Why identity backup is your most dangerous blind spot
You back up your SharePoint files, your virtual machines, your databases. But do you have a recovery strategy for your identity fabric? For years, the honest answer was: no. Not for lack of rigor, but because the native mechanisms simply didn't exist.
When a poorly designed automation script deleted a conditional group controlling access to a critical application, or when a Conditional Access policy disappeared due to a mishandling, recovery invariably involved manual reconstruction — hoping that internal documentation was up to date. This scenario is now a thing of the past.
Microsoft Entra Backup and Recovery has reached general availability (GA). It is a native feature, integrated directly into the Entra portal, that takes daily snapshots of essential directory objects and allows their restoration without third-party tools. This article covers the exact scope of the feature, its non-negotiable limitations, the new associated RBAC role, scenarios where ISV solutions remain relevant, and how to automate via Microsoft Graph.
Distinct Scope
Microsoft Entra Backup and Recovery protects identity configuration (users, groups, policies). It does not replace Microsoft 365 Backup, which covers application data (Exchange, SharePoint, OneDrive). These are two tools for two different problems.
What Entra Backup and Recovery covers
The feature captures the following directory objects daily in your tenant:
- Users (attributes, group memberships)
- Groups (security, Microsoft 365, dynamic membership)
- Applications (application registrations)
- Service principals (service principals)
- Conditional Access policies
- Authentication methods
- Named locations
Restoration takes place directly from the Microsoft Entra administration center (entra.microsoft.com), without prior export or external tools. Backup storage is managed by Microsoft — you do not have direct access to snapshot files.
The limitations that the official announcement downplays
Before considering this feature as your only safety net, be aware of the following restrictions. They are decisive for your BCDR strategy.
Critical Limitations to Integrate into Your RTO/RPO
- Retention: 7 days only. A deletion not detected before day 8 cannot be recovered natively.
- Hard-deleted objects: not recoverable. Only soft-deleted objects in the Entra trash are eligible before expiration.
- Intune: out of scope. Intune policy configurations (compliance, configuration, AppProtection) are not covered.
- No export. It is not possible to extract snapshots to external storage (Azure Blob, etc.) natively.
- Slow-burn compromise: not covered. If an attacker gradually modifies objects over several weeks, the 7-day window is not sufficient.
| Object | Covered by Entra B&R | Retention | Remark |
|---|---|---|---|
| Users | Yes | 7 days | Soft-delete only |
| Groups | Yes | 7 days | Including M365 groups |
| Conditional Access | Yes | 7 days | Complete policies |
| Applications / SP | Yes | 7 days | Registrations and service principals |
| Authentication methods | Yes | 7 days | |
| Named locations | Yes | 7 days | |
| Intune configurations | No | N/A | Out of scope |
| SharePoint/Exchange data | No | N/A | Covered by Microsoft 365 Backup |
The new RBAC role: Backup Reader
Microsoft Entra Backup and Recovery introduces a dedicated role respecting the principle of least privilege: Entra Backup Reader. This role allows you to view snapshots and trigger restores without having global admin or identity admin rights.
