Troubleshooting
Messages TenuVault shows, what causes them, and how to fix them.
This page lists the messages TenuVault shows, grouped by area, with the cause and the fix for each. Text in italics is replaced with your own values, such as a tenant or storage account name.
- Starting the app
- Sign in
- License
- Backup
- Azure storage
- Restore
- Updates
- Background backups
- Baselines and frameworks
Starting the app
Section titled “Starting the app”| Message | Cause | Fix |
|---|---|---|
| OS encryption is not available. Enable the operating system credential store before opening TenuVault. | TenuVault encrypts its saved data with the operating system’s credential protection (Windows data protection or the macOS Keychain) and cannot find it. | Make sure you are signed in to a normal user session with the credential store available, then start TenuVault again. |
| TenuVault cannot unlock its saved data. | On macOS, access to TenuVault’s Keychain item was denied. On Windows, the data was probably created by another Windows user. | Choose Quit and restore access first. Export the key in Settings > Storage and recovery > Save recovery key. Delete backup key and start over keeps an unreadable saved-data copy but deletes the backup encryption key from the active app state, along with sign-ins and the license. Backups on this device become unreadable unless you exported their recovery key, and so do Azure backups that an earlier TenuVault version encrypted with it. Azure backups made by this version stay readable. After starting over, use Import a recovery key in the same Settings section. |
| Could not load license status | The app could not read its license status during startup. The panel shows the error. A check that does not respond within 30 seconds shows “The license check did not respond. Try again.” | Click Retry. A spinner appears while the check runs. If the check fails or times out again, the error and Retry return. |
Sign in
Section titled “Sign in”| Message | Cause | Fix |
|---|---|---|
| Microsoft did not let this account approve the setup (code). | During Set up with Microsoft sign-in, Microsoft did not let the account approve Microsoft Graph Command Line Tools (AADSTS65001 or AADSTS90094). Nothing was changed. | Select Try again and sign in as a Global Administrator, Cloud Application Administrator or Application Administrator. If you cannot, select Someone else is the admin? Copy instructions and send them to your Entra administrator. |
| You declined Microsoft’s request to approve Microsoft Graph Command Line Tools (AADSTS65004). | You selected Cancel on Microsoft’s approval page during Set up with Microsoft sign-in. Nothing was changed. | Select Try again and accept the request. If you do not want to approve it yourself, select Someone else is the admin? Copy instructions. |
| The app registration is ready, but Microsoft is still making it available for sign-in. Wait a moment, then select Sign in with Microsoft. | The setup created the app registration, and Microsoft’s sign-in service did not accept it yet within a minute and a half. | Stay on the Sign in step, wait a moment, then select Sign in with Microsoft. The IDs are already filled in, and nothing is created twice. |
| Setup did not finish. Cleanup failed. Delete app registration TenuVault Desktop (client id ID) in the Entra admin center. | A step failed after TenuVault created the app registration, and TenuVault could not remove it again. The reason follows this text. | Delete the named app registration under Entra admin center > App registrations, fix the reason and select Try again. |
| This tenant does not let your account sign in to Microsoft Graph Command Line Tools, the Microsoft app that the setup and the setup script sign in through (code). | Sign-in to Microsoft Graph Command Line Tools is turned off in the tenant (AADSTS7000112), the app is limited to assigned users and your account is not one of them (AADSTS50105), or the app is missing from the tenant (AADSTS700016). The setup script signs in through the same app, so it fails the same way. Nothing was changed. | Select Create it by hand next to the message and create the app registration manually, then select I already have an app registration and enter its two IDs. Or ask your Entra administrator to allow Microsoft Graph Command Line Tools for your account and select Try again. |
| Conditional Access blocked the sign-in to Microsoft Graph Command Line Tools, the Microsoft app that the setup and the setup script sign in through (AADSTS53003). | A Conditional Access policy blocked the setup sign-in. It may require a compliant device or an allowed location, or block Microsoft Graph Command Line Tools for everyone but a few admins, which many tenants do. Nothing was changed. | Look up the sign-in in Entra admin center > Sign-in logs to see which policy applied. If it blocks Microsoft Graph Command Line Tools, select Create it by hand and create the app registration manually. If it asks for a compliant device or a trusted location, sign in from one and select Try again. |
| This tenant already has a TenuVault app registration, “name” (client id ID), but sign-in to its enterprise application is turned off. | An administrator disabled the enterprise application of the TenuVault app registration the setup found. The setup does not add consent to it. Nothing was changed. | Turn sign-in on again under Entra admin center > Enterprise applications > the named application > Properties, or delete the app registration, then select Try again. |
| The sign-in in the browser was not completed within 15 minutes. | TenuVault waited for Set up with Microsoft sign-in and no answer came back from the browser. Microsoft’s own error pages, such as Need admin approval or a page saying that Microsoft Graph Command Line Tools is blocked or disabled, do not return to TenuVault. Nothing was changed. | If Microsoft asked for admin approval, sign in as a Global Administrator, Cloud Application Administrator or Application Administrator and select Try again, or select Someone else is the admin? Copy instructions. If Microsoft said that Microsoft Graph Command Line Tools is blocked, disabled or not assigned to you, select Create it by hand and create the app registration manually. |
| Enter a valid tenant ID or domain. | The optional Tenant ID or domain (optional) field of the setup is not a tenant ID or a domain. | Correct it under What the setup does on the Connect step, or leave it empty to use the tenant of the account you sign in with. |
| Delegated permission permission was not found on API. | The tenant’s copy of a Microsoft API does not list a permission TenuVault needs. | Try again after a few minutes. If it stays, create the app registration manually and contact support. |
| Graph method failed: reason | Microsoft Graph refused a request of the setup. Microsoft’s reason follows. | Fix the reason and select Try again. If TenuVault had created the app registration, it says whether it removed it again. |
| The browser did not open. Open the address above by hand, or run with -UseDeviceCode. | The setup script could not open a browser, for example in a remote shell. | Open the address the script printed in a browser on the same computer. Without a browser there, run the script again with -UseDeviceCode. See Create the app registration. |
