Skip to main content
TenuVault
Download
FreeCommunity forever, Pro free for 14 days

Unlimited devices, one flat price

You pay per tenant, never per device, so your price stays the same as your fleet grows. Protect one tenant for free. Control change with Pro. Standardize customer tenants with MSP. Prices in EUR, excluding VAT.

Plans

Community Free

For admins who want a real safety net for one tenant.

Free
Unlimited devices, no per device fees

Forever. No paid license or TenuVault web account.

Download

Includes

  • 1 Microsoft Entra tenant
  • Manual backups and a weekly scheduled backup
  • Supported Intune configuration types, with assignments
  • Encrypted local storage with a recovery key
  • 30 days of backup history
  • Restore single items, unlimited
  • Drift detection with diffs
  • OpenIntuneBaseline deployment, comparison and validation
  • Supported framework mappings except CIS, with PDF, CSV and JSON reports
Recommended

Pro

For organizations that must recover fast and control change.

€49per month

Excl. VAT, added at checkout. Business VAT IDs accepted.

Unlimited devices, no per device fees

2 tenants, billed monthly.

Start free trial

Every new tenant starts with 14 days of Pro. No card and no email. Afterwards, keep using TenuVault free on Community with one tenant.

Need longer? Extend once in the app. Need a quote or invoice? Get a yearly quote as a PDF.

Card, Apple Pay or Google Pay. Yearly plans can also be paid by invoice.

Everything in Community, plus

  • 2 tenants, for example production and test
  • Full backup restore and replace in place
  • One click revert of drifted policies
  • Daily schedules and custom retention
  • Backups in your own Azure storage account
  • Baseline management: create only what is missing
  • Restore and change audit log
  • Up to 5 installations per tenant
  • Email support
  • Dev → Prod promotion of supported Settings Catalog settings
  • Dashboard scores for OIB and supported frameworks
  • Policy conflict and hygiene explorer
  • Versioned custom baselines and reviewed upgrades
  • Scheduled health review and opt-in notifications
  • Full white-label PDF reports with your logo and colors
  • CIS Benchmarks assessment and remediation, with reports, for the certified benchmarks

MSP

For service providers and organizations with 5 or more tenants.

from€99per month

Excl. VAT, added at checkout. Business VAT IDs accepted.

Unlimited devices, no per device fees

Includes 5 tenants. Additional tenants per month: €15 for tenants 6 to 25, €10 for tenants 26+.

Start free trial

Every new tenant starts with 14 days of Pro. No card and no email. Afterwards, keep using TenuVault free on Community with one tenant.

Card, Apple Pay or Google Pay. Yearly plans can also be paid by invoice.

Everything in Pro, plus

  • Includes 5 tenant slots, add more as you grow
  • All tenants in one app with a tenant switcher
  • Cross tenant dashboard for backups and drift
  • Bulk restore and baseline rollout across tenants
  • Per tenant schedules and storage
  • Optional license sharing with a customer tenant
  • Priority email support
  • Versioned customer standards and overlays

Buying through procurement? For yearly plans, create a PDF quote in a minute, order with your purchase order and pay by invoice and bank transfer. Get a quote or email us. Evaluate first with the 14 day trial, no credit card needed.

Estimate your MSP price

Includes 5 tenants. Each additional tenant is priced within its band, with a lower rate from tenant 26.

10 tenants per month€174
Average per tenant€17.40

Estimate in EUR, excluding VAT. Choose your total tenant slots at checkout. Existing MSP subscriptions use their current billing model. Get a yearly quote for 10 tenants

Try Pro free for 14 days without email or a card, or buy Pro or MSP now; your license key arrives by email. Both include CIS Benchmarks assessment and remediation for the certified benchmarks listed below.

Pay with the email address that should keep the key: it receives the key, the invoices and access to the customer portal. Any admin can enter the key in TenuVault, because it is tied to the Microsoft tenant, not to that address.

Compare plans feature by feature

Compare implemented workflows and their supported scope.

On smaller screens, scroll the table horizontally to compare all three plans.

