Microsoft Entra ID serves as the central identity and access layer for many Microsoft 365 environments. User accounts, groups, applications, and conditional access policies determine who is allowed to access which services and corporate data.
Faulty automations, accidentally deleted objects, or compromised administrator accounts can therefore have far-reaching consequences. In the worst-case scenario, employees lose access to business-critical applications, or unintended changes affect large portions of the Microsoft 365 tenant.
Microsoft Entra Backup and Recovery has been generally available since June 30, 2026. This native feature automatically creates daily backups and enables the recovery of supported identity objects and security configurations.
With this, Microsoft is closing an important gap in the recoverability of Microsoft Entra ID. However, this feature does not provide a complete backup of the entire tenant or the associated Microsoft 365 data. For more technical details, see the official overview of Microsoft Entra Backup and Recovery.
Key Points at a Glance
Microsoft Entra Backup and Recovery:
- automatically creates a backup once a day,
- maintains up to seven daily backup points,
- protects the checkpoints from being modified by tenant administrators and applications,
- shows discrepancies via difference reports,
- restores supported changes, object types, or individual objects,
- does not back up Exchange, OneDrive, SharePoint, or Teams content,
- does not provide a complete tenant rollback.
The native function is therefore primarily a short-term safeguard for the identity and configuration layers.
What is Microsoft Entra Backup and Recovery?
Microsoft Entra Backup and Recovery is a solution for backing up and restoring supported directory objects that is directly integrated into Microsoft Entra.
A Microsoft Entra Workforce tenant with Microsoft Entra ID P1 or P2 is required. External ID and Azure AD B2C tenants are not currently supported.
Organizations do not need to create their own backup jobs, select a storage location, or install additional backup software. Microsoft automatically creates and manages the backup points within the geographic region designated for the tenant.
This reduces setup and operating costs. At the same time, companies cannot determine the backup schedule, retention period, or storage location on their own.
How the native Entra backup works
One automatic backup point per day
Microsoft creates a backup of supported Entra objects once a day. Up to seven daily backup points are available at any given time.
There is no provision for custom schedules or additional manual snapshots. As a result, companies cannot create a separate backup point immediately before implementing a major change.
In the worst-case scenario, the last available backup point is nearly 24 hours old. For organizations with a tighter recovery point objective—that is, a lower tolerable level of data or configuration loss—the native backup frequency may therefore be too infrequent.
Protected against administrative manipulation
The checkpoints are managed entirely by Microsoft. Even highly privileged administrators or applications with extensive Microsoft Graph permissions cannot disable, modify, or delete them within the tenant.
This is particularly relevant when a privileged account has been compromised and an attacker attempts to eliminate existing recovery options.
The fact that Microsoft manages the system entirely is also a limitation: The backup points cannot be exported to a separate storage location or archived long-term independently of the Microsoft service.
Difference Reports show changes
A difference report compares a selected backup point with the tenant's current state.
For example, the report shows:
- newly created objects,
- altered properties,
- changes in relationships and group memberships,
- temporarily deleted items,
- objects that have since been restored.
The analysis can be performed for all supported changes, specific object types, or up to 100 specific object IDs.
A difference report does not change the tenant. It serves as a preview and a basis for decision-making prior to a restore.
However, the report reflects only the status at the time it was created. If the tenant is modified again afterward, those changes will not appear in the existing report. Therefore, before performing a critical restore, an up-to-date difference report should be generated and reviewed by a technical expert.
Microsoft describes how this works in detail in the documentation on difference reports and restores.
Targeted Recovery
Administrators can initiate the restore for three different scopes:
- all supported changes,
- selected property types,
- individual objects based on their object ID.
For example, this allows you to selectively reset a conditional access policy that has been incorrectly modified without affecting all users or applications at the same time.
Changes to individual properties are displayed in the Difference Report. However, Microsoft does not offer the option to selectively restore only a specific property as a standalone recovery level. Recovery occurs at the object, object type, or entire scope level.