| Sign-in was not completed within 15 minutes. Nothing was changed. Run the script again. | The setup script waited for the browser sign-in and no answer came back, for example because the tab was closed or Microsoft showed an error page of its own. | Run the script again and finish the sign-in in the browser. If the wrong browser opens, copy the address the script prints into the browser or profile you need. If Microsoft said that Microsoft Graph Command Line Tools is blocked, disabled or not assigned to you, create the app registration manually instead. |
| Browser sign-in failed. Nothing was changed. | Microsoft answered the sign-in with an error, for example because consent was declined or a Conditional Access policy blocked it. Microsoft’s own message follows this text. When the tenant blocks Microsoft Graph Command Line Tools, the script adds that the app registration has to be created by hand. | Read Microsoft’s message, then run the script again. If it reports a device or compliance problem, open the printed address in a browser profile that passes your device identity. If the tenant blocks Microsoft Graph Command Line Tools, create the app registration manually. |
| The signed-in account user lacks a role that can create app registrations and grant admin consent. | The account you signed in with, in TenuVault or in the setup script, cannot create the app registration or cannot grant tenant-wide admin consent. | Start the setup again and sign in as a Global Administrator, Cloud Application Administrator or Application Administrator. A Privileged Role Administrator can grant the consent but can create the app registration only when users in the tenant may register applications. If you activate the role with Privileged Identity Management, activate it first. |
| Setup did not finish. The half-created app registration was removed again. | A step failed after the app registration was created, and the setup removed it again. The reason follows this text. | Fix the reason, then select Try again in TenuVault or run the script again. |
| Device code expired. Nothing was changed. Run the script again. | You ran the setup script with -UseDeviceCode and the sign-in was not finished in time, for example because Microsoft showed an error page of its own. | Run the script again and finish the sign-in. If Microsoft said that Microsoft Graph Command Line Tools is blocked, disabled or not assigned to you, create the app registration manually instead. |
| Device code sign-in failed. Conditional Access may block device code flow; run the script without -UseDeviceCode on a computer with a browser. | You ran the setup script with -UseDeviceCode and Microsoft refused the sign-in. Many tenants block device code flow. | Run the script without -UseDeviceCode on a computer with a browser. If Microsoft’s message says that Microsoft Graph Command Line Tools is blocked for your account, create the app registration manually instead. |
| This PowerShell session runs in ConstrainedLanguage mode, which blocks the browser sign-in this script uses. | PowerShell on this computer is restricted, for example by App Control for Business or AppLocker. | Run the script on a computer without that restriction, or create the app registration manually. |
| Enter a tenant id or a domain such as contoso.onmicrosoft.com. | The Tenant id or domain field is not a GUID or a domain. | Enter the tenant ID or a verified domain of the tenant. |
| The client id is a GUID, printed by the setup script. | The Application (client) id is not a GUID. | Copy the client ID from the setup script output or from the app registration in Entra. See Create the app registration. |
| You signed in to a different tenant. Sign in with an account from this tenant. | The account you used belongs to another tenant, for example a guest account or the wrong browser profile. | Sign in again with an account that is a member of the tenant you are connecting. |
| The sign-in in the browser was not completed within 15 minutes. Select Try again to sign in again. | The first sign-in to a tenant waited 15 minutes and no answer came back from the browser, for example because the tab was closed or Microsoft showed an error page of its own, such as a Conditional Access block, an MFA prompt or Need admin approval. | Select Try again next to the message. If Microsoft showed an error you cannot fix yourself, select Copy instructions for your admin and send the setup to your Entra administrator. |
| Still waiting for Microsoft? | A sign-in, the first sign-in or the setup sign-in, has waited 3 minutes for the browser. | Select Try again to start the sign-in again, Copy sign-in link to open the same sign-in in another browser or profile, or Copy instructions for your admin. See Still waiting for Microsoft?. |
| TenuVault could not open a local port for the Microsoft sign-in (code). Check that no security software blocks connections to 127.0.0.1 on this computer, then sign in again. | Each sign-in receives Microsoft’s answer on a port of its own on 127.0.0.1, and this computer did not let TenuVault open one. | Allow TenuVault to accept connections on 127.0.0.1 in your security software or firewall, then sign in again. |
| Microsoft did not return an account for this sign-in. | The sign-in window closed or completed without returning an account. | Try again, and finish the sign-in in your browser. |
| You are not signed in to this tenant. Sign in to continue. | No sign-in is stored for this tenant on this device, or it was made with a different client ID. | Click Sign in on the banner, or Sign in next to the tenant in Settings > Sign-in. |
| Your session for user has ended. Sign in again to continue. | The cached account is no longer available, for example after the refresh token expired. | Sign in again. |
| Microsoft needs you to sign in again as user for resource (codes). | Microsoft requires interaction for that resource (Microsoft Graph, Azure Storage or Azure Service Management), for example because of Conditional Access, MFA, a password change or missing consent. The codes are the Microsoft error codes, such as invalid_grant, AADSTS65001. | Click Sign in on the banner and complete the prompt. TenuVault signs you in for the resource named in the message. |
| The app registration has no admin consent for resource (AADSTS650057 or AADSTS65001). Add the permission to the app registration, grant admin consent, and sign in again. | The app registration does not list the permission, or the permission has no admin consent. Signing in again cannot fix this. It happens with Azure storage when the Azure permissions were left out of the app registration. | Add the permission named in the message (user_impersonation for Azure Storage and Azure Service Management, the listed delegated permissions for Microsoft Graph) as described in Create the app registration, select Grant admin consent for <your tenant>, and click Sign in again. Backups on this device do not need the Azure permissions. |
| Sign in to access Intune and verify this tenant’s license. | Notice on Backup & Restore, Drift Detection and Audit Log: the selected tenant is not signed in. | Click Open sign-in settings and sign in. |
| The tenant was not added. reason | Adding the tenant failed. The reason follows. | Fix the reason shown, often a license or sign-in issue, and add the tenant again. |
When the first sign-in to a tenant fails with a common Microsoft code, such as a wrong client ID, an unknown tenant, a missing redirect URI, a Conditional Access block, an MFA requirement or missing consent, TenuVault shows what to do followed by the code. For Conditional Access, consent and MFA codes it also offers Copy instructions for your admin and Create it by hand. See Sign-in errors.
