Microsoft Entra Backup and Recovery reached general availability on June 30, 2026. For eligible workforce tenants with Microsoft Entra ID P1 or P2, Microsoft now creates built-in backups of supported directory objects automatically once per day and retains up to seven days of backup history.
This closes an important resilience gap. A mistaken Conditional Access edit, damaged group membership, compromised application object, or broad configuration change no longer has to be reconstructed entirely from screenshots, exports, memory, and audit logs—provided the affected object, property, and timing fall inside the service’s current coverage.
The right expectation: Entra Backup and Recovery is a high-value recovery layer, not a complete identity disaster-recovery strategy. Its seven-day window, supported-object boundaries, hard-delete limitation, and hybrid identity rules still require a broader runbook.
How the built-in backup model works
| Design element | Microsoft’s current model | Operational implication |
|---|---|---|
| Frequency | Supported objects are backed up automatically once per day. | The recovery point is not continuous; very recent changes may not exist in the latest retained backup. |
| Retention | Up to seven days of backup history. | Detection speed matters. A slow investigation can outlast the useful backup window. |
| Tamper resistance | No signed-in user or application can turn off, delete, or modify tenant backups. | A compromised administrator cannot erase this recovery layer through ordinary tenant access. |
| Data location | Backup data remains in the same geographic location as the Entra tenant. | The service follows the tenant’s established geo rather than creating a customer-selected secondary region. |
| Access | Microsoft Entra Backup Reader can review backups and difference reports; Microsoft Entra Backup Administrator can perform recovery. Global Administrator includes the administrator permissions. | Use the dedicated roles and just-in-time elevation instead of making routine reviewers permanent Global Administrators. |
What the service currently protects
Microsoft documents support for these Entra object families:
- Users
- Groups
- Applications
- Service principals
- Conditional Access policies
- Named locations
- Authentication method policy
- Selected authorization policy properties
The service can also support Agent ID because those identities are represented through user and service-principal object types. The important qualifier is supported properties and relationships. An object type appearing on the list does not mean every field, linked object, secret, assignment, or platform-specific setting is protected.
What recovery can do
An administrator can inspect retained backups, create a difference report, recover all supported objects, limit recovery to selected object types, or enter specific object IDs. Microsoft currently allows up to 100 object IDs in a targeted recovery request.
| Recovery scope | Best use | Main caution |
|---|---|---|
| Specific object IDs | A small, confirmed set of damaged users, groups, applications, policies, or related objects. | Dependencies and linked objects may require separate review. |
| Selected object types | A broader incident isolated to one class, such as Conditional Access policies. | Unrelated legitimate changes inside the same type may also differ from the backup. |
| All supported objects | A major, well-understood tenant-wide compromise or destructive change. | This has the largest blast radius and requires the strongest review, communications, and validation plan. |
Only one recovery or difference-report job can run at a time. Recovery actions are written to audit logs, and recovery history is retained for seven days after completion.
Run a difference report before recovery
A difference report compares current tenant state with a selected retained backup. It lets the team examine changed attributes and links before applying recovery.
Microsoft explicitly warns that a recovery applies changes directly to the tenant and cannot be undone automatically. Canceling a running recovery does not roll back changes already completed. That makes the difference report a change-control artifact, not an optional convenience.
For a material recovery, document:
- The incident and the time the unwanted change likely began
- The selected backup and why it represents a known-good state
- The object IDs or types included and excluded
- Expected downstream effects on sign-in, applications, groups, and automation
- The approver, recovery administrator, observer, and communications owner
- Validation checks and the manual correction plan if recovery is incomplete
The limitations that belong in every runbook
Hard-deleted objects cannot be recovered
Backup and Recovery does not recreate or restore hard-deleted objects. Supported soft-deleted users, Microsoft 365 Groups, cloud security groups, application registrations, and service principals have a separate 30-day soft-delete recovery window. Use protected actions and strong privileged-access controls to reduce the chance that an attacker or administrator completes an irreversible hard deletion.
