Hello everyone!
Someone deletes a Conditional Access policy. A named location is changed. A group’s membership is altered during an incident. The question every admin dreads: can we get it back to how it was?
Microsoft Entra now has a built-in answer. Microsoft Entra Backup and Recovery automatically backs up core directory objects and lets you restore them to a known good state—no third-party tool required.
Scope: This walkthrough uses public Microsoft documentation and real, redacted screenshots from a dedicated synthetic lab tenant. No production or customer data is shown. Confirm current availability and limits before relying on it.
What it protects
Backup and Recovery captures selected properties of your most security-critical objects: users, groups, applications, service principals, Conditional Access policies, named locations, authentication method policy, and authorization policy. It also covers Agent ID objects.
For reference (Microsoft Entra Backup and Recovery overview).
How the backups work
- Microsoft takes one backup per day, automatically, retaining the last 7 days.
- Backups are immutable: no signed-in user or app—even with the highest admin privileges—can turn off, delete, or modify them.
- Backup data stays in the same geo-location as your tenant.
For reference (Microsoft Entra Backup and Recovery overview) and (Microsoft Entra data residency).
Licensing and where to find it
- Licensing: your tenant needs Microsoft Entra ID P1 or P2. It must be a workforce tenant (External ID and Azure AD B2C aren’t supported).
- Location: Microsoft Entra admin center → Backup and recovery. You’ll find Overview, Backups, Difference Reports, and Recovery History.
For reference (Microsoft Entra Backup and Recovery overview).
Access is least-privilege by design
Here’s a detail that surprises admins: opening the backup data isn’t automatic. Access is governed by two dedicated built-in roles:
- Microsoft Entra Backup Reader—view backups, view difference comparisons, and review recovery history.
- Microsoft Entra Backup Administrator—everything the Reader can do, plus initiate difference reports and trigger recovery. (These permissions are included in Global Administrator.)
Without the right permission, opening Backups returns a clear “No access” message—a good reminder that this is scoped access, not something every admin role lands on by default.
For reference (Microsoft Entra Backup and Recovery overview).
The recovery workflow
- Browse backups—the available restore points from the last seven days.
- Create a difference report—compare a backup to the current tenant state and review exactly which attributes and links changed. Always do this first.
- Recover—restore everything, selected object types, or specific object IDs.
- Review recovery history—track completed and in-progress operations.
The difference report is the star: it turns “I think something changed” into “here’s precisely what changed, and here’s what I’ll revert.”
For reference (Microsoft Entra Backup and Recovery overview).
What it does not do
- It cannot recover hard-deleted objects. It restores properties and links of existing (or soft-deleted) objects—it does not re-create permanently deleted ones.
- Soft-deleted users, Microsoft 365 Groups, cloud security groups, app registrations, and service principals remain restorable for 30 days through the existing soft-delete path; Backup and Recovery complements that, it doesn’t replace it.
- For hybrid objects synced from AD DS, you can create difference reports to spot changes, but full recovery requires moving the group’s source of authority to the cloud.
For reference (supported objects and limitations) and (soft deletion in Backup and Recovery).
Final takeaway
Microsoft Entra Backup and Recovery turns tenant resilience from a hope into a workflow: daily immutable backups, a difference report to see exactly what changed, and scoped recovery to put it right. Treat it as one layer of a broader recoverability strategy—not a substitute for change control, soft-delete awareness, or protecting against hard deletion in the first place.
Information current as of October 7, 2026. Confirm current availability, licensing, and limits before implementation.