Recovery History, Roles, and Logging
Ongoing and completed recovery jobs are documented in the Recovery History. Among other things, the Recovery History displays the restore point used, the duration, the status, the affected objects, and any warnings and errors.
Recovery history entries and completed difference reports are retained for seven days after they are finalized. Therefore, additional log retention processes are necessary for long-term audit, compliance, or incident response documentation.
For more details, see the Microsoft documentation on recovery history.
To enable operation based on the least-privilege principle, Microsoft provides two specialized roles:
Microsoft Entra Backup Reader is authorized to view backup points, difference reports, and the restore history.
The Microsoft Entra Backup Administrator can also initiate difference reports and restore jobs, or cancel jobs that are currently running.
Automation is generally possible via Microsoft Graph. However, the associated Entra Backup interfaces are still in beta. Productive automation workflows should therefore be thoroughly tested and prepared for potential changes to the interfaces.
Which objects and configurations are supported?
Microsoft supports a defined, but not exhaustive, set of directory objects, properties, and relationships.
| Area | Examples of Supported Content | Important Boundary |
|---|---|---|
| User | Selected master data, account settings, password policies, and user-specific MFA status | Passwords, as well as manager and sponsor relationships, are not included in the documented scope of recovery |
| Groups | Microsoft 365 Groups, Cloud Security Groups, and Static Memberships | Group owners and rules for dynamic groups are only partially supported |
| Conditional Access | Conditional Access Policies and Named Locations | No substitute for emergency accounts and preventive exclusion rules |
| Applications and Identities | App registrations, service principals, selected assignments, and managed identities | Client secrets, certificates, and other login credentials are generally not included among the documented recoverable properties |
| Authentication | Selected authentication method policies, such as those for passkeys, Microsoft Authenticator, SMS, temporary access passes, and certificate-based authentication | Support for these guidelines does not mean that all individual users' authentication credentials will be restored |
| Other Areas | Selected Authorization Policies, tenant-wide settings for user-based MFA, and Entra Agent ID | Coverage varies depending on the object and its properties |
Entra Agent ID is supported, provided that the underlying user and service principal objects, as well as their documented properties, are covered.
Support for an object type does not, therefore, automatically mean that all settings, login credentials, relationships, and dependencies will be restored.
However, supported authentication method policies should not be equated with the individual authentication credentials of specific users. Before implementation, organizations should therefore review Microsoft’s current list of supported objects and recoverable properties.
Protect passwords and application keys separately
Passwords are not included among the documented recoverable user properties.
Client secrets, certificates, and other application credentials should not be secured solely by Entra Backup and Recovery. Organizations need a separate secrets management system, defined rotation processes, and, if necessary, a service such as Azure Key Vault.
Furthermore, following a security incident, recovered identity and application configurations should not automatically be considered trustworthy. Critical credentials must be verified, rotated, or reissued.
Of particular relevance: Conditional Access
Conditional access policies control the conditions under which users are allowed to access applications and data. However, an incorrectly configured policy can also lock out legitimate users or administrators.
Microsoft Entra Backup and Recovery can roll back supported Conditional Access policies to a previous backup state. This makes Conditional Access one of the most important practical use cases.
However, this safeguard is no substitute for preventive measures. Companies still need:
- protected "break-glass" or emergency accounts,
- documented emergency procedures,
- controlled exclusion rules,
- structured change management,
- Regular reviews of critical policies.
How does a restore work?
During a recovery, Microsoft does not create a complete copy of a previous tenant. Instead, the service compares the selected restore point with the current state and performs the appropriate actions.
| Changes since the checkpoint | Action During Recovery |
|---|---|
| An existing object was modified | Supported properties and relationships are reset |
| An object was created after the backup | The object will be temporarily deleted |
| An object was temporarily deleted after being backed up | The object is being restored |
| An object that had previously been deleted has since been restored | The object will be temporarily deleted again |
Recovery is performed as an in-place recovery, meaning directly within the existing production tenant.
There is no automatic undo function. If a running job is canceled, any changes that have already been made will remain in effect. Therefore, before performing extensive restores, an up-to-date difference report, technical approval, and a documented recovery runbook are required.
