In short
Entra ID backup protects the identity configuration Microsoft 365 depends on: users, groups, Conditional Access policies, app registrations and role assignments. Microsoft offers 30-day soft delete for some objects and Microsoft Entra Backup and Recovery, which keeps seven days of daily backups and cannot re-create hard-deleted objects. Third-party Entra ID backup adds longer history and a separate copy.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Why identity configuration needs recovery
Microsoft Entra ID, formerly Azure Active Directory (which is why people still search for Azure AD backup), holds the identities and rules that control access to Microsoft 365. It is easy to damage and slow to rebuild by hand:
- Conditional Access policies: a deleted or edited policy can remove MFA requirements or lock everyone out
- Groups and memberships: a sync error or script can strip memberships that grant access to teams, sites and apps
- App registrations and service principals: deleting one can break an integration that the business depends on
- Role assignments: changes made by an attacker with admin access need to be found and reversed
- User attributes: bulk edits can overwrite departments, managers or licence-driving attributes across thousands of users
None of this is mail or files, so a Microsoft 365 data backup does not cover it unless the platform includes Entra ID specifically.
Microsoft's native options for Entra ID
| Option | What it covers | Limit |
|---|---|---|
| Soft delete (deleted items) | Users, Microsoft 365 groups, cloud security groups, application registrations and service principals | Restorable for 30 days; edits to objects that were not deleted are not covered |
| Microsoft Entra Backup and Recovery | Supported properties of users, groups, applications, service principals, Conditional Access policies, named locations, the authentication methods policy and selected authorisation policy settings | Daily backups, up to seven days of history; does not recover or re-create hard-deleted objects; needs Entra ID P1 or P2 |
| Audit and sign-in logs | Show who changed what | A record of changes, not a way to reverse them |
Microsoft Entra Backup and Recovery is a real step forward: automatic, impossible for admins to switch off or tamper with, and able to show a difference report before you recover. Its limits are the reason third-party Entra ID backup still has a place.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Where the native options stop
- Seven days of history: a change discovered after a week cannot be rolled back with Microsoft Entra Backup and Recovery
- Hard-deleted objects: once an object is permanently deleted, Microsoft's tool cannot re-create it
- Supported properties only: Microsoft says recovery covers the listed properties and does not imply full object rollback; manager changes, group ownership and dynamic group rules are out of scope
- On-premises objects: changes to objects synchronised from Active Directory Domain Services appear in difference reports but are excluded from recovery (except group memberships)
- Same tenant: the backups sit in your tenant's geography, managed through the same Entra admin center an attacker may already be using
Entra ID backup options we supply
| Platform | What it protects | How it is sold |
|---|---|---|
| NinjaOne SaaS Backup for Microsoft 365 (+ Entra bundle) | Users, Microsoft 365 groups, roles and admins, Conditional Access policies, app registrations, devices and BitLocker keys, with automated point-in-time backups | Per user, in the + Entra or + Archiver + Entra bundles, alongside Microsoft 365 data backup: see Dropsuite Entra ID backup |
| Redstor backup for Microsoft 365 (Restore and Comply bundles) | Entra ID users, groups, roles and policies, backed up automatically to immutable storage, per Redstor | Restore Bundle (Microsoft 365 backup plus Entra ID backup) or Comply Bundle (adds email archiving) |
| Acronis Backup for Microsoft 365 | Supported Entra ID data, including users, groups, Conditional Access policies and configuration | Part of Acronis Microsoft 365 backup on Acronis Cyber Platform |
| Commvault Cloud Backup & Recovery for Active Directory | Entra ID users, groups, licences, Conditional Access and role assignments, plus on-premises Active Directory; comparison reports between two points in time | A separate Commvault product, per enabled user, in Standard or Enterprise editions |
The right choice usually follows your data backup. If you already use, or are choosing, NinjaOne SaaS Backup or Redstor for Microsoft 365, their bundles add Entra ID in the same console. If you run on-premises Active Directory as well, Commvault covers both directories under one licence per enabled user.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Hybrid identity and on-premises Active Directory
Many organisations still synchronise users and groups from on-premises Active Directory. Microsoft says objects managed in Active Directory Domain Services need another solution for backup and recovery, because changes to them are excluded from Microsoft Entra Backup and Recovery. For those objects, either back up Active Directory itself or move their source of authority to the cloud, which Microsoft supports for some object types such as groups.
Commvault's Active Directory product protects both sides: on-premises Active Directory objects, Group Policy and forest recovery planning, and Entra ID. It is worth considering if a lost domain would stop the business.
How to back up Entra ID
- Check your licences: Microsoft Entra Backup and Recovery needs Entra ID P1 or P2; see Microsoft Entra ID P1 vs P2
- Use what Microsoft gives you: assign the Microsoft Entra Backup Reader and Backup Administrator roles to the right people and practise a difference report
- Decide how far back you need to go: if seven days is not enough, or you need a copy outside the tenant, add a third-party Entra ID backup
- Match it to your data backup: choose a bundle or product that sits alongside the platform protecting your mail and files
- Limit who can restore: restores write into the live directory, so agree who may run them and protect those accounts with strong MFA
- Test a recovery: change a test group or policy, then recover it, so the process is known before an incident
How we help
We review what your directory holds and how it is managed, including any on-premises Active Directory, check whether your licences already give you Microsoft Entra Backup and Recovery, and recommend whether a third-party Entra ID backup is worth adding. If it is, we can set it up alongside your Microsoft 365 data backup and run a test recovery with you. Licences sit on one Forever Systems account, with terms confirmed at quote; Microsoft licences themselves are handled by Forever Group's Microsoft licensing team.
Contact us to talk about protecting Entra ID.
Explore Entra ID
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Does Microsoft back up Entra ID?
Microsoft Entra Backup and Recovery automatically takes daily backups of supported objects and keeps up to seven days of history, in tenants with Entra ID P1 or P2. It does not re-create hard-deleted objects and covers supported properties only, so many organisations add a third-party backup for a longer history and a separate copy.
How long are deleted Entra ID users kept?
Soft-deleted users, Microsoft 365 groups, cloud security groups, app registrations and service principals can be restored for 30 days. After that they are permanently deleted.
Is Azure AD backup the same as Entra ID backup?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID, so Azure AD backup and Entra ID backup describe the same thing.
Do I still need Entra ID backup if I have Microsoft Entra Backup and Recovery?
It depends on how far back you need to go and whether you want a copy outside the tenant. Microsoft's feature covers seven days and supported properties; third-party options keep a longer history and are managed separately from your directory.
Which of your platforms include Entra ID backup?
NinjaOne SaaS Backup in its + Entra bundles, Redstor in its Restore and Comply bundles, Acronis for supported Entra ID data, and Commvault through its separate Active Directory product, which also covers on-premises Active Directory.
Still have a question about Entra ID backup?
Ask us and a member of our team will reply by email.