Implemented workflows in each TenuVault Desktop plan. MSP includes every Pro benefit.
FeatureCommunity FreeProMSP
Plan
DPA (Data Privacy Agreement)Not includedIncludedIncluded
Direct supportNot includedIncludedIncluded
Managed devicesUnlimitedUnlimitedUnlimited
Tenants12, for example production and test5 included, additional tenants billed in bands
Installations per tenantNot applicableUp to 5Up to 5
Additional tenantsOne tenant onlyTwo organization tenants included6–25: €15/month each; 26+: €10/month each. Annual: €150 and €100 each.
Free trialNo license key needed14 daysPro trial available
Security and privacy
Runs locally with your own app registrationIncludedIncludedIncluded
No TenuVault web account for tenant operationsSign in to Microsoft from the desktop app with delegated permissions.IncludedIncludedIncluded
Device backup encryption, recovery key and restore safety checksIncludedIncludedIncluded
Backup
Manual backupsIncludedIncludedIncluded
Weekly scheduled backupsSchedules run while the desktop app can operate in an active user session; the computer must be awake.IncludedIncludedIncluded
Backup download and drift CSV/JSON exportIncludedIncludedIncluded
Daily scheduled backupsNot includedIncludedIncluded
Backups encrypted on this deviceIncludedIncludedIncluded
Backups in your own Azure storage accountNot includedIncludedIncluded
Backup historyUp to 30 days7 to 365 days, or forever7 to 365 days, or forever
Restore
Restore one item as a copyIncludedIncludedIncluded
Restore several items at onceNot includedIncludedIncluded
Replace items in placeNot includedIncludedIncluded
Restore assignmentsNot includedIncludedIncluded
Copy items to other tenants when restoringNot includedNot includedIncluded
Drift detection and audit
Compare backups and detect driftIncludedIncludedIncluded
One click revert of drifted policiesNot includedIncludedIncluded
Audit logNot includedIncludedIncluded
Cross tenant dashboard, including Check all for driftNot includedNot includedIncluded
OpenIntuneBaseline
Deploy OpenIntuneBaseline as new policiesWindows, macOS, Windows 365 and BYOD app protection, using the latest OpenIntuneBaseline version. Each run records the exact version.IncludedIncludedIncluded
Compare existing deployments and validate policies for driftIncludedIncludedIncluded
Policy selection that matches your licensingBusiness Premium or Enterprise, Defender for Endpoint and Autopatch.IncludedIncludedIncluded
Undo a deploymentIncludedIncludedIncluded
Update existing policies in place and fix driftA backup is taken first.Not includedIncludedIncluded
Deploy to several tenants at onceNot includedNot includedIncluded
Frameworks
Framework PDF reports and CSV/JSON exportsAvailable for every framework below. CIS reports need Pro or MSP, like CIS assessment. Reports show evaluated coverage and unknowns; they do not certify compliance.IncludedIncludedIncluded
OpenIntuneBaselineIncludedIncludedIncluded
Microsoft Security BaselinesImport the Settings Catalog policies of your selected baseline.IncludedIncludedIncluded
UK NCSC Device Security Guidance configuration packsRead-only comparison with nine Windows Settings Catalog policies from the public NCSC configuration pack, pinned to a reviewed source version and used under Apache License 2.0. No endorsement by NCSC.IncludedIncludedIncluded
NIST CSF 2.0IncludedIncludedIncluded
NIST SP 800-53 Rev. 5IncludedIncludedIncluded
NIST SP 800-171 Rev. 3 and Rev. 2IncludedIncludedIncluded
ISO/IEC 27001:2022IncludedIncludedIncluded
SOC 2IncludedIncludedIncluded
ASD Essential EightIncludedIncludedIncluded
BSI IT-GrundschutzIncludedIncludedIncluded
UK MOD Def Stan 05-138IncludedIncludedIncluded
Cyber EssentialsIncludedIncludedIncluded
DISA STIGImport reviewed Settings Catalog mappings for a specific STIG.IncludedIncludedIncluded
Custom baselinesIncludedIncludedIncluded
Customize OpenIntuneBaselineChoose latest main or a published platform release, customize its supported Settings Catalog policies, deploy through a reviewed change set and compare your version with newer OpenIntuneBaseline source versions.Not includedIncludedIncluded
Company baseline from a tenant snapshotTurn supported Settings Catalog policies from a tenant snapshot into a versioned baseline, edit it in the app, compare it with supported framework mappings and deploy through a reviewed change set.Not includedIncludedIncluded
CIS Benchmarks assessment and remediationTenuVault is CIS Benchmarks Certified for Assessment and Remediation. The certification covers only the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 (Level 1), CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 (Level 1 and Level 2) and CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 (Level 1 and Level 2). TenuVault remediates only the recommendations it assesses automatically through Intune policy settings. It lists Manual and not assessed recommendations with their CIS guidance for manual action. Remediation runs as a reviewed change set with a backup first.Not includedIncludedIncluded
Teams and tenants
Share the license with other admins in your tenantNot includedOn by defaultOff by default
Back up several tenants at once with Backup SelectedNot includedNot includedIncluded
Assessment and reporting
Dashboard baseline scoresSaved OIB validations of selected deployed policies and supported native framework comparisons: gaps, assessment date and comparable trends. Scores show evaluated coverage and unknowns; they do not certify compliance.Not includedPer-framework scores and coveragePer-tenant scores and portfolio drill-down
Policy conflict and hygiene explorerFind candidate conflicting settings, duplicate profiles, missing targeting and broken references for admin review.Not includedIncludedPer-customer findings and fleet queue
Full white-label PDF reportsYour company name, logo and colors on every PDF report, with no TenuVault branding. Community reports keep the TenuVault design.Not includedIncludedIncluded
Controlled change and recovery
Dev → Prod settings syncTest OIB or supported framework settings in development, then promote selected settings between Pro’s two licensed organization tenants. Start with supported Settings Catalog policies, with a diff, target dependency review, production backup, confirmation and read-back verification. One-way and admin-started; assignments need separate review.Not includedReviewed promotion between two tenantsReviewed promotion between licensed tenants
Baseline upgrades preserving customizationsFor supported Settings Catalog policies, review installed source, local changes and new upstream settings together; resolve conflicts before applying an upgrade.Manual comparisonIncludedVersioned customer overlays
Scheduled health review and opt-in notificationsReview stale backups on a schedule, using local or customer-controlled notification endpoints.In-app backup statusIncludedPortfolio triage and customer ownership
MSP customer operations
Versioned golden standards and customer overlaysNot includedOrganization customizationsReusable standards, parameters and exceptions

Bulk and cross-tenant actions require MSP on the tenants involved. Pro promotion covers its two licensed organization tenants.

