Sign in to your tenant

Connect your tenant with one Microsoft sign-in, using your own admin account.

You connect a tenant by signing in with your own admin account. TenuVault creates the app registration it signs in through in your tenant, and never asks for a password or a client secret.

Open the guided setup

The guided setup, Set up TenuVault, is the only way to connect a tenant. TenuVault opens it after you select Connect your tenant on the welcome screen, and whenever no tenant is connected. You can also open it at any time:

From the dashboard, when no tenant is connected: Set up TenuVault.
From the tenant switcher at the top of the sidebar: Connect a tenant.
From Tenants or the dashboard’s Quick Actions: Connect tenant.
From the All tenants page: Connect a tenant.

The guided setup has four steps: Connect, Sign in, Storage and First backup. Use Previous to go back a step. While no tenant is connected, the setup has the window to itself: there is no sidebar, only License and Support links at the top. Once a tenant is connected, the setup shows Back to dashboard.

Continue where you left off

TenuVault saves your progress on this computer, in its encrypted app store: the step, the tenant ID, the client ID, the display name, and a sign-in to a tenant that is not saved yet. No token is kept in this record. Your progress survives a restart, so you can close TenuVault while you run the setup script or wait for another administrator. When you come back, TenuVault skips the welcome screen and the setup says Welcome back. You can continue where you left off. A saved sign-in is resumed only while it is still signed in on this computer; otherwise you sign in again. The First backup step is not resumed.

Step 1: Connect

The Connect step, Connect your tenant, takes one Microsoft sign-in.

Read the four points on the step. They say what you let in: one app registration that lives in your own tenant, acts only as you, has no secret, and leaves your backups with you. Above the button, the step tells you that Microsoft will ask you to approve Microsoft Graph Command Line Tools, Microsoft’s own sign-in app, which TenuVault uses once to create the app registration.
Select Set up with Microsoft sign-in and sign in as a Global Administrator, Cloud Application Administrator or Application Administrator. The setup creates an app registration and grants admin consent, which needs one of these roles. TenuVault connects tenants in Microsoft’s global cloud only; GCC High, DoD and 21Vianet tenants are not supported. If the tenant blocks Microsoft Graph Command Line Tools, which the setup and the setup script sign in through, TenuVault offers Create it by hand instead. See If something goes wrong.
Follow the list under Setting up your tenant. If the sign-in has not come back after 3 minutes, TenuVault shows Still waiting for Microsoft?. When it is done, your browser opens once more and signs you in to TenuVault, with nothing to enter. TenuVault skips the Sign in step and continues with Storage.

For what happens in each step, what is created and how to remove it, see Create the app registration.

Under Other ways to connect:

Button	Use it when
Someone else is the admin? Copy instructions	You cannot grant admin consent yourself. It copies a ready-to-send message for your Entra administrator. TenuVault keeps your place; when they send back the two lines, select I already have an app registration and paste them.
Use the setup script instead	You want to create the app registration with the PowerShell script.
I already have an app registration	The tenant has an app registration from an earlier setup and you know its two IDs. It opens the Sign in step.

The admins who use TenuVault need an Intune role, for example Intune Administrator.

The Sign in step is headed Sign in to your tenant. After Set up with Microsoft sign-in on the Connect step you do not use it: TenuVault signs you in by itself and goes on to Storage. The tenant takes your organization’s name and default domain from Microsoft Entra ID; you can rename it later on the Tenants page. If that sign-in fails or you cancel it, this step opens with both IDs filled in and the note The app registration is ready.; select Sign in with Microsoft to try again.

If you sign in to a tenant that is already connected to TenuVault, the step says This tenant is already connected to TenuVault. with a link to the dashboard, and the tenant is not added a second time.