If Microsoft shows an error in the sign-in window itself (an AADSTS code), check that the app registration exists in this tenant, that admin consent was granted, and, if the setup script was run with -AllowedGroupId, that your account is a member of that group. See App registration and delegated permissions.
If the browser shows AADSTS50011 (redirect URI mismatch), the app registration is missing the http://localhost redirect URI. Add it under Authentication > Mobile and desktop applications, as described in Create the app registration, and sign in again.
License
Section titled “License”| Message | Cause | Fix |
|---|---|---|
| This tenant has an organization license shared through another app registration than the one this sign-in used. This sign-in cannot use that license, and no trial can start. To use the license, remove the tenant from TenuVault and connect it again through that app registration. Choose “I already have an app registration” on the Connect step and enter its client ID, which an Entra administrator can find under App registrations. | The tenant has an organization license, but you signed in through another app registration than the one the license was shared from. The tenant shows Community and no trial can start. | Remove the tenant, connect it again with I already have an app registration on the Connect step and enter the client ID of the app registration the license was shared from. See Manage your license. |
| A TenuVault license is required for this tenant. Add your license key on the License page, or start a free trial. | The tenant has no license and is not the free Community tenant on this device. | Add a license key on the License page, or choose Try Pro free there if the tenant has not used its 14 day trial yet. |
| TenuVault Community covers one tenant, and it is used for tenant ID. Add a Pro or MSP license on the License page to use more tenants. | Community is free for one tenant, and another tenant already uses it. | Add a Pro or MSP license key. See Plans and features. |
| An active license is required for backup and restore operations. | Notice on the backup, drift and audit pages: the tenant is signed in but not licensed. | Click Open license and activate a license for the tenant. |
| Feature: included in TenuVault Pro and MSP. Upgrade on the License page. | The action needs a higher plan, for example daily schedules, Azure storage, restoring several items or replacing in place. | Upgrade on the License page, or use an option your plan includes. |
| This license key is not valid for TenuVault. | The key is not a TenuVault key. | Paste the key from your purchase email. Keys start with TENU. |
| This license key is not valid, or it has been revoked or has expired. Check your subscription in the customer portal. | The license server does not know the key, or it is no longer active. | Click Manage subscription on the License page and check the subscription. |
| This license has been revoked. Check your subscription. / This license key has been disabled. / This license key has expired. | The subscription behind the key is no longer active. | Renew or check the subscription in the customer portal. |
| This license already covers its maximum number of tenants. Upgrade, or remove a tenant from TenuVault on the machine that uses it. | Pro covers two tenants and MSP covers its subscription quantity, and all are in use. | Remove a tenant you no longer protect, or increase the subscription. |
| This tenant already has 5 active installations. Deactivate one in the app or the customer portal. | Five installations already use the license for this tenant. | Click Deactivate this machine on an installation you no longer use, or deactivate it in the customer portal. |
| This license has no activations left. Deactivate an installation in the customer portal. | All activations of the key are in use. | Deactivate an unused installation in the customer portal. |
| This installation is no longer activated. It activates again the next time the tenant is used. | The installation was deactivated elsewhere. | Use the tenant again; TenuVault activates it automatically. |
| Your organization has no license for this tenant. | You rely on an organization license, but no admin shared one with this tenant. | Ask the admin who holds the key to tick Let other admins in this tenant use this license, or add your own key. |
| The licensing service could not be reached. / The licensing service is unavailable. Please try again later. | TenuVault could not reach www.tenuvault.com, or the service had an error. | Check that the device can reach www.tenuvault.com over HTTPS. A verified license keeps working offline until the Works offline until date on the License page. This is separate from License valid until, which shows the key’s expiry when supplied. |
| Your Microsoft sign-in could not be verified by the licensing service. Sign in again and retry. | The license check could not verify your Microsoft sign-in. | Sign in to the tenant again, then click Retry on the License page. |
| Sign in to this tenant again to check your organization’s license. | The organization license check needs a recent sign-in. | Sign in to the tenant again. |
| Deactivate this machine before entering a different license key. | A key is already active on this device, and this entry point only saves a first key. | On the License page, click Use a different key next to the saved key and paste the new one. It is activated before the saved key is released, so a refused key changes nothing. |
| Only the machine that holds the license key can change sharing. | License sharing can only be changed where the key was entered. | Change Let other admins in this tenant use this license on the machine that holds the key. |
| Sign in to this tenant again to share the license with it. | Sharing needs a recent sign-in to the tenant. | Sign in to the tenant again, then change the setting. |
| Enter a valid license key. | The key has the wrong format. | Paste the whole key from your email, without extra characters. |
| This computer’s clock is ahead: it shows date, but the license was issued on date. Set the correct date and time, then retry. | The licensing service issued a license that this computer already considers expired, because its clock is two weeks or more ahead. | Correct the date, time and time zone (or turn on automatic time), then click Retry on the License page. |
| The license could not be verified: it was not signed by the TenuVault licensing service this app trusts. | The answer was not signed with the key built into this version of TenuVault. An outdated version, or a proxy or security product that rewrites HTTPS responses, causes this. | Update TenuVault. If it persists, exclude www.tenuvault.com from HTTPS content rewriting and contact support. |
| The licensing service is busy with many requests from your network. Try again in time. | Many license requests came from your network at once, for example several admins behind one internet address or many tenants activated together. TenuVault already waited and retried. | Wait the time shown and retry. Tenants that are already active keep working. |
| The new license key could not be saved. Your current license is unchanged. | Changing the key failed while saving it on this computer, for example because the disk is full. | Free disk space and try Use a different key again. The previous key stays active. |
After Start over or a reinstall on a new profile
Section titled “After Start over or a reinstall on a new profile”Each TenuVault installation has its own installation ID, kept with the app’s saved data. When you choose Start over after the saved data could not be opened, or set the computer up again without that data, TenuVault gets a new installation ID. The old one still counts toward the 5 installations per tenant. If a tenant reports that it already has 5 active installations, click Manage subscription on the License page and release the installations you no longer use in the customer portal.
