Microsoft Entra Backup and Recovery finally available

Maxime Hiez
Entra ID
23 Jul, 2026

Introduction

Accidentally deleting a user account, a conditional access policy, or a service principal assignment can quickly paralyze a Microsoft Entra ID tenant. Until now, no native mechanism allowed restoring these objects to a prior state without resorting to third-party tools or manual procedures. Microsoft Entra Backup and Recovery is now in General Availability and fills this gap directly from the Entra portal.

What is Microsoft Entra Backup and Recovery ?

Microsoft Entra Backup and Recovery is an integrated, always-on backup solution. It automatically takes a daily snapshot of critical directory objects and retains a seven-day history. No configuration is required to get started, and no one can disable, modify, or delete the backups, even a Global Administrator.

The solution is accessible from the Microsoft Entra portal via the Backup and recovery section, which contains four sub-pages : Overview, Backups, Difference reports, and Recovery history.

What is covered

The solution covers the main directory objects, with full or partial coverage depending on the type :

Conditional access policies : Full coverage of all properties.
Named locations : Full coverage of all properties.
Users : Partial coverage (33 properties ; manager and sponsor links are excluded).
Microsoft 365 and security groups : Partial coverage (12 properties ; static members included, dynamic group rules and owner links excluded).
Applications : Partial coverage (selected configuration properties ; secrets, certificates, and application proxy configuration excluded).
Service principals : Partial coverage (app role assignments recovered as anchors).
Authentication methods policies : Selected methods (FIDO2, Authenticator, SMS, Voice, Email OTP, OATH, TAP, CBA).

Several items are explicitly excluded :

Microsoft 365 resources : Mailboxes, OneDrive, and SharePoint fall under Microsoft 365 Backup Storage, a separate product.
Permanently deleted objects : Cannot be recovered or recreated. Using protected actions in Entra is recommended to limit this risk.
Objects synchronized from on-premises AD : Visible in difference reports, but excluded from recovery. Restoration must be performed in the local Active Directory.
User OAuth2 consents : Only admin consents of type AllPrincipals are included.

How to access it ?

Access to the feature requires one of the following roles :

Microsoft Entra Backup Reader : View backups, difference reports, and recovery history.
Microsoft Entra Backup Administrator : All Reader permissions, plus the ability to launch difference reports and recovery tasks.

The recommended workflow is to launch a difference report before any recovery, to review exactly what has changed. This step also pre-loads the backup data and speeds up the subsequent recovery task.

During a recovery, three scope levels are available :

Recover all objects to a prior state.
Recover only certain object types (for example, only conditional access policies).
Recover up to 100 specific objects identified by their Object ID.

Availability and prerequisites

Microsoft Entra Backup and Recovery is included at no additional cost with Microsoft Entra ID P1 and P2 licenses. The feature is available for Workforce tenants only. Entra External ID and Azure AD B2C tenants are not supported.

Programmatic access via Microsoft Graph is available, but only under the /beta endpoint (microsoft.graph.entraRecoveryServices namespace). The use of beta APIs in production is not officially supported by Microsoft.

Conclusion

Microsoft Entra Backup and Recovery finally provides a native safety net for Entra ID directory objects. For a complete resilience strategy, it is recommended to complement it with soft-deletion monitoring, protected actions for critical objects, an infrastructure-as-code approach for conditional access policies, and Microsoft 365 Backup Storage for Exchange, OneDrive, and SharePoint data.

Sources

Microsoft Learn - Entra backup and recovery overview

Microsoft Learn - Supported objects and properties

Microsoft Learn - Backup model, difference report, and recovery

Microsoft Learn - Recover objects

Did you enjoy this post ? If you have any questions, comments or suggestions, please feel free to send me a message from the contact form.

Don’t forget to follow us and share this post.

Tags :

Email verification of external Teams participants

Maxime Hiez
Teams
19 Nov, 2024

Introduction Microsoft Teams Premium introduces a new feature to enhance the security and reliability of your meetings: email verification for external participants. This feature allows m

How to activate Microsoft 365 Passkey in Entra ID

Introduction Microsoft 365 Passkey is an authentication method that replaces passwords with more secure options like facial recognition, fingerprint, or a PIN.Prerequisites **<

How to sign in with Passkey to Microsoft 365

Introduction Microsoft 365 Passkey is an authentication method that replaces passwords with more secure options like facial recognition, fingerprint, or a PIN.Prerequisites **<

How to enable LAPS on the MTR Admin account via Intune

Introduction Microsoft's LAPS (Local Administrator Password Solution) is a free tool designed to improve password security for local administrator accounts on workstations, servers and

Impact analysis of Entra ID conditional access policies

Maxime Hiez
Entra ID
17 Mar, 2025

Introduction Conditional access in Entra is a security policy that allows administrators to control access to applications and resources based on specific conditions. These conditions can i

How to create a Windows local admin account via Intune LAPS

Introduction I wrote an article last February on how to replace the password of your MTR's local account using LAPS (Local Administrator Password Solution) in Intune. I concluded my article

New security approach for non-compliant emails

Maxime Hiez
Defender
07 Apr, 2025

Introduction Microsoft has announced a major update to Defender for Office 365 that strengthens email security by improving the handling of non-RFC compliant emails. This initiative is

