Security and privacy
How TenuVault accesses your tenant, where your data goes, and what TenuVault the company can and cannot see.
TenuVault is built so that your Intune configuration, your backups and your Microsoft tokens stay between your machine, Microsoft and the storage you choose. This page explains the design; the pages below it go into the details.
At a glance
Section titled “At a glance”| Question | Answer |
|---|---|
| Whose app registration does TenuVault use? | Your own, created in your own tenant with a setup script. |
| What kind of permissions? | Delegated permissions. Only if you set up the optional Backup Reader for scheduled backups, a separate app registration adds read-only application permissions. |
| Is there a client secret or certificate? | Never a secret. The app registration you sign in with is a public client with no credentials. The optional Backup Reader uses a certificate whose private key never leaves your computer. |
| Who does TenuVault act as? | You, the signed-in admin. It can never do more than your own roles allow. Only scheduled backups of a tenant with a Backup Reader read as that read-only app. |
| Do MFA and Conditional Access apply? | Yes, exactly as they do when you sign in to the Intune admin center. The Backup Reader is an application, so Conditional Access for workload identities applies to it instead. See Conditional Access and TenuVault. |
| Where do backups go? | Encrypted on your device, or into your own Azure storage account, where Azure encrypts them at rest and your role assignments decide who reads them. |
| Does tenant data reach TenuVault servers? | No, with one opt-in exception: feedback you choose to send with Share feedback. It contains the text you write and, only if you tick it, a screenshot of the window that may show tenant, policy or user names. Otherwise only license checks go to tenuvault.com, and they carry no tenant configuration, backups or access tokens. |
| Is TenuVault data shared with anyone? | Only with the service providers that run TenuVault’s services, and never sold or shared for their own marketing. Each license activation (installation ID, tenant ID, operating system and app version) is recorded with your license key in Polar, the merchant of record. Licenses shared with a tenant are stored with the tenant ID and client ID in TenuVault’s database at Supabase, and Vercel hosts the services and keeps request logs. Feedback you choose to send is stored up to 12 months; the email copy to support is kept as support correspondence. See Service providers in the privacy policy. |
| Can I check this myself? | Yes. The source code is public at github.com/ugurkocde/TenuVault. |
How TenuVault connects to your tenant
Section titled “How TenuVault connects to your tenant”TenuVault is a desktop app, not a hosted service. Everything it does with your tenant happens on the machine where it runs.
- Your app registration. You create the app registration with the TenuVault setup script. It lives in your tenant, is single-tenant, and is a public client: it has no client secret and no certificate. See App registration and delegated permissions.
- You sign in as yourself. When you add a tenant, you sign in with your own admin account. The sign-in opens in your system browser on Windows and macOS, so you can use a separate admin account rather than the one signed in to the computer.
- Delegated access by default. Every call to Microsoft Graph and Azure uses a token issued to you through that app registration; the only exception is the optional Backup Reader in step 6. TenuVault holds no permission of its own. The effective access is the overlap of the delegated permissions and your own roles, such as Intune Administrator.
- Your policies apply. Because you sign in interactively, MFA, Conditional Access, sign-in frequency and device compliance requirements apply as they do in the Intune admin center. When Microsoft asks for a new sign-in, TenuVault stops and asks you to sign in again. Background work never opens a sign-in window on its own.
- Changes are attributed to you. Restores and other writes are made with your token, so they appear under your name in the Intune and Entra audit logs, just like changes you make in the portal.
- Optional: a read-only Backup Reader. When session controls such as sign-in frequency stop scheduled backups at night, you can add the Backup Reader on Pro and MSP. It is a second app registration with read-only Intune permissions and a certificate. Only scheduled backups use it; every change still uses your own token. It cannot change Intune or delete backups.
What stays on your machine
Section titled “What stays on your machine”TenuVault keeps its working data in an encrypted store in your user profile, protected by the operating system (Windows DPAPI or the macOS Keychain). This includes:
- Your Microsoft token cache (access and refresh tokens).
- Your tenant profiles and sign-in accounts.
- Your license key and license activations.
- The encryption keys for your backups.
- The Backup Reader’s private key, when you set one up. It is never shown or exported.
If the operating system cannot provide this protection, the packaged app refuses to start rather than store this data in plain text.
Backups on your device are encrypted with AES-256-GCM before they are written to disk. Backups in your Azure storage account are stored as plain JSON policies: Azure encrypts them at rest, and access follows your Azure role assignments, so every admin with access sees the same backups. Anyone who can write to the backup container is trusted like an Intune admin. See Encryption and recovery key.