You use this step yourself when the app registration was created with the setup script, by another administrator, or in an earlier setup:

Enter the tenant ID and the client ID. The setup script copies its two closing lines to your clipboard, so when you open this step with both ID fields empty, TenuVault fills them in and shows Filled in the tenant ID and the client ID from your clipboard. It never replaces values you typed or that it kept from an earlier visit. If the fields stay empty, paste the two lines the setup script printed into Paste the script output: TenuVault fills in Tenant id or domain and Application (client) id and shows Filled in the tenant ID and the client ID. Pasting the whole output into either ID field works too. Or type the values:

Field	Enter	Example
Tenant id or domain	Your tenant ID (GUID) or a verified domain of the tenant	`contoso.onmicrosoft.com`
Application (client) id	The client ID printed by the setup script	`00000000-0000-0000-0000-000000000000`
Display name (optional)	The name TenuVault shows for this tenant. If you leave it empty, TenuVault uses your organization’s name from Microsoft Entra ID.	`Contoso Production`

Select Sign in with Microsoft. The button changes to Waiting for sign-in… and TenuVault shows Complete the sign-in in your browser. TenuVault then checks the license for this tenant.
Complete the Microsoft sign-in with your admin account, including MFA if your policies require it.

The sign-in opens in your default browser, on Windows and on macOS. When it finishes, the browser shows Go back to TenuVault and TenuVault comes to the front. On Windows, where a window may not put itself in front, its taskbar button flashes instead. You can close the browser tab.

If you abandoned the sign-in in the browser, select Cancel sign-in to stop waiting and start again.

Still waiting for Microsoft?

When a sign-in has waited 3 minutes for the browser to come back, on this step or during Set up with Microsoft sign-in on the Connect step, TenuVault shows Still waiting for Microsoft? under the waiting message:

Button	What it does
Try again	Stops waiting for the open sign-in and starts the same sign-in again in your default browser.
Copy sign-in link	Copies the exact Microsoft sign-in address TenuVault opened, so you can paste it into another browser or browser profile, for example Microsoft Edge signed in to your work profile. Finish the sign-in there and it comes back to TenuVault as usual. The link only works while this sign-in waits; after it ends, TenuVault says The sign-in link is no longer available. and you select Try again for a new one.
Copy instructions for your admin	Copies the same ready-to-send setup message as Someone else is the admin? Copy instructions, for an Entra administrator who can create the app registration.

When a sign-in ends, whether it finished, failed, was cancelled, timed out or was started again, TenuVault stops listening for its answer, so a browser tab finished later signs nothing in. The panel belongs to the browser step only: once Microsoft has answered and TenuVault checks the license, it goes away, and Try again no longer stops anything. TenuVault stops waiting after 15 minutes. The first sign-in then shows The sign-in in the browser was not completed within 15 minutes. with Try again and Copy instructions for your admin next to it.

You can use a separate admin account. It does not have to be the account you are signed in to Windows or macOS with. Pick it in the Microsoft account list, choose Use another account, or start the sign-in while a browser profile signed in as that admin account is your default.

Device-based Conditional Access, such as requiring a compliant or Entra-joined device, is checked in the browser. While TenuVault waits for the sign-in, it notes that Conditional Access needs a browser that passes the device identity, such as Microsoft Edge signed in to your work profile: make it your default browser, cancel and sign in again. On Windows it works in Microsoft Edge when you are signed in to the browser profile, in Chrome with the Microsoft Single Sign On extension or the CloudAPAuthEnabled policy, and in Firefox with Windows single sign-on turned on. On macOS it needs the Microsoft Enterprise SSO extension on the device, and Chrome there also needs the Microsoft Single Sign On extension, unless it is Chrome 135 or later on a Mac that stores the device key in the Secure Enclave.

After a successful sign-in, TenuVault checks the license for this tenant and moves to Storage, showing Signed in as <your account>.

Signed in, but not saved yet

If you signed in but did not finish the Storage step, for example because you went back or restarted TenuVault, the Sign in step shows Signed in as <your account> with two buttons:

Continue: goes on to Storage with this sign-in.
Use a different tenant or account: signs out of that tenant and shows the sign-in form again. This also frees the free Community plan for another tenant.

Form errors

Message	Fix
Enter a tenant id or a domain such as contoso.onmicrosoft.com.	Enter the tenant GUID or a full domain name.
The client id is a GUID, printed by the setup script.	Paste the Application (client) id, not the app name or object ID.
No IDs found. Paste the lines that start with Tenant id and Application (client) id.	The pasted text does not contain the script output. Copy the two lines at the end of the script output again.