More on licenses: Activate and manage your license.
Backup
Section titled “Backup”| Message | Cause | Fix |
|---|---|---|
| Choose where backups for this tenant are stored in Settings first. | The tenant has no backup storage. | Choose storage in Settings > Sign-in > Change storage. See Choose where backups are stored. |
| Choose at least one type to back up. | A custom scope excludes every type. | Select at least one type in the backup scope. |
| The backup could not start. | The backup request was rejected. A more specific reason is usually shown with it. | Check the tenant’s sign-in, license and storage. |
| Access denied by Microsoft Graph: message. Check that your account has an Intune role and the app registration has the Intune permissions. | Graph returned 403 while reading Intune. | Make sure your account has an Intune role such as Intune Administrator, and that admin consent was granted for the app registration. |
| Skipped type: access was denied. The app registration may lack the permission or admin consent, or your Intune role may not allow it. | Microsoft Graph returned access denied for this type. Usually the app registration is missing a permission added in a newer version, the permissions were added as Application permissions instead of Delegated permissions, or they never got admin consent. Your Intune role can also be the cause. Backup Details lists these types under “Left out because access was denied”. | Open the app registration in Microsoft Entra, go to API permissions and select Grant admin consent for <your tenant>, or run the setup script again. Then sign out of the tenant in TenuVault and sign in again. If every permission already shows Granted, check that its type is Delegated: TenuVault signs in as you and does not use application permissions. Then check that your Intune role covers these items. |
| Could not read type: message | Reading one type failed. The backup continues and completes with warnings. | Check the message. Retry the backup later if it was a temporary Graph error. |
| Could not read type: host could not be reached. guidance (code) | TenuVault got no answer from host, usually graph.microsoft.com. A proxy, HTTPS inspection, DNS or a firewall stopped the request before Microsoft could answer, so this is not a permissions problem. The code names the cause, for example ERR_PROXY_CONNECTION_FAILED, ERR_CERT_AUTHORITY_INVALID or ERR_NAME_NOT_RESOLVED. HTTP 407 or an ERR_PROXY_AUTH code means the proxy requires a sign-in that was cancelled or refused. | Allow the destinations in Network requirements through the proxy or firewall. For proxy authentication, enter the proxy credentials when TenuVault asks (see Proxies that require authentication). For a certificate code, make sure the HTTPS inspection certificate is trusted by Windows or macOS. Versions before 0.2.2 did not use the system proxy for Microsoft Graph and showed only “fetch failed”; update TenuVault. |
| Could not back up “name”: message | Saving one item failed. | Check the message and the storage. Retry the backup. |
| Backup failed: no policies could be saved | Nothing could be written. | Check storage access and sign-in, then retry. |
| A different backup is already running for this tenant. Wait for it to finish, then try again. | A backup with another storage account or scope is already running for this tenant, so this request did not start. A scheduled backup that meets this message counts as a failed attempt and is retried. | Wait for the running backup to finish, then start the backup again. |
| Backup folder name is already in use by another backup for this tenant and storage. Nothing from this backup was written. Wait for the other backup to finish, then try again. | Another TenuVault instance or automation run claimed the same backup folder first, for example by starting in the same second for the same tenant and storage. This backup wrote no policy files and no summary. | Wait for the other backup to finish, then start the backup again. |
| Backup request timed out after 90 seconds. Check your connection and retry. | A request, token acquisition or response body stayed blocked through three bounded attempts. An exhausted item read or upload is listed as a policy warning and other policies are saved. Token acquisition, listing or manifest commit timeouts fail the job. | Check the network and sign-in, then retry. Scheduled jobs wait 15 minutes before retrying, with at most three attempts per slot. A timeout that fails the job is not counted toward the three attempts if the backup saved nothing, got no answer from Microsoft Graph or Azure Storage, and every failure was a connection failure or timeout. |
| Backup timed out after the 30 minute job deadline. Retry the backup. | The overall job reached its 30 minute deadline before the manifest PUT started, or its commit exhausted the additional two minute budget for requests and retry waits. A successful commit stays completed if retention reaches the deadline. A run that stops before committing records its folder as a failed backup, which Backup History lists as Failed and retention removes once it is older than the retention period. | Check connectivity and sign-in, then run another backup. Use a smaller custom scope if the tenant consistently takes more than 30 minutes. |
| Backup cancelled by you. This run is never offered as a complete backup. | You selected Cancel backup before the manifest PUT started. If the run had already claimed its folder, Backup History lists it as Cancelled with any policies it saved, and retention removes it once it is older than the retention period. It is never offered as a complete backup and does not count in the Dashboard Success Rate. | Start a new backup when ready. A cancelled automatic job sends no failure notification, does not consume its retry budget and waits until the next scheduled slot. |
| Retention was interrupted; older backups are cleaned up on the next run | Cancellation or the deadline interrupted retention after a successful commit, with retention enabled (more than zero days) and every selected item saved. The saved backup remains completed. Runs that never attempted retention do not report this warning. | No retry is needed for the saved backup. Older backups are reconsidered on the next run. |
| Old backups were not removed because the network stopped responding. They will be reconsidered on the next run. | Retention lost contact with backup storage after the new backup was saved. | Check the storage connection. The saved backup remains completed and the next complete run retries cleanup. |