On-premises authority stays on premises
Users and groups synchronized from Active Directory Domain Services cannot be recovered through Entra Backup and Recovery while the on-premises directory remains the source of authority. Recover them in AD DS and allow synchronization to restore cloud state. Microsoft notes that some objects, such as groups, can be converted so authority moves to the cloud; only then does the cloud recovery model fully apply to those converted objects.
Property coverage is partial
Read-only properties, system-generated values, and settings that depend on specialized business logic may not be recoverable. Microsoft’s application guidance calls out examples that may need separate validation or manual reconstruction, such as redirect URIs, supported account types, assigned permissions or roles, exposed APIs, policy attachments, managed-identity relationships, and Application Proxy configuration.
Not every relationship is restored
Microsoft currently documents recovery for static group membership links, but not group owner links, user-manager relationships, or sponsor links. Dynamic membership also depends on the governing rule and supported properties rather than a simple membership snapshot.
Seven days is a short investigation window
If an identity change remains unnoticed for more than a week, the built-in backup may no longer contain a pre-incident state. Alerting on sensitive directory changes, retaining audit data appropriately, and assigning investigation ownership are what make the backup usable in time.
A resilient Entra recovery design
| Layer | Purpose | Minimum practice |
|---|---|---|
| Prevention | Reduce destructive or unauthorized changes. | Least privilege, PIM, protected actions, Conditional Access, separate admin accounts, and phishing-resistant authentication. |
| Detection | Find damaging changes inside the retention window. | Alerts for policy, role, application, credential, federation, and high-impact group changes. |
| Built-in recovery | Return supported cloud objects and properties to a known-good state. | Assigned Backup Reader and Backup Administrator roles, tested access, difference-report procedure, and approval flow. |
| Configuration evidence | Rebuild unsupported settings and prove intended state. | Version-controlled exports or infrastructure definitions for critical Conditional Access, applications, roles, domains, and hybrid configuration. |
| Hybrid recovery | Restore authoritative on-premises identity. | AD DS system-state and forest-recovery planning, tested synchronization recovery, and ownership across cloud and directory teams. |
| Emergency access | Preserve administrative access during identity or policy failure. | Protected cloud-only emergency accounts, monitoring, tested credentials, and a documented activation process. |
What to do this month
- Confirm eligibility. Verify the tenant is a supported workforce tenant and has Entra ID P1 or P2 licensing.
- Assign dedicated roles. Give routine review to Backup Readers and recovery authority to tightly controlled Backup Administrators, preferably through PIM.
- Inspect the backup inventory. Confirm backups appear and understand the daily timing and available history.
- Generate a difference report. Practice the read-only comparison workflow before an incident creates time pressure.
- Map unsupported state. Identify critical application, relationship, hybrid, secret, and policy details that need exports or another recovery method.
- Update incident runbooks. Add decision criteria for soft delete, targeted backup recovery, object-type recovery, tenant-wide recovery, and manual reconstruction.
- Run a tabletop. Simulate a compromised administrator changing Conditional Access, an enterprise application, and a critical group. Time detection, approval, recovery, and validation.
Frequently Asked Questions
Is Microsoft Entra Backup and Recovery generally available? Yes. Microsoft announced general availability on June 30, 2026 for eligible workforce tenants with Entra ID P1 or P2.
How long are backups retained? Microsoft documents automatic daily backups with up to seven days of history.
Can administrators delete the backups? No signed-in user or application, including highly privileged administrators, can disable, delete, or modify them.
Can it restore a hard-deleted user or application? No. Hard-deleted objects cannot be recreated through this service. Use prevention and the applicable soft-delete window before permanent deletion.
Can it restore synchronized users and groups? Not while AD DS remains authoritative. Those objects must be recovered in the on-premises directory.
Should we still export Entra configuration? Yes. Exports and configuration-as-code can preserve unsupported properties, relationships, and intended design beyond the seven-day window.
Make Entra recovery usable before an incident
Accred Consulting can assess object coverage, privileged roles, Conditional Access resilience, hybrid dependencies, emergency access, configuration evidence, and recovery testing across your Microsoft identity environment.
Build an Entra Recovery Runbook