In short
Microsoft Entra Backup and Recovery is a built-in Entra ID feature that automatically backs up supported directory objects once a day and keeps up to seven days of history. Administrators compare a backup with the current tenant in a difference report, then recover everything, chosen object types or specific objects. It needs Entra ID P1 or P2 licences.
Get a quote for Entra ID backup
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Microsoft Entra Backup and Recovery is
Microsoft describes Microsoft Entra Backup and Recovery as a built-in way to return critical directory objects to a previously known good state after accidental changes or security compromises. It is found in the Microsoft Entra admin center under Backup and recovery, with four pages: Overview, Backups (the last seven days), Difference Reports and Recovery History.
Three design choices stand out in Microsoft's documentation:
- Automatic: backups are taken once a day without any setup, and up to seven days of history are kept
- Tamper-resistant: Microsoft says no signed-in user or application, even with the highest admin privileges, can turn off, delete or modify the backups
- In your tenant's geography: backup data is stored in the same geo-location as the Entra tenant, set when the tenant was created
Microsoft also says it regularly expands the feature to cover more objects and attributes, so check the current list before relying on it for a specific setting.
What it backs up
| Object type | What can be recovered |
|---|---|
| Users | Supported properties such as display name, user principal name, job title, department, account enabled, usage location and per-user MFA state; manager and sponsor changes are not in scope |
| Groups | Supported properties such as name, description, group type and mail settings; group ownership changes and dynamic group rule changes are not in scope |
| Conditional Access policies | All properties |
| Named locations | All properties |
| Authentication methods policy | Email one-time passcode, FIDO2 passkey, Authenticator app, voice call, SMS, third-party software OATH, Temporary Access Pass and certificate-based authentication |
| Authorisation policy | Selected settings: blocking MSOnline PowerShell and the guest user access level |
| Applications | Selected properties of app registrations, such as name, sign-in audience, required API permissions and optional claims |
| Service principals | Selected properties, plus the admin-consented delegated permission grants and app role assignments that point to them; grants from individual user consent are not supported |
| Organisation | Tenant-level per-user MFA settings |
Microsoft notes that recovery applies only to the supported properties it lists and "doesn't imply full object rollback". Microsoft Entra Agent ID objects are covered through the user, application and service principal objects they are built on.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How recovery works
- Open Backup and recovery in the Microsoft Entra admin center and choose a backup from the last seven days
- Create a difference report comparing that backup with the current state of the tenant
- Review the changes: changed attributes and links are listed, so you can see exactly what happened
- Recover: all supported objects, selected object types, or specific object IDs
- Check Recovery History to follow the job and confirm it completed
Microsoft recommends running a difference report before every recovery, so you recover to the right backup. It also explains that the first time a backup is opened, its data takes a fixed time to load, even for small tenants, and the rest of the job depends on how many changes are being reversed. Creating the difference report first preloads the data and can shorten the recovery itself.
Prerequisites and roles
| Requirement | Detail |
|---|---|
| Tenant type | A workforce tenant; External ID and Azure AD B2C tenants are not supported |
| Licences | Microsoft Entra ID P1 or P2 in the tenant |
| Microsoft Entra Backup Reader | View backups, difference reports and recovery history |
| Microsoft Entra Backup Administrator | Everything the Reader can do, plus create difference reports and start recovery; these permissions are included in Global Administrator |
If you are not sure which Entra ID plan you have, Microsoft Entra ID P1 vs P2 explains the difference, and Forever Group's Microsoft licensing team can check your subscriptions. Assign the Backup roles deliberately: the Administrator role can change the live directory.
Is Entra ID backup the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Limits to understand
- Seven days: anything discovered after a week falls outside the backup history
- No hard-deleted objects: Microsoft says the feature does not recover or re-create permanently deleted objects; soft-deleted users, Microsoft 365 groups, cloud security groups, app registrations and service principals can still be restored from deleted items for 30 days
- Supported properties only: unsupported attributes, manager and ownership changes and dynamic group rules are not rolled back
- On-premises synchronised objects: changes to objects synchronised from Active Directory Domain Services show in difference reports but are excluded from recovery, except group memberships; Microsoft says to use another solution for those objects
- Same tenant: the backups cannot be deleted, but they live in the tenant and are recovered through the same admin center, rather than in a separate copy managed elsewhere
Microsoft itself positions the feature as one part of a wider approach to recoverability, alongside preventative security, documenting a known good state and rehearsed recovery processes.
When you need more than seven days
For many organisations, Microsoft Entra Backup and Recovery covers the most common accident: a policy or group changed by mistake and noticed within days. It is worth turning into a practised routine whatever else you do.
A third-party backup earns its place when you need a longer history, protection for objects or properties outside Microsoft's list, on-premises Active Directory, or a copy managed separately from the tenant. Entra ID backup compares the options we supply: NinjaOne SaaS Backup + Entra, Redstor's Restore and Comply bundles, Acronis and Commvault's Active Directory product.
How we help
We check whether your tenant meets the prerequisites, help you assign the Backup Reader and Backup Administrator roles to the right people, and walk through a difference report and test recovery with you. Then we look at whether seven days and Microsoft's supported objects are enough for your risks, and if not, recommend a third-party Entra ID backup that sits alongside your Microsoft 365 data backup.
Contact us to review how your Entra ID is protected.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
How long does Microsoft Entra Backup and Recovery keep backups?
Backups are taken automatically once a day and up to seven days of history are kept.
Can administrators delete Entra Backup and Recovery backups?
No. Microsoft says no signed-in user or application, even with the highest admin privileges, can turn off, delete or modify the backups.
Does Microsoft Entra Backup and Recovery restore hard-deleted users?
No. It does not recover or re-create hard-deleted objects. Soft-deleted users and some other objects can be restored from deleted items for 30 days.
What licence does Microsoft Entra Backup and Recovery need?
A workforce tenant with Microsoft Entra ID P1 or P2 licences, and administrators with the Microsoft Entra Backup Reader or Backup Administrator role (Global Administrator includes the Backup Administrator permissions).
Does it back up on-premises Active Directory?
No. Changes to objects synchronised from Active Directory Domain Services appear in difference reports but are excluded from recovery, except group memberships. Microsoft says to use another solution for objects managed on-premises.
Is it the same as Microsoft 365 Backup?
No. Microsoft 365 Backup is a separate pay-as-you-go service for OneDrive, SharePoint and Exchange data. Microsoft Entra Backup and Recovery covers Entra ID directory objects and needs Entra ID P1 or P2.
Still have a question about Entra ID backup?
Ask us and a member of our team will reply by email.
More Microsoft 365 backup guides
Microsoft 365 BackupMicrosoft's own backup for OneDrive, SharePoint and Exchange, explained.What to back upExchange Online, OneDrive, SharePoint, Teams and Entra ID: native safety nets and what a backup adds.Best practicesA practical checklist for Microsoft 365 backup, aligned with NCSC guidance.