| Could not remove old backups: message. They will be reconsidered on the next run. | Storage refused a retention operation after the new backup was saved. The saved backup remains completed. | Check the message, storage permissions and immutability policy. Older backups are reconsidered on the next complete run. |
| Older backups were kept because this backup is incomplete. | Retention cleanup only runs after a complete backup. | No action needed. Fix the cause of the incomplete backup. |
| This backup stopped before it finished, for example because TenuVault was closed. It holds only part of the tenant. | The app closed or the machine slept during the backup. | Run a new backup. The partial backup can still be used for restore. |
| This backup failed before it finished. It holds only the policies it saved and is never used as a complete backup. | The backup stopped after saving some policies, for example because the sign-in expired, Microsoft Graph stopped responding or the deadline passed. A backup you cancelled says “This backup was cancelled before it finished.” instead. The backup log shows the error. | Run a new backup. Selected policies it saved can still be restored one by one; a full restore from it is refused. |
| Backup name belongs to another tenant. | Shown by Drift Detection when one of the two backups to compare names another tenant in its metadata.json or ownership marker, for example in a storage account several tenants share. | Select the tenant the backup belongs to, or compare two of this tenant’s backups. If the backup should be this tenant’s, check the TenantId in its metadata.json: a folder copied from another tenant keeps that tenant. |
| N backups could not be read. Select Refresh to try again. | The record of which tenant these backups belong to could not be read, for example because the storage did not answer. They may belong to another tenant that shares the storage account, so they are left out of the list and the Dashboard. | Select Refresh. Once the record can be read, each backup is listed again, or left out if it belongs to another tenant. |
| Backups are unavailable. Check this tenant’s sign-in, license, and storage access. | Backup History could not load. | Sign in again, check the license, and check storage access. |
| This backup was encrypted with a key this device does not have. Import its recovery key. | The backup was made on another device or before a reinstall. | Import the recovery key in Settings > Storage and recovery > Import a recovery key. See Encryption and recovery key. |
| This is not a TenuVault recovery key. Use a TVK2 bundle or a legacy TVK1 key. | The pasted text is not a recovery key. | Paste the full key from the recovery key file, starting with TVK2. |
| This folder has backups this device cannot read | The local backup folder holds backups written by another installation with a different key, for example on another computer or before a reinstall, or backup files are damaged or missing. TenuVault found this by reading the tenant’s backup inventory, as a backup does. Other backups stay usable and new backups are saved, but nothing in the folder is deleted until this is resolved. | Select Import recovery key in the notice and paste that installation’s recovery key, or select Choose another folder to use an empty folder. See A folder with backups this device cannot read. |
| Backup name is unavailable: reason | Files of this backup in the local backup folder were made with a key this device does not have, are damaged, or are missing. Backup History lists it as Unavailable; other backups work as before. | Import the recovery key of the installation that made them, or restore the files from a copy. See Damaged backup files. |
| Some backups may be missing from this list | Shown above the Backup Timeline when files in the tenant’s local backup folder cannot be read. The notice says why: most likely made with the recovery key of another device or an earlier installation, refused by the file system (with its error code, such as EACCES), holding the same backup items twice, or damaged or incomplete. Files for different reasons are counted by reason under Show file names. When the reasons are not known, it says the files may have been made with another recovery key or may be damaged. New backups are still saved, and older backups are not deleted until this is fixed. | Follow the notice: select Import recovery key when it is offered, check the folder’s permissions and that a sync app has downloaded the files, keep one copy of each duplicate, or restore damaged files from a copy, then select Refresh. Open backup folder opens the tenant’s folder, and Show file names lists the encrypted names on disk. See Damaged backup files. |
| No readable backups found for this tenant | No backup could be listed, and files in the backup folder cannot be read, so some backups may be missing. | Resolve the files the notice above the timeline describes. |
| Retention is paused. N file(s) in the backup folder could not be read… | Retention deletes nothing while the folder holds damaged files or an unavailable backup. | Resolve the damaged files; retention resumes on the next backup. |
| Download failed: N backup files could not be read. Retry to download a complete archive. | Some files could not be read while building the ZIP. | Retry the download. Check storage access if it keeps failing. |
Importing a backup ZIP
Section titled “Importing a backup ZIP”| Message | Fix |
|---|---|
| Choose an archive smaller than 128 MiB | Only archives up to 128 MiB can be imported. |
| A TenuVault export manifest with source tenant identity is required | The ZIP is not a TenuVault export or its manifest was removed. Use the original Download from Backup Details. |
| Only complete backups with item metadata can be imported | Export a backup whose status is Complete. |
| Backup contents do not match the export inventory / Backup archive is incomplete or contains extra files / Archive contains an unsupported file | The ZIP was changed after export. Use an unmodified export. |
| This backup already exists on this device | The backup was already imported. Choose This device as storage for the tenant to see it. |
Azure storage
Section titled “Azure storage”| Message | Cause | Fix |
|---|---|---|
| Could not list your Azure storage accounts. / Failed to access Azure subscriptions | TenuVault could not list your subscriptions or storage accounts. | Check that your account can see the subscription in the Azure portal and that the app registration has the Azure Service Management permission with admin consent. |