Typical Use Cases
Microsoft Entra Backup and Recovery is particularly well-suited for incidents detected at short notice:
- A PowerShell or Microsoft Graph script modifies numerous users, groups, or applications.
- A conditional access policy unexpectedly blocks employees or administrators.
- A group, app registration, or service principal is accidentally deleted on a temporary basis.
- A compromised administrator account changes security policies or permissions.
- Group memberships or selected application assignments are adjusted unintentionally.
The greatest benefit is achieved when an incident is detected quickly and a suitable checkpoint is available within the seven-day window.
What are the limitations of the Microsoft solution?
Microsoft Entra Backup and Recovery provides valuable native basic protection. However, to develop a comprehensive recovery strategy, organizations must take several limitations into account.
Short recovery window: Microsoft retains up to seven daily backup points. Errors that are not detected until several weeks or months later cannot be corrected using an older native backup.
No snapshot before critical changes: Only one automatic backup point is created per day. There is no provision for an additional manual snapshot immediately before a major change.
No complete tenant rollback: This feature backs up only documented objects, properties, and relationships. It does not create a complete snapshot of all Microsoft 365 and Entra services.
Permanently Deleted Objects Cannot Be Restored: Permanently deleted objects cannot be restored using their original object ID. Manually recreating the object generates a new ID. Previous relationships, memberships, or permissions may need to be reestablished.
No exportable backups: The native backup points cannot be transferred to a separate storage location or archived long-term outside the Microsoft service.
No Microsoft 365 user data: Exchange mailboxes, OneDrive files, SharePoint sites, and Teams content are not covered by Entra Identity Protection. A separate Microsoft 365 backup and recovery strategy is required for this data.
Limitations of hybrid identities: If users or groups are synchronized from a local Active Directory, restoration must always take place in the local source environment as long as it is the primary data source.
Limited Concurrency: Only one difference report or one restore job can be run at a time per tenant. In large environments, difference reports can run for several hours. The restore time also increases with the number and type of changes.
Acronis Cyber Protect Cloud as an Additional Layer of Protection
With version 26.06, Acronis Cyber Protect Cloud has also gained its own protection for Microsoft Entra ID.
Acronis documents four features relevant to the comparison. While Microsoft can also compare a backup state to the current tenant status using difference reports, Acronis supplements this approach with additional options:
- Comparison of a backup with the current live data
- Comparison of Two Historical Backup Sets
- Restoration of supported Entra data down to the property level
- Download of backed-up objects, as well as audit and sign-in logs
Comparison with live data is therefore not a feature exclusive to Acronis. The main additional differences lie, in particular, in the comparison of two historical backup states, the documented restoration of individual supported features, and the download options.
Acronis describes recovery at the organizational, object, record, and property levels. However, the term " organizational level " does not automatically mean that all tenant services, Microsoft 365 content, and dependencies will be fully restored.
The Entra data supported by Acronis and included in the backup will be restored. The exact scope should be verified using the current product documentation and, if possible, in a test tenant. The features described are documented in the Acronis Cyber Protect Cloud 26.06 Release Notes.
Acronis also does not view Entra ID as an isolated workload. Depending on licensing and service configuration, the same platform can also protect Microsoft 365 data, endpoints, servers, and virtual machines, as well as provide additional security, management, or disaster recovery capabilities.
For more information about the platform, visit the innobit Technologies page on Acronis.
Backup frequency and retention depend on the protection plan: The official Acronis documentation confirms Entra-ID protection but does not specify a universal standard retention period for every customer configuration.
Therefore, the specific schedules, storage targets, and retention options available must be determined based on the selected protection plan, licensing model, and scope of service.
One should not automatically assume that all Acronis backup features apply unchanged to Entra-ID backups.
