Run your first backup

Take your first backup, read its results and confirm it worked.

The last setup step takes a first backup, so you know sign-in, permissions and storage all work before you rely on TenuVault.

Run it from the guided setup

The First backup step is headed Take a first backup and shows <tenant> is connected. It explains what the backup does:

It reads your Intune policies, scripts and settings, and changes nothing in your tenant.
Apps are left out by default to keep it quick. You can change what is backed up later in the backup scope.
It usually takes a few minutes, longer for large tenants.

Select Run first backup.
Watch the progress bar and the results. TenuVault first lists every Intune type (Reading Intune configuration…), then saves each object (Backing up <type>). Each type appears in the results list as it is backed up, with its count. Select Cancel backup to stop it.
When the backup succeeds, the step shows Your first backup is done and Next steps, described below.
Select Go to dashboard.

The first backup uses the default scope, Everything except apps: policies, scripts, updates, enrollment and tenant settings. To include apps, run a manual backup with Everything from Backup & Restore, described below. See What gets backed up.

To do it later, select Skip for now. TenuVault opens the dashboard, and you can run the backup from Backup & Restore at any time.

If the first backup fails or you cancel it, select Try again to run it again, or Go to Backup & Restore to continue there.

Next steps

After a successful first backup, the step offers two things:

Turn on automatic backups. One button turns on a schedule for this tenant: Back up every Sunday at 02:00 on Community, or Back up daily at 02:00 on Pro and MSP. TenuVault backs up while it is open or in the tray. A backup missed while the computer was off runs the next time TenuVault starts. Change the day and time later in Backup & Restore, Schedule. See Schedule backups.
Save your recovery key, for backups on this device, if you have not saved it yet. Select Save recovery key and keep the file somewhere safe, such as your password manager. Without the recovery key, backups on this device cannot be read after a reinstall or on another computer. See Save your recovery key. For a tenant with Azure storage this step is left out, because Azure backups do not need the key.

When a schedule is already on or the key is already saved, the step says so instead.

Run it from Backup & Restore

Open Backup & Restore and select the tenant.
Select Run Backup.
In Back up <tenant>, choose what to back up:
- Everything except apps
- Everything: also app details and assignments. Installer files are never included.
- Custom: choose areas and individual types.
Optional: select Also use this for automatic backups of <tenant> to save this choice for scheduled backups.
Select Start backup.

For more on manual backups, see Run a backup.

Read the result

Result	Meaning
Backup completed successfully	Every object in scope was saved.
Backup completed with <n> warnings	Most objects were saved, but some could not be read. Needs attention lists each one with the reason. Older backups are kept because this backup is incomplete.
Backup failed: no policies could be saved	Nothing was saved. Check Needs attention or the raw log for the first error.

Below the result, TenuVault shows:

Policies saved, Types backed up and Duration, plus inventory such as Autopilot devices, which is counted apart from policies
Needs attention, when a type could not be read, was left out for a missing permission, or some of its objects could not be saved, each with the reason
every type that was backed up, with the number of objects saved
<n> types had nothing to back up, which you can expand to see the types your tenant has none of
Show raw log, the full technical log with Copy log, for support

The raw log ends with a summary such as Backup completed: 214 policies in 1m 12s. and shows times in your local time zone.

After a successful manual backup on Community, a line beside the completion result appears once per machine and describes backups in your own Azure storage account, which every admin with access sees, and longer retention, included in TenuVault Pro and MSP.

Common problems on the first backup

Message	Fix
Skipped <type>: access was denied. The app registration may lack the permission or admin consent, or your Intune role may not allow it.	Your app registration is missing a permission TenuVault uses or its admin consent, or your Intune role does not cover this type. Open the app registration in Microsoft Entra, go to API permissions and select Grant admin consent for <your tenant>, or run the setup script again. Then sign out of the tenant in TenuVault and sign in again. If every permission already shows Granted, check that your Intune role covers these items. See Create the app registration manually.
Could not read <type>	Needs attention shows the error Microsoft Graph returned. If it is an access error, check that your Intune role includes this type.
A banner asks you to sign in again	Your Microsoft session ended. Select Sign in in the banner, then run the backup again.
You do not have write access to storage account <name> …	See Storage errors.

You are done

TenuVault is set up. Next:

Schedule backups, if you did not turn on automatic backups in Next steps. Community tenants can back up weekly; Pro and MSP can also back up daily.
Keep TenuVault running in the menu bar on macOS or the tray on Windows so schedules run. See Settings reference.
Learn how to restore Intune policies and detect drift.

Once you have a successful backup, practice an Intune restore before you need one in an incident.

Set up and schedule Microsoft Intune backups: the setup guide, on the product site