TenuVault is CIS Benchmarks Certified for Assessment and Remediation. The certification covers only the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 (Level 1), CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 (Level 1 and Level 2) and CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 (Level 1 and Level 2). TenuVault remediates only the recommendations it assesses automatically through Intune policy settings. It lists Manual and not assessed recommendations with their CIS guidance for manual action. CIS, CIS Benchmarks and CIS Controls are trademarks of the Center for Internet Security, Inc.

Billing questions

Do you charge per device?

No. Every plan covers an unlimited number of managed devices. Community is free for one tenant, Pro is a flat price for two tenants and MSP is priced by tenant. Adding devices to a licensed tenant never changes your price.

Can Pro sync settings from development to production?

Yes. Pro supports reviewed promotion between its two included organization tenants. Test selected OIB or supported framework settings in development, review the diff and dependencies, back up production, then approve and verify the promotion. It starts with supported Settings Catalog policies.

Which CIS Benchmarks does TenuVault support?

TenuVault is CIS Benchmarks Certified for Assessment and Remediation. The certification covers only the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 (Level 1), CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 (Level 1 and Level 2) and CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 (Level 1 and Level 2). TenuVault remediates only the recommendations it assesses automatically through Intune policy settings. It lists Manual and not assessed recommendations with their CIS guidance for manual action. CIS assessment, remediation and CIS reports are part of Pro and MSP. Framework PDF, CSV and JSON reports for every other framework are included in Community.

How does the free trial work?

Download TenuVault and connect a new tenant. Pro starts automatically, without email or a card. Afterwards, keep using TenuVault free on Community with one tenant. Extend once in the app. Optional setup and reminder emails can be stopped at any time.

Can we pay by invoice instead of by card?

Yes, for yearly Pro and MSP plans. Get a quote: enter your company details and the PDF quote for your approval process downloads at once. Or email support@tenuvault.com. Once you order, you receive an invoice from Ugurlabs UG, the company behind TenuVault, payable by bank transfer. To evaluate first, start the 14 day trial, no credit card needed.

How do I cancel or change my plan?

Manage invoices, payment details and your subscription in the customer portal. If you pay by invoice, email support@tenuvault.com instead. When a subscription ends, the app falls back to Community; stored backups are retained and Community limits apply.

What happens when a subscription ends?

The app falls back to Community. Your backups remain in their storage location; access follows Community tenant and storage limits. Paid recovery and Azure features require an active subscription.

How does the MSP plan count tenants?

The new offer includes 5 active tenant slots for €99 per month or €990 per year. Additional tenants 6–25 cost €15 per month each (€150 per year); tenant 26 onwards costs €10 per month each (€100 per year). Each rate applies only within its band. Choose your total tenant slots at checkout. Existing MSP subscriptions use their current billing model; manage them in the customer portal.

Which email address should I use at checkout?

One that should own billing and keep the key, such as a shared IT or finance mailbox. The key, the invoices and the customer portal belong to that address. Who enters the key in TenuVault does not matter: it is tied to the Microsoft tenant signed in to the app, so a different admin can activate it.

Can my whole team use one Pro license?

Yes. A Pro license is shared with the key holder's tenant by default, so other admins in that tenant only sign in. MSP keys share with a customer tenant only when you turn it on.

How many computers can use one license?

Up to 5 installations of the desktop app per licensed tenant. This counts the admin computers running TenuVault, not the devices you manage in Intune, which are unlimited. Deactivate an installation from the License page to free its slot. An installation that has not checked its license for 30 days may be released automatically when a new installation of the tenant needs its slot.

What happens when I am offline?

The app checks its license every few hours. After a successful check it keeps working offline for 14 days.

Take your first backup today

Install, run the setup script, sign in. Your first backup is a few minutes away.

Download for WindowsGet it from Microsoft

Also for Mac: Apple silicon · Intel

Download for Mac

For Apple silicon Macs.Intel Mac? Get the Intel build

Also for Windows: direct download · Microsoft Store

Send yourself the link and install TenuVault on your computer.

Windows: direct download · Microsoft Store

Mac: Apple silicon · Intel

Download for WindowsGet it from Microsoft
Download for Mac

For Apple silicon Macs.Intel Mac? Get the Intel build

Free for one tenant, OpenIntuneBaseline included. Try Pro free for 14 days, no card needed.

Book a 30-minute demoRead the docs