A Comparison of Microsoft Entra Backup and Recovery and Acronis
| Criterion | Microsoft Entra Backup and Recovery | Acronis Cyber Protect Cloud |
|---|---|---|
| Basic Approach | Native Short-Term Protection for Entra ID | Comprehensive Backup and Cyber Protection Platform |
| Backup Frequency | One automatic backup point per day | Specific Entra options depend on the protection plan and service |
| Storage | Up to seven daily backup points | Depending on licensing, protection plan, and storage destination |
| Scope of Recovery | Supported changes, object types, or individual object IDs | Organization, Object, Record, and Property Levels |
| Comparison Options | Checkpoint with the current tenant status | Comparison with live data and between two backup states |
| Permanently Deleted Objects | Restoration is not possible using the previous object ID | No general conclusions can be drawn based on the available documentation; behavior must be evaluated on a case-by-case basis |
| Export and Download | Native checkpoints cannot be exported | Objects, as well as audit and sign-in logs, can be downloaded |
| Additional Workloads | No Microsoft 365 user data, servers, or devices | Depending on the Microsoft 365 plan, endpoints, servers, and virtual machines |
| Operating Model | Automatic, Microsoft-managed core feature | Configurable platform with feature set dependent on licensing |
Microsoft has a clear advantage with its automatically generated backup points, which are protected from tenant administrators.
Acronis supplements this approach in particular with historical backup comparisons, finer-grained, documented recovery granularity, download options, and the integration of additional workloads.
The two approaches do not, therefore, have to be mutually exclusive.
What kind of coverage does your business need?
The native Microsoft feature is particularly well-suited for changes detected on short notice and for organizations that need basic identity protection without the need for additional setup.
A supplementary solution becomes necessary when comparing historical states, restoring specific supported properties, downloading logs from the backup, or protecting additional Microsoft 365 and infrastructure workloads.
What matters is not the number of backup products used. What matters is whether the backup frequency, retention period, scope of data coverage, and recovery processes align with actual business requirements.
Frequently asked questions
Does Microsoft Entra ID back up data automatically? Yes. Microsoft Entra Backup and Recovery automatically creates a backup of supported Entra objects once a day.
How long are Microsoft Entra backups retained? Microsoft retains up to seven daily backup points. Older native backup points are not available.
Can deleted users be restored? Temporarily deleted users can generally be restored within 30 days. This is different from the retention period for Entra backup points, which is only seven days.
Microsoft Entra Backup and Recovery can reset supported properties and relationships from a backup point that is still available. Permanently deleted objects cannot be restored using their previous object ID.
Are conditional access policies backed up? Yes. Supported conditional access policies and named locations are included in the backup scope. However, emergency accounts, exclusion rules, and documented recovery processes are still required.
Is Microsoft Entra Backup a comprehensive Microsoft 365 backup? No. Exchange mailboxes, OneDrive files, SharePoint sites, and Teams content are not included in Entra Identity Backup.
Conclusion
Microsoft Entra Backup and Recovery is a major step forward for the resilience of Entra tenants.
Automatic backups, protected restore points, difference reports, and targeted recovery options make it easier to correct misconfigurations, deletions, and unwanted bulk changes that are detected promptly.
However, the native feature does not replace a comprehensive backup and recovery strategy. Companies still need documented runbooks, protected emergency accounts, clear responsibilities, regular recovery tests, and an additional backup of any Microsoft 365 data not covered by the native feature.
Securing Microsoft Entra and Microsoft 365 Appropriately
Whether one backup point per day, seven days of retention, and the supported object coverage are sufficient depends on your business, technical, and regulatory requirements.
With SmartProtection365, innobit helps companies further secure their Microsoft 365 data and establish a traceable recovery strategy.
Microsoft Entra ID protection can be added depending on the selected Acronis license and service scope. Therefore, it is not automatically included in every existing SmartProtection365 configuration.
Together, we'll review:
- which identities, configurations, and data are business-critical,
- what recovery objectives apply to your business,
- which additional workloads need to be protected,
- which licensing and storage options best suit your needs,
- how recovery procedures can be documented and tested on a regular basis.
Request a consultation on Microsoft Entra and Microsoft 365 Backup