| No storage accounts found that your account can see. Ask an Azure administrator to create one and grant you access. | Your account has no access to any storage account. | Send your Azure administrator Create a storage account for TenuVault: its script creates the account and grants your admin group access. |
| You do not have write access to storage account name. Ask an Azure administrator for the “Storage Blob Data Contributor” role on it. New role assignments can take a few minutes to apply. | Your account lacks a data role on the storage account. Owner or Contributor alone does not grant access to blob data. | Assign Storage Blob Data Contributor on the storage account, wait a few minutes, and click Check access again. |
| Your account cannot read backups in storage account name. Ask an Azure administrator for the “Storage Blob Data Contributor” role on it. | Same cause, when listing backups. | Same fix. |
| Storage account name rejected the request from this network. Allow this computer’s public IP address in the storage account’s networking settings, or connect through a network it allows. | The storage account firewall blocks your network. | Add your public IP address in the storage account’s Networking settings, or connect through an allowed network. |
| Storage account name could not be reached. | Network or DNS problem, or a proxy blocks *.blob.core.windows.net. | Check that the device can reach <account>.blob.core.windows.net over HTTPS 443. |
| Storage account name returned status (code): message | Azure Storage returned another error. | Act on the code and message shown. |
| This backup was encrypted by an earlier TenuVault version. Import the recovery key of the device that made it to open it. | An Azure backup made by a TenuVault version before plain Azure backups, encrypted with another device’s key, or a damaged copy of one. New backups are plain and not affected. | Select Import recovery key in the notice on Backup & Restore, or use Settings > Storage and recovery > Import a recovery key, with the recovery key of the device that made it. If the key is correct, the file is damaged; use another backup. See Older encrypted Azure backups. |
| N older Azure backups need a recovery key | The tenant’s storage account holds such backups. In a storage account several tenants share, they may be another tenant’s. | Import the recovery key of the device that made them, or ignore the notice: it never blocks backups or restores from your other backups. |
| This backup was encrypted by an earlier TenuVault version and could not be opened for this tenant. It belongs to another tenant, or it needs the recovery key of the device that made it. | Shown when you restore, download or validate such a backup. | Same fix as above. |
| This backup file is larger than the 32 MiB TenuVault reads, so it was not opened. | A file of an Azure backup that an earlier TenuVault version encrypted is larger than 32 MiB. TenuVault does not open encrypted files that large. New backups are plain and not affected. | Use another backup, or run a new backup and restore from it. |
| Backup tenant context is unavailable. Sign in again. | Opening an Azure backup that an earlier TenuVault version encrypted needs the tenant of a current sign-in. | Sign in to the tenant again and retry. |
Restore
Section titled “Restore”| Message | Cause | Fix |
|---|---|---|
| No backups to restore from | The tenant has no backup with items, or its only backup is still running. | Run a backup first. |
| This backup did not complete fully, so some items may be missing from it. | The chosen backup stopped early or had failures. | Items that were saved restore normally. Pick another backup if the item you need is missing. |
| Intune does not let apps download installer files. Upload the installer again to restore this app. | The app type needs an installer, which Intune does not export. | Upload the installer through Intune. See What cannot be restored. |
| This backup holds a masked OMA-URI value (****). Create a new backup to restore it; restoring would send **** to devices. | The backup captured a secret as ****. | Run a new backup, then restore from it. |
| This is the tenant default. Restore updates it in place. / This is the default branding. Restore updates it in place. | Defaults cannot be copied. | Use Replace in place. |
| Replace only: this object cannot be copied. | Shown in Replace in place mode for items that cannot be restored as copies. | Keep Replace in place for this item. |
| This backup does not record its tenant. Restore it as a copy instead. | Neither the backup’s metadata.json nor its ownership marker names a tenant, so TenuVault cannot tell it belongs to this tenant. Only backups from very old versions look like this. | Restore it as an unassigned copy, or restore from a newer backup. See When replace in place is blocked. |
| This backup belongs to another tenant. | Shown when you restore, revert, download or validate a backup whose metadata.json or ownership marker names another tenant, for example in a storage account several tenants share. An older encrypted Azure backup that opens only for another tenant signed in on this device gets the same message. | Select the tenant the backup belongs to, or pick one of this tenant’s backups. A folder copied from another tenant keeps that tenant’s TenantId, so TenuVault never restores it in place for this one. |
| This backup’s metadata is larger than the 32 MiB TenuVault reads, so its tenant cannot be checked. | The backup’s metadata.json is larger than 32 MiB, so TenuVault does not read it and cannot tell which tenant the backup belongs to. A damaged or replaced file is the usual cause. | Restore from another backup, or run a new backup. Check the file in the storage account if every backup shows this. |
| This backup’s ownership record is damaged, so TenuVault cannot tell which tenant it belongs to. | The backup’s .tenuvault-owner.json cannot be read as a record that names a tenant. | Restore from another backup. Retention also leaves such a backup in place. |
| This backup file does not match its recorded fingerprint. It was not restored. | The backup file changed after the backup recorded it, for restores, Revert and Recreate alike. | Restore from another backup. |
An [Unverified legacy] name, or “This snapshot is not authenticated. Review its content and restore a copy; replacement is blocked.” | Shown only by TenuVault versions before plain Azure backups, for Azure backups made by a newer version. | Update TenuVault on that computer. The current version restores these backups in every mode. |
