Microsoft Entra Backup and Recovery and How to Use It

Microsoft Entra Backup and Recovery is a new admin feature for recovering supported Microsoft Entra ID objects back to a previously known good state. That means if someone accidentally changes a Conditional Access policy, deletes an application registration, modifies a group, or breaks part of your identity setup, you may now have a Microsoft managed recovery option inside the Microsoft Entra admin centre.

This is not a replacement for good change control. It is not an excuse to click around in production and hope for the best. But it is a very welcome safety net for Microsoft Entra ID.

Never miss an article and subscribe, and don’t forget to check out my YouTube channel, Control Alt Delete Tech Bits

What is Microsoft Entra Backup and Recovery?

Microsoft Entra Backup and Recovery is built into Microsoft Entra. It automatically creates backups of supported tenant objects once per day and keeps backup history for up to seven days. These backups cannot be turned off, deleted, or changed by an administrator, even by someone with high privileges. Microsoft says the backup data is stored in the same geo location as the Microsoft Entra tenant.

The main idea is simple.

You can view available backups, compare a backup against the current state of your tenant, and then recover supported objects if needed. Microsoft calls the comparison a difference report. This is the bit I would use first before doing any recovery, because it lets you see what changed before pressing the scary button.

What can it recover?

Microsoft currently lists support for users, groups, applications, service principals, Conditional Access policies, named locations, authentication method policy, authorisation policy and organisation settings. Microsoft also says supported objects and properties will expand over time, so this is one to keep checking.

A few examples that caught my eye:

Conditional Access policies are in scope.

Named location policies are in scope.

Some authentication method policies are in scope, including FIDO2 passkeys, Authenticator app, SMS, voice call, Temporary Access Pass and certificate based authentication.

Applications and service principals are also supported, which is useful if someone changes app permissions or breaks an enterprise application setup. Microsoft notes that service principal recovery can also restore related OAuth2 permission grants and app role assignments where supported.

This site and my YouTube channel are supported by Tech-Source.

Tech-Source is a UK-based technology supplier that works closely with IT teams across education, public sector, and commercial environments. They provide hardware, licensing, and infrastructure solutions, with a strong focus on practical advice rather than upselling.

Their support helps keep this site running and allows me to continue publishing in-depth, admin-focused content and walkthroughs without paywalls.

You can find out more about what they do at https://tech-source.co.uk/

What do you need before using it?

You need a workforce tenant. Microsoft says External ID and Azure AD B2C tenants are not supported. You also need Microsoft Entra ID P1 or P2 licences.

There are two specific roles to know about.

Microsoft Entra Backup Reader can view backups, view comparisons and review recovery history.

Microsoft Entra Backup Administrator can do the above, create difference reports and start recovery jobs. Global Administrator includes the Microsoft Entra Backup Administrator permissions.

For day to day admin, I would avoid using Global Administrator for this unless you have to. Assign the least privileged role needed, ideally through Privileged Identity Management if you have it.

How to view your Microsoft Entra backups

Sign in to the Microsoft Entra admin centre.

Go to Backup and recovery.

Open Backups.

You should see the available backups for your tenant. Each backup shows a timestamp and backup ID. Microsoft says one backup is created per day and each backup is retained for up to seven days.

At this point, do not rush into recovery. The safer route is to create a difference report first.

How to create a difference report

A difference report compares your current tenant state with a selected backup. It shows objects that have been created, modified, soft deleted or restored since that backup was taken. It can also show changed attributes and changed links, such as group membership changes.

To create one:

1. Go to Backup and recovery > Backups.
2. Select the backup you want to compare against.
3. Select Create difference report.
4. Choose the scope.

You can include all supported objects, choose certain object types, or specify object IDs. Microsoft says you can enter up to 100 object IDs across supported object types.

This is useful because you might not want to recover everything. If the problem is a Conditional Access policy change, scope the report to Conditional Access policies. If the issue is a broken app registration, scope it to the application or service principal.

Once the report is complete, review it carefully. A difference report does not update automatically. If more changes happen after the report was created, create a fresh report before recovery.

How to recover from a difference report

Once you have reviewed a completed difference report, you can recover from it.

Go to Backup and recovery > Difference reports.

Open the completed report.

Review the changed objects and attributes.

Select Recover.

Microsoft also allows recovery of a single high priority object from the changed attributes panel, which is useful if you only need to fix one object rather than starting a wider recovery.

This is the workflow I would recommend in most cases:

1. Identify what broke.
2. Pick the most relevant backup.
3. Create a scoped difference report.
4. Review the changes.
5. Recover only what you need.

That is much safer than recovering everything and hoping you do not undo other legitimate work.

How to recover directly from a backup

You can recover directly from a backup without creating a difference report, but I would treat that as the emergency route.

Microsoft says you can go to Backup and recovery > Backups, select a backup, choose Recover backup, and then scope the recovery. You can recover all supported objects, recover selected object types, or recover specific objects by object ID.

Before using this in production, stop and ask:

Do I know exactly what changed?

Have I checked the difference report?

Could this undo valid changes made after the backup?

Do I have approval to recover this object?

Microsoft warns that recovery actions apply directly to the tenant and cannot be automatically undone. The recovery job records changes in audit logs.

Key limitations to know

There are a few big limitations.

First, this is not a full tenant rollback. Microsoft says recovery only applies to supported properties. Not every property on every object is covered.

Second, hard deleted objects cannot be recovered or recreated using Microsoft Entra Backup and Recovery. Soft deleted users, Microsoft 365 Groups, cloud security groups, application registrations and service principals can be restored for 30 days, but hard deleted objects are out of scope.

Third, hybrid identity needs care. Microsoft says changes to on premises synced objects can appear in difference reports, but those objects are automatically excluded from recovery, except for certain group membership scenarios. If the object is mastered in Active Directory Domain Services, recover it there.

Fourth, only one recovery or difference report job can run at a time. If another job is already running, you need to wait or cancel it

You might also like this article