If Microsoft refuses the first sign-in, TenuVault shows what to do, followed by the Microsoft error code:

Code	Meaning	Fix
`AADSTS700016`	No app registration with this client ID exists in this tenant.	Check the Application (client) id, and that the tenant is the one the app registration was created in. If it was created a moment ago, wait a minute and sign in again.
`AADSTS90002`, `AADSTS900023`	Microsoft does not know this tenant, or it is not a valid tenant ID or domain.	Use the tenant ID of your tenant, or a domain such as `contoso.onmicrosoft.com`.
`AADSTS50011`	The app registration has no `http://localhost` redirect URI for mobile and desktop applications.	Run the setup script again, or add the redirect URI as described in Create the app registration manually.
`AADSTS7000218`	The app registration asks for a client secret, because `http://localhost` is registered for the Web platform.	Add `http://localhost` under Mobile and desktop applications on the app registration’s Authentication page, or run the setup script again.
`AADSTS50020`	The account does not belong to this tenant.	Sign in with an admin account of this tenant.
`AADSTS50105`	Your account is not assigned to the TenuVault app registration.	Ask your Entra administrator to add you to the group that may sign in.
`AADSTS50076`	Microsoft asks for multifactor authentication for this sign-in, because of a Conditional Access policy, per-user MFA or a new location, and it was not completed.	Sign in again and complete the MFA prompt in the browser. If no prompt appears, ask your Entra administrator to check the sign-in logs in the Entra admin center.
`AADSTS50079`	Microsoft requires multifactor authentication for this sign-in, because of a Conditional Access policy, per-user MFA or a new location, and your account cannot complete it yet.	If your account is managed in Entra ID, register your security info at My Sign-Ins security info and sign in again. If your account signs in through another identity provider (a federated account), that provider must supply the MFA claim: ask your administrator to set it up.
`AADSTS53000`, `AADSTS53001`	Conditional Access requires a compliant, registered or domain-joined device.	Make a browser that passes the device identity, such as Microsoft Edge signed in to your work profile, your default browser and try again.
`AADSTS53003`	Conditional Access blocked the sign-in.	Check the sign-in logs in the Entra admin center for the policy, or sign in from a device and location it allows.
`AADSTS65001`, `AADSTS650057`	The app registration has no admin consent for Microsoft Graph.	Add the Microsoft Graph permissions listed in Delegated permissions, grant admin consent and sign in again.
`AADSTS90094`	Administrator consent is required: the tenant does not let your account grant the permissions the TenuVault app registration asks for.	Ask a Global Administrator, Cloud Application Administrator or Application Administrator to grant admin consent for it, or send them the setup instructions.
`AADSTS65004`	The consent was declined in the browser.	Sign in again and accept, or ask an administrator to run the setup script, which grants admin consent.

For the Conditional Access codes (AADSTS53000, AADSTS53001, AADSTS53003), missing consent or approval (AADSTS65001, AADSTS90094) and MFA (AADSTS50076, AADSTS50079), the message also offers Copy instructions for your admin, the setup message for another administrator, and Create it by hand, which opens the guide to create the app registration manually.

For other errors, TenuVault shows the error Microsoft returned. See Troubleshooting.

TenuVault checks that your license covers the tenant when you sign in, and again before it saves the tenant. If the license does not cover it, the tenant is not added, the new sign-in is removed and the reason is shown. For example:

TenuVault Community covers one tenant, and it is used for tenant <tenant id>. Add a Pro or MSP license on the License page to use more tenants.
A TenuVault license is required for this tenant. Add your license key on the License page, or start a free trial.

If the second check, on Continue in the Storage step, fails, setup returns to Sign in with the tenant ID and client ID kept. It explains that TenuVault signed you out of this tenant and that you can sign in again once the license covers it, and offers Try Pro free for 30 days, no card and I have a license key. When Community already covers another tenant, the dialog Community covers one tenant explains the limit instead.

See Activate and manage your license for all license messages. To add more tenants and switch between them, see Manage tenants.

Staying signed in

TenuVault keeps your sign-in in a token cache encrypted with Windows data protection or the macOS Keychain. Background tasks such as scheduled backups never open a sign-in window. When Microsoft needs you to sign in again, a banner appears with a Sign in button, or you use Settings > Sign-in. See Settings reference.

Next step

Choose where backups are stored.