| Assignment replacement is not supported for type. Turn off Restore assignments and reconcile assignments in Intune. | Windows Autopilot profiles, Apple user enrollment profiles, terms and conditions and Intune roles cannot have assignments replaced in place. | Restore these items in their own selection with Restore assignments off. See Restore modes and assignments. |
| Assignments were not restored: this backup was made by an earlier TenuVault version that could not read them. Assign the policy in Intune. | Earlier versions saved Settings Catalog policies (including endpoint security and Settings Catalog compliance policies) without their assignments. Restoring such a backup with Restore assignments leaves the item’s current assignments as they are instead of removing them. | Check the item’s assignments in Intune. Backups made with this version include the assignments. |
| property changed since the backup and Intune cannot change it on an existing app. Delete the app and restore it to recreate it. | Some app properties can only be set on create. | Delete the app in Intune, then restore it with Replace in place to recreate it. |
| Submitted for approval / Multi Admin Approval protects type in this tenant. Nothing was changed. | Intune Multi Admin Approval protects this item type in the tenant. Nothing was written for the item yet. | Submitted items: ask an approver to approve the request in Intune, then select Complete under Waiting for approval. Items not sent: enter a justification there and select Submit for approval. In a copy to other tenants, nothing is sent for approval: make the change in the target tenant’s Intune admin center. Retry failed items does not help. See Multi Admin Approval. |
| Restore: the current version could not be checked | Reading the live item for the review failed. The read error is shown under the item. | Check the error. The item is still restored if you continue. |
| The backup file could not be read. / This snapshot could not be assessed. | TenuVault could not read the snapshot. | Check storage access, and for backups on this device or older encrypted Azure backups, the recovery key. See Backup and Azure storage. |
| Assignments could not be restored: message / Settings could not be restored: message | The object was created or updated, but a follow-up step failed. The result shows “Incomplete object: ID”. | Click Retry failed items within one hour to repair it without creating another object, or complete it in Intune. |
| Repair is unavailable or expired. Check the existing object in Intune; do not create another copy. | The one hour repair window passed or the app was restarted. | Complete the incomplete object in Intune. |
| The live object changed after the failed restore. Review it and start a fresh replacement. | Someone changed the object between the failure and the repair. | Review the object and restore it again. |
| Outcome unknown. Check Intune before attempting another restore. / Check this item in Intune before retrying; a write may already have completed. | The response of a write was lost, for example because the connection dropped. | Check the item in Intune, then resolve the write in Restore write history. See Restore write history. |
| A previous write has an uncertain outcome. Reconcile it in Settings before retrying. | An identical earlier write has an unknown outcome. | Open Settings > Storage and recovery > Restore write history and choose Confirm applied or Confirm not applied. |
| Restore journal is full. Review write history in Settings before continuing; recent reconciliations stay protected for one hour. | The write history holds 1,000 records that cannot be removed yet. | Resolve uncertain records in Restore write history, or wait an hour. |
| Microsoft Graph did not return an ID. Check Intune before retrying. | Graph accepted a create but returned no ID. | Look for the object in Intune before retrying, so you do not create a duplicate. |
| Microsoft Graph retry limit reached | Graph kept throttling the request. TenuVault tries each request up to four times and honours retry delays up to 30 seconds. | Wait a few minutes and use Retry failed items. |
| Unresolved target dependencies (paths). Copy the dependencies first or reconcile this object in the target tenant. | A cross-tenant copy refers to objects that do not exist in the target tenant. | Include the dependencies in the same restore, or map apps and app categories. See Restore to another tenant. |
| A mapped dependency is missing or unreadable in the target tenant | A mapped target ID does not exist or cannot be read. | Check the target IDs in the target tenant. Nothing was written. |
| The original target tenant is no longer connected. | A retry targets a tenant that was removed from TenuVault. | Connect the tenant again, or start a new restore. |
| Sign in with licensed Intune access to this tenant before viewing or changing restore history. | Restore write history requires sign-in, a license and live Intune access for the tenant. | Sign in to the tenant again and check its license and your Intune role. |
Updates
Section titled “Updates”| Message | Cause | Fix |
|---|---|---|
| Could not check for updates: message | TenuVault could not reach GitHub releases. | Allow github.com, release-assets.githubusercontent.com and objects.githubusercontent.com over HTTPS. Backup and restore keep working without updates. See Network connections and data flows. |
| Your organization manages updates for TenuVault. | Automatic updates are turned off by policy (DisableAutoUpdate). Check now is unavailable. | Your IT department deploys updates. See Deploy TenuVault in your organization. |
| Automatic updates are off. | Download and install updates automatically is off in Settings > Updates. | Tick the setting to turn updates back on. |
| Green Update available label at the bottom of the sidebar. | An update is downloading or ready to install. | Select the label. It installs and restarts TenuVault when the download finishes. Or use Restart and update in Settings > Updates. |
A stable install follows stable releases by default. Enable Settings > Updates > Get nightly builds to receive previews, plus any stable release that is newer than the latest nightly. Turn it off to return to the current stable release, even if that version is older than the installed nightly. See Install and update TenuVault.
