault out to several admins: installing it on managed devices, controlling automatic updates, and deciding who can sign in.

Plan the rollout

Section titled “Plan the rollout”
  1. One app registration per tenant. Create it once with the setup script. Every admin signs in through the same app registration with their own account, so you share the client ID, not a secret.
  2. Decide who can sign in. Restrict sign-in to one group if TenuVault should only be used by a defined set of admins. See Restrict who can sign in.
  3. Give admins the right roles. Each admin needs an Intune role, and Storage Blob Data Contributor on the storage account if backups go to Azure. See Requirements.
  4. Decide how updates reach devices. Either let TenuVault update itself, or turn automatic updates off by policy and deploy new versions yourself. See Control automatic updates.
  5. Share licenses. The admin who holds the license key can share it with the tenant’s other admins, so they do not need the key. See Activate and manage your license.
  6. Share one storage account. When every admin picks the same Azure storage account, they all see, compare and restore the same backups, with no recovery key to hand over. See Work with other admins in one tenant for what is shared and what stays on each computer.

Deploy with Intune

Section titled “Deploy with Intune”

Use the MSI (TenuVault-<version>-win-x64.msi) from the releases page. It installs per machine, without prompts, and creates a desktop shortcut. TenuVault installed from the MSI never updates itself, so deploy each new version’s MSI through Intune.

  1. In the Intune admin center, go to Apps > Windows > Create.
  2. For App type, choose Line-of-business app and upload the MSI.
  3. Complete the app information, then assign the app to a group of admin devices as Required or Available for enrolled devices.

Intune reads the product code and version from the MSI and installs it silently.

To install the MSI manually or with Configuration Manager:

msiexec /i "TenuVault-<version>-win-x64.msi" /qn

The MSI is x64 only. For Arm64 devices, use the setup program TenuVault-<version>-win-arm64.exe.

Each admin still signs in and chooses storage on first launch; see Getting started. TenuVault stores sign-ins, settings and the backup key per user account on the device.

Control automatic updates

Section titled “Control automatic updates”

By default, TenuVault checks GitHub for updates 15 seconds after it starts and every 6 hours, downloads them in the background and installs them on restart. When you deploy TenuVault centrally, you can turn this off with a policy and ship new versions through Intune instead, so every device runs the version you approved.

When the policy is set:

  • Automatic update checks and downloads stop.
  • Settings > Updates shows Your organization manages updates for TenuVault. and the Download and install updates automatically checkbox is locked.

TenuVault reads the policy when it starts. Restart TenuVault after the policy reaches the device.

Set a DWORD value DisableAutoUpdate = 1 under either of these keys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\TenuVault (all users on the device)
  • HKEY_CURRENT_USER\SOFTWARE\Policies\TenuVault (one user)

To deploy it with Intune, create a platform script (Devices > Scripts and remediations > Platform scripts) with this content:

$key = "HKLM:\SOFTWARE\Policies\TenuVault"
New-Item -Path $key -Force | Out-Null
New-ItemProperty -Path $key -Name "DisableAutoUpdate" -PropertyType DWord -Value 1 -Force | Out-Null

Set Run this script using the logged on credentials to No and Run script in 64 bit PowerShell Host to Yes. In a 32 bit host, the value lands under WOW6432Node and TenuVault does not see it.

To turn updates back on, delete the value or set it to 0.

Turn off setup diagnostics

Section titled “Turn off setup diagnostics”

A new install asks once whether it may share setup diagnostics: which setup steps worked and which Microsoft error codes stopped them, for 30 days after the admin agrees. To decide this for your organization, set the policy DisableSetupDiagnostics. TenuVault then never asks, sends no events, and Settings > About shows Share setup diagnostics locked off with Turned off by your organization. An install that was already sharing deletes anything still queued at its next start and sends one erase request to tenuvault.com, with only its random ID, to delete the events it already sent. It keeps that ID, and nothing else, until tenuvault.com confirms the deletion, for at most 180 days.

TenuVault reads the policy when it starts. Set it before the first launch so the question is never shown.

Set a DWORD value DisableSetupDiagnostics = 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\TenuVault (all users on the device) or HKEY_CURRENT_USER\SOFTWARE\Policies\TenuVault (one user). With an Intune platform script, as for updates above:

$key = "HKLM:\SOFTWARE\Policies\TenuVault"
New-Item -Path $key -Force | Out-Null
New-ItemProperty -Path $key -Name "DisableSetupDiagnostics" -PropertyType DWord -Value 1 -Force | Out-Null

Restrict who can sign in

Section titled “Restrict who can sign in”

By default, any user in the tenant can sign in through the TenuVault app registration. What they can do is still limited by their own Intune and Azure roles, because every permission is delegated.

To allow only one group:

  • New app registration: run the setup script with -AllowedGroupId <group object id>. The script sets Assignment required on the enterprise application and assigns the group.
  • Existing app registration: in the Microsoft Entra admin center, open Enterprise apps > TenuVault Desktop > Properties, set Assignment required? to Yes, then add the group under Users and groups.

Users outside the group get a Microsoft sign-in error when they try to connect the tenant.

You can also target the app with Conditional Access like any other cloud app. TenuVault signs in through the default browser on Windows and macOS. Device-based Conditional Access, such as requiring a compliant or Entra-joined device, is checked in the browser. On Windows it works in Microsoft Edge when you are signed in to the browser profile, in Chrome with the Microsoft Single Sign On extension or the CloudAPAuthEnabled policy, and in Firefox with Windows single sign-on turned on. On macOS it needs the Microsoft Enterprise SSO extension on the device, and Chrome there also needs the Microsoft Single Sign On extension, unless it is Chrome 135 or later on a Mac that stores the device key in the Secure Enclave.

Scheduled backups on admin devices

Section titled “Scheduled backups on admin devices”

Scheduled backups run on the admin’s computer, as that admin, while TenuVault is running. For reliable schedules, ask admins to:

  • Keep Keep running in the menu bar/tray when I close the window turned on.
  • Turn on Start TenuVault in the menu bar/tray when I sign in to this computer.
  • Optionally select Install background launch, which reopens TenuVault within five minutes if it was closed.

In Settings > Background runner, these labels say menu bar on macOS and tray on Windows.

Backups do not run while the admin is signed out or the computer is asleep or off. See Schedule backups and Settings reference.