Blocking screenshots during Teams meetings

Maxime Hiez
Teams
12 May, 2025

Introduction Microsoft Teams continues to strengthen the privacy and security of online meetings. Starting in July 2025, a new feature will be rolled out to prevent screenshots during meeti

"Anti-Tampering" certification for Defender for Endpoint (2025)

Maxime Hiez
Defender
16 May, 2025

Introduction Microsoft recently announced that Microsoft Defender for Endpoint has successfully passed the 2025 anti-tampering tests conducted by AV-Comparatives, a recognized independe

How to enable DLP for Teams with Purview

Introduction In a context where sensitive data, particularly banking information, is increasingly circulating in collaborative tools, businesses must be extra vigilant to avoid accidental o

How to enable DLP for Outlook with Purview

Introduction Last week, I showed you how to enable DLP for Teams with Microsoft Purview to prevent accidental or malicious data leaks (Data Loss Prevention). Purview is a comprehensive

Entra Private Access for Domain Controllers

Maxime Hiez
Entra ID
22 Aug, 2025

Introduction Microsoft has announced the Public Preview of Microsoft Entra Private Access for Active Directory Domain Controllers, a major step forward in strengthening the security of

How to activate Defender EDR in "Block Mode"

Introduction In a context of constantly evolving cyber threats, antivirus solutions are no longer sufficient to effectively protect workstations. Microsoft Defender for Endpoint's *Block

How to enable DSPM for AI with Purview

Introduction With the rise of generative AI models, the phenomenon of Shadow AI (the use of artificial intelligence tools and services not approved or controlled by organizations) is incr

How to block a website URL in Edge with Defender

Introduction Web browsing is one of the most common attack vectors in business environments. To strengthen security, Microsoft Defender for Endpoint offers a powerful feature : blocking m

How to enable DLP for cloud storage with Purview

Introduction A few months ago, I showed you how to enable DLP for Outlook with Microsoft Purview to prevent accidental or malicious data leaks (Data Loss Prevention). Purview is a com

Extend Zero Trust to AI agent identities in Entra ID

Maxime Hiez
Entra ID
30 Jan, 2026

Introduction AI agents are becoming increasingly widespread in businesses (incident summaries, log analysis, flow execution, etc.), and it is crucial that their access is continuously evalu

How to enable DLP for printing with Purview

Introduction A few weeks ago, I showed you how to enable DLP to prevent the copying of financial data to an external cloud storage solution using Microsoft Purview, in order to prevent

How to enable DLP for AI websites with Purview

Introduction Last week, I showed you how to enable DLP to prevent printing of financial data using Microsoft Purview, in order to prevent accidental or malicious data leaks (*Data Loss

How to enable DLP for copy/paste with Purview

Introduction Last month, I showed you how to enable DLP to prevent financial data from being sent to an AI website using Microsoft Purview, in order to prevent accidental or malicious d

Purview Sensitivity Labels are coming to OneNote

Maxime Hiez
Purview
13 Mar, 2026

Introduction Good news for security and compliance teams, Sensitivity Labels are now General Availability in OneNote. This update finally allows you to apply the same classification a

How to block Teams calls and chats with Purview IB

Introduction Microsoft Purview's Information Barriers allow you to restrict communication and collaboration between specific user groups within a Microsoft 365 environment. Their prim

External MFA is now available in Entra ID

Maxime Hiez
Entra ID
27 Mar, 2026

Introduction Microsoft has announced the General Availability of External MFA, in Microsoft Entra ID, formerly known as External Authentication Methods. This feature allows the use

How to create Sensitivity Labels for emails in Purview

Introduction Emails remain one of the primary vectors for information leaks in businesses. Whether it's a message sent to the wrong recipient, an attachment forwarded without proper oversig

How to secure your emails with Sensitivity Labels

Introduction Last week, I showed you how to create Sensitivity Labels to secure your emails, without explaining how they work. Today I'll talk about how to use them and what results you g

Detect exposed passwords in plain text with Purview

Maxime Hiez
Purview
21 Apr, 2026

Introduction In a Microsoft 365 environment, data breaches aren't limited to credit card numbers or personal information. A frequently underestimated risk is the sharing of passwords in p

Microsoft raises the conditional access policy limit

Maxime Hiez
Entra ID
21 May, 2026

Introduction Microsoft quietly raises the limit of conditional access policies per tenant, from 195 to 244. This limit applies to all policies, whether active, disabled, or in *report-onl

How to create Sensitive Information Types in Purview

Introduction In previous articles, we examined how Microsoft Purview can protect sensitive data through DLP (Data Loss Prevention) policies and Sensitivity Labels. However, all thes

Purview Sensitivity Labels now support security groups

Maxime Hiez
Purview
09 Jul, 2026

Introduction Microsoft has updated the scoping of Sensitivity Labels policies in Microsoft Purview, now generally available. Administrators can now include non-mail-enabled security

Bot protection in Microsoft Teams meetings

Maxime Hiez
Teams
21 Jul, 2026

Introduction AI note-taking tools like Read.ai, Fireflies.ai or Otter.ai join meetings as external participants. For organizers, this raises a real control challenge : when the lobby

How to migrate SMS and voice users to Passkey

Maxime Hiez
Mistral AI
17 Aug, 2026

Introduction Mistral AI announced on August 4, 2026 Shieldstral, a multimodal safety classifier meant to moderate the inputs and the outputs of a language model. The model sits before a