What TenuVault the company can see
Section titled “What TenuVault the company can see”TenuVault talks to its own server, tenuvault.com, to check your license and, only when you send it, to receive your feedback. The table below lists everything a license check and a feedback message can include. Network connections and data flows lists every request in detail.
| TenuVault can see | When |
|---|---|
| Your license key | When this machine activates, refreshes or releases a key. Community sends no key. |
| Your tenant ID | Each time a tenant is activated or refreshed. |
| The client ID of your app registration | When a license key is activated or refreshed for a tenant you are signed in to, so the license can be shared with that tenant’s other admins. |
| A random installation ID | Each activation and refresh. It is generated on your machine and identifies this installation, not you. |
| Your operating system (Windows or macOS) and the TenuVault version | When a tenant is activated, and with organization license checks. |
| A Microsoft ID token for your sign-in | When a license is shared with your tenant, or when you use a license your organization shared. The token contains identity claims such as your name and user principal name. The licensing service verifies it with Microsoft’s public signing keys to confirm which tenant and app registration you signed in to, and does not store it. |
| Your public IP address | As with any web request. The licensing service uses it only to rate limit requests. |
| Setup diagnostics, if a new install chooses to share them | For 30 days after you agree: which setup steps worked, Microsoft error codes such as AADSTS53003, app version, operating system and a random ID that links the steps. Never tenant names or IDs, account names, client IDs, error messages, policies or backups. Kept 180 days. Turning it off deletes the events already sent; only the random ID is kept for 180 days, as a marker so late uploads are discarded. See Setup diagnostics. |
| Feedback you send | Only when you click Send feedback in Share feedback: your answers, the reply-to email if you enter one, app version, operating system, plan, page name and a random message ID. A screenshot of the window only if you tick it; it may show tenant, policy or user names. Stored up to 12 months; the email copy to support is kept as support correspondence. A keyed hash of your IP address is kept 24 hours for rate limiting. See Feedback. |
If you buy a plan, the purchase itself is handled by Polar, the payment provider, which holds your billing details. Your license key and its activations are managed there.
Apart from what you write in feedback and a feedback screenshot you choose to attach, TenuVault never sees:
| TenuVault never sees | |
|---|---|
| Your Intune configuration | Policies, profiles, apps, scripts and assignments are read and written between your machine and Microsoft Graph only. A feedback screenshot you tick may show policy names on screen. |
| Your backups | Stored on your device or in your Azure storage account, never uploaded to TenuVault. |
| Access tokens and refresh tokens | They stay in the encrypted token cache on your machine. |
| Your backup recovery key | It is created on your machine and only leaves it when you save it to a file yourself. |
| Your storage account contents | TenuVault has no access to your Azure subscription. |
TenuVault contains no analytics or crash reporting. Apart from license checks, it sends TenuVault only feedback you choose to send and, on a new install that chooses to share them, setup diagnostics for 30 days after it agrees: which setup steps worked and which Microsoft error codes stopped them, never tenant names or IDs, account names, policies or backups.
Control and revoke access
Section titled “Control and revoke access”You stay in control of the app registration at all times, because it lives in your tenant.
- Limit who can sign in. Run the setup script with
-AllowedGroupIdto require user assignment. Only members of that group can then sign in to TenuVault. See App registration and delegated permissions. - Revoke access. Delete the app registration, or remove the admin consent for it in the Microsoft Entra admin center. TenuVault then cannot obtain new tokens for your tenant.
- Sign out on one machine. Remove the tenant from TenuVault on the Tenants page. This signs you out of the tenant on that machine, stops its scheduled backups and frees its license slot. Existing backups are kept and nothing in the tenant changes.
- Apply your own policies. Conditional Access, sign-in frequency and device compliance policies that target the app registration or your admins apply to TenuVault too.
- Revoke the Backup Reader. Remove a computer’s certificate from the Backup Reader app registration, or delete the app registration; Microsoft then refuses it. To switch that computer’s scheduled backups back to your sign-in, select Remove on its Backup Reader card, which also deletes the private key.
Review the source
Section titled “Review the source”The TenuVault Desktop source code is public at github.com/ugurkocde/TenuVault so you and your security team can review how it signs in, what it sends and how it protects backups. TenuVault is commercial software; the source is published for transparency and review.
Windows builds are signed with Azure Trusted Signing. macOS builds are signed and notarized by Apple.
In this section
Section titled “In this section”- App registration and delegated permissions: every permission and why it is needed.
- Network connections and data flows: every outbound destination and what is sent to it.
- Encryption and recovery key: how backups on your device and in Azure are protected, and when you need the recovery key.
- Conditional Access and TenuVault: how your policies apply, and how to keep scheduled backups running under sign-in frequency.