Background backups
Section titled “Background backups”| Message | Cause | Fix |
|---|---|---|
| Scheduled backup of tenant failed / Tray backup of tenant failed | Desktop notification after a scheduled or tray backup fails. The title identifies how it started. The body holds the reason. | Click the notification to open that tenant’s Schedule tab in Backup & Restore. Check the failure reason there. A failure before any backup was saved can leave no entry in stored backup history. For a scheduled backup, TenuVault retries 15 minutes after the failed attempt finishes, up to three attempts per slot, then waits for the next scheduled slot. A failure does not count toward the three attempts when the backup saved nothing, got no answer from Microsoft Graph or Azure Storage, and every failure was a connection failure or timeout. It is still retried 15 minutes later. Its notification is sent once per slot. A backup started from the tray is not retried: start it again from the tray or from Backup & Restore. |
| Not backed up: reason | A scheduled or tray backup was refused because the license or plan does not cover it. The schedule panel lists these under “Not backed up because of the license”. | Fix the license, or change the schedule to one your plan includes. Daily schedules and Azure storage need Pro or MSP. |
| This tenant is no longer connected. | A schedule exists for a tenant that was removed. | Add the tenant again, or remove its schedule. |
| Choose a time such as 02:00. / Choose a day of the week. | The schedule time or day is invalid. | Enter a 24 hour time and, for weekly schedules, a weekday. |
| Unable to check / Could not check background startup. Try again. | The background runner status request failed. Installation stays disabled. | Open Settings > Background runner and select Retry check. A successful check replaces the message with Installed or Not installed. |
| Not installed | The status check reports that the background runner is absent. | In an installed build, select Install background launch in Settings > Background runner. This adds a LaunchAgent for your user account on macOS or a scheduled task for your user account on Windows. |
| Background launch requires an installed Windows or macOS build. / Available in installed Windows and macOS builds. | The background runner only works in the installed app. | Install TenuVault with the installer and try again. |
| An older direct-launch agent is loaded. Remove background launch first, then log out and back in before reinstalling; active backups are left running. | macOS still has an agent from a pre-release build. | Click Remove background launch, log out and back in, then install it again. |
| The TenuVault window comes to the front every few minutes on macOS | The background runner of an earlier build reopened TenuVault every five minutes even while it was running, and macOS treats that like a click on the Dock icon. | Update TenuVault and start it once. It replaces the background runner with one that leaves a running TenuVault in the background. If the window still comes to the front, select Remove background launch and then Install background launch in Settings > Background runner. |
| TenuVault is still running | Shown when you close the window. TenuVault keeps running in the menu bar on macOS or the tray on Windows so schedules can run. | Quit TenuVault from that icon to stop the current process. An installed background runner may reopen it within five minutes, as the row above Quit explains. To stop automatic restarts, select Remove background launch in Settings > Background runner and turn off start at login before quitting. |
Overlapping tray and scheduled requests for one tenant share the running backup and produce one failure notification. Its title identifies the request that started the backup. The tenant label uses its friendly name, then its domain, then “this tenant”. The tenant ID is not used as the label, though the reported error message can contain one.
Scheduled backups also stop when:
- The machine is asleep, off, or you are signed out. The background runner only runs in your own signed-in session and does not wake the machine. Locking the screen does not sign you out; closing a laptop lid may put it to sleep. A missed slot runs once at the next start.
- The sign-in needs interaction. A background backup cannot complete MFA or Conditional Access prompts. Sign in again when TenuVault shows the banner. If this happens every night, a sign-in frequency policy ends your session (
AADSTS70044); see Conditional Access and TenuVault for ways to keep scheduled backups running, including the optional Backup Reader. - The backup storage is unavailable. Check the storage messages above.
See Schedule backups.
Baselines and frameworks
Section titled “Baselines and frameworks”| Message | Cause | Fix |
|---|---|---|
| Another change is being applied to this tenant: label. Try again when it finishes. | An OpenIntuneBaseline deployment, drift fix or undo, a promotion, baseline upgrade, custom baseline change or rollback, or framework policy creation is already running for this tenant. TenuVault refuses overlapping writes to the same tenant. | Wait for the named change to finish, review its results, then retry your change. Changes to other tenants can run at the same time. |
Messages from the OpenIntuneBaseline section and framework comparisons are covered on their own pages:
Share feedback
Section titled “Share feedback”Select Share feedback in the sidebar, just above Support, to tell us what you were trying to do and what got in your way. It is available on every plan, including Community and without a license.
- Open the screen where you got stuck, then select Share feedback.
- Answer What were you trying to do? and What got in your way, and what would help? Both are required, up to 500 characters each.
- Optionally tick Attach a screenshot of this window. The screenshot is taken when you open the dialog, so the dialog itself is not in it. It may show tenant, policy or user names, so it is never attached unless you tick it.
- Optionally enter a Reply-to email if you would like an answer.
- Check Sent with your feedback, which lists everything that goes with your answers: the TenuVault version, your operating system and its version, your plan, the section you were on, a random message ID so a retry is not counted twice and, when ticked, the screenshot. Then select Send feedback.
Nothing is sent before you select Send feedback. Your answers stay in the dialog while TenuVault runs, so you can close it and come back. If sending fails, for example because you are offline or your network blocks www.tenuvault.com, the dialog keeps your draft and shows why. Try again later, or select Copy as email. It copies the full text (subject, both answers, the same details and the message ID, without the screenshot) to the clipboard and opens a new email to support. The email draft may be shortened to fit what mail apps accept, so if anything is cut off, paste the copied text instead. If no mail app opens, paste the text into an email to support@tenuvault.com.
Feedback and its screenshot are stored up to 12 months; the email copy to support is kept as support correspondence. See Network connections and data flows for exactly what is sent. For a problem that is blocking your work, use Support instead.
Still stuck?
Section titled “Still stuck?”Check Settings > About for your TenuVault version and sign-in method, then contact support through Website and support on the same page, or tell us what got in your way with Share feedback.