Recommended minimum permissions to operate Entra B&R:
Entra Backup Reader: snapshot reading, triggering restoresGlobal AdministratororPrivileged Role Administrator: initial feature activation
To assign the role via Microsoft Graph PowerShell (module Microsoft.Graph.Identity.DirectoryManagement, v2.x recommended):
1# Prerequisites: Microsoft.Graph v2+ module2# Connect with required scopes3Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"4 5# Retrieve the ID of the Entra Backup Reader role6$role = Get-MgDirectoryRoleTemplate | Where-Object { $_.DisplayName -eq "Entra Backup Reader" }7 8# Activate the role in the tenant if not already active9$activeRole = New-MgDirectoryRole -RoleTemplateId $role.Id10 11# Assign the role to a user12$userId = (Get-MgUser -Filter "userPrincipalName eq 'admin-backup@contoso.com'").Id13 14New-MgDirectoryRoleMember -DirectoryRoleId $activeRole.Id -BodyParameter @{15 "@odata.id" = "https://graph.microsoft.com/v1.0/users/$userId"16}17 18Write-Output "Entra Backup Reader role successfully assigned to $userId"Verify available snapshots via Microsoft Graph
The Microsoft Graph API exposes backup management endpoints. Here's how to query available snapshots for your tenant from PowerShell:
1# Authentication with required scopes for Entra Backup2Connect-MgGraph -Scopes "BackupRestore.Read.All"3 4# List available identity configuration snapshots5$snapshots = Invoke-MgGraphRequest -Method GET \6 -Uri "https://graph.microsoft.com/v1.0/solutions/backupRestore/oneDriveForBusinessRestoreSessions" \7 -OutputType PSObject8 9$snapshots.value | Select-Object id, status, createdDateTime, expirationDateTimeReference Documentation
The complete REST API is documented on Microsoft Learn — Backup and Restore API. Endpoints specific to Entra identity configuration are being enriched as GA evolves.
Trigger a restore from the Entra portal
Access the Entra administration center
Open entra.microsoft.com and sign in with an account that has the Entra Backup Reader or Global Administrator role.
Navigate to Backup and Recovery
In the left menu, go to Protection > Backup and Recovery. If the section is not visible, verify that the feature is enabled at the tenant level (the Enable button at the top of the page).
Select object type and snapshot
Choose the category of object to restore (e.g., Conditional Access policies), then select the dated snapshot corresponding to the last known good state. Retention shown does not exceed 7 days.
Identify and select objects to restore
The list of objects present in the snapshot is displayed. Check those to restore. You can compare the snapshot state with the current tenant state before validating.
Trigger and verify the restore
Click Restore. A restore job is created. Check its status in the Restore jobs tab. Once complete, validate in PowerShell:
1# Verify that a restored Conditional Access policy is present2Connect-MgGraph -Scopes "Policy.Read.All"3 4Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State, CreatedDateTime | Sort-Object CreatedDateTime -DescendingTenant-Wide Impact Operation
A restore of Conditional Access policies can immediately modify access conditions for all users in the tenant. Always test in a pre-production environment or with test accounts before any production restore. Have an Emergency Access account (break-glass) excluded from all CA policies before you begin.
When ISV solutions remain essential
Microsoft Entra Backup and Recovery addresses most incidents of accidental deletion of common objects. But your threat model must remain realistic about its blind spots:
- Long-term retention (compliance, audit): retention beyond 7 days requires an ISV solution or custom export via Graph.
- Progressive compromise: an attacker who subtly modifies attributes over 30 days makes the 7-day retention inoperative.
- Intune configurations: no native equivalent — solutions like Backup for Intune from Simeon Cloud or Identiverse-compatible exports remain relevant.
- Export and portability: if your security policy requires storing backups outside Microsoft cloud (air-gap, sovereign storage), a third-party solution is mandatory.
- Attribute granularity: certain extended attributes or custom schemas may not be covered by native snapshots.
Troubleshooting common errors
1# Error: "Insufficient privileges to complete the operation"2# Cause: the account does not have the BackupRestore.Read.All scope or Entra Backup Reader role3# Resolution: verify assigned roles4Get-MgUserMemberOf -UserId (Get-MgContext).Account | Select-Object -ExpandProperty AdditionalProperties5 6# Error: "Snapshot not found" or empty list7# Cause: the feature has not yet generated a snapshot (first activation < 24h)8# Resolution: wait for the first daily cycle (up to 24h after activation)9 10# Check Backup and Recovery activation status11Invoke-MgGraphRequest -Method GET \12 -Uri "https://graph.microsoft.com/v1.0/solutions/backupRestore" \13 -OutputType PSObject | Select-Object status14# Expected value: "active"Regular Testing Mandatory
An untested backup is a hypothesis, not a guarantee. Plan quarterly restore exercises on a dedicated development tenant. Document your identity RTO (Recovery Time Objective): how long can you tolerate without an operational Conditional Access policy if the main one disappears tonight?
