Recover confidently from misconfigurations, security compromises, and operational errors with Microsoft Entra Backup and Recovery.
Identity is the backbone of modern security. When identity systems fail, access breaks down, productivity stops, and security controls weaken across the organization. That is why Microsoft invests deeply in resilience across Microsoft Entra, designing the service not only to meet a 99.99% availability SLA, but also to continue supporting sign-ins even when parts of the cloud experience disruption.
This resilience is built into the foundation of the service. Microsoft Entra is hardened at the core, supported by a parallel backup authentication system, and reinforced through resilient SDKs and applications. Together, these layers help ensure that critical identity scenarios continue to function during service level incidents.
However, resilience is not only about keeping the service available. It is also about recovering when changes inside your tenant do not go as planned. Identity environments evolve constantly as policies are updated, integrations expand, and administrative responsibilities shift. Without a reliable way to understand, validate, and recover those changes, even routine updates can introduce significant risk.
A misaligned policy can block user or administrator access. A provisioning error can overwrite thousands of user attributes leading to increased support calls. A compromised privileged account can quietly modify critical group memberships in ways that are difficult to detect and even harder to reverse at scale. While service resilience keeps Microsoft Entra available, Microsoft Entra Backup and Recovery helps organizations recover when changes inside their environment introduce risk or disrupt users.
Microsoft Entra Backup and Recovery now available in Public Preview
Microsoft Entra Backup and Recovery helps you build identity resilience into daily operations using an always‑on, Microsoft‑managed solution that rapidly restores critical identity objects to a known‑good state. It provides automatic backups, point‑in‑time visibility into configuration changes, and backups are protected by a built‑in safeguard that prevents them from being disabled, deleted, or altered. This helps reduce recovery time and maintain business continuity.
For Public Preview, we are announcing new capabilities that help you recover with confidence: Restoring core directory objects 1 backup a day within the last 5 days, including users, groups, applications, service principals, Conditional Access policies, authentication method policy, authorization policy, and named locations.
Entra Backup and Recovery strengthens the core of your identity resilience strategy, helping you minimize downtime, protect your tenant, and recover quickly from both accidental changes and security compromises while maintaining confidence in the integrity of your environment.
Note: Microsoft Entra Backup and Recovery is available today and requires an Entra ID P1 or P2 license. Learn more on the Microsoft Entra Backup and Recovery learn docs page.
Get started today by navigating to Microsoft Entra Backup and Recovery under the Entra ID blade in the Microsoft Entra admin center.
Next, let’s explore how Entra Backup and Recovery helps organizations respond quickly and confidently by examining three common disaster recovery scenarios. These include an erroneous Conditional Access update that blocks user access, widespread user‑attribute corruption caused by an HR system issue, and malicious modifications to identity configurations.
Scenario 1: Recovering from an erroneous Conditional Access change that locks out users
Conditional Access policies are central to enforcing Zero Trust, and many organizations rely on them to control access across users, applications, and locations. While safeguards such as report-only mode and change validation help reduce risk, organizations need a reliable way to quickly recover from mistakes that can have an outsized impact.
In this scenario, an identity team is updating an existing Conditional Access policy as part of routine maintenance. During the update, an exclusion group is unintentionally removed from the policy assignments. The change applies right away. Some users are no longer able to sign-in, authentication failures increase, and helpdesk tickets begin to spike.
To restore access without prolonged disruption, the identity team turns to Microsoft Entra Backup and Recovery. Using the Backup and Recovery experience in the Microsoft Entra admin center, they review available backups and select a recent snapshot that reflects the last known-good configuration.
Identify the right backup to restore
You can easily view available backups in the Microsoft Entra Admin center and take action on accidental changes.
Next, the team generates a Difference Report scoped to Conditional Access policies. The report clearly shows what changed, including the removal of the exclusion group from the affected policy. This allows the team to confirm the root cause before taking action and to ensure no unrelated policies are included in the recovery scope.
After validating the changes, the team runs a targeted recovery job to restore the affected Conditional Access policy to its previous state. Within minutes, access is restored for impacted users, without requiring manual policy edits or custom scripts.
By using Microsoft Entra Backup and Recovery to identify the exact change and revert only the affected configuration, the organization resolves the incident quickly, limits disruption, and maintains confidence in its identity controls.
Scenario 2: Restoring user attributes after an HR system error pushes incorrect data at scale
Many organizations rely on an HR system as the authoritative source for user identity data. Attributes such as job title, department, and manager name often flow automatically into Microsoft Entra and downstream applications to power access decisions, workflows, and reporting.
In this scenario, a configuration issue in the HR system causes incorrect attribute values to be pushed to multiple user accounts during a scheduled provisioning cycle. Job titles and departments are overwritten at scale, reporting structures become inaccurate, and applications that depend on consistent identity data begin to behave unpredictably. To prevent further impact, the identity team pauses inbound provisioning while they assess the situation.
To investigate, the identity team uses Microsoft Entra Backup and Recovery to compare the current state of user attributes with a backup taken two days prior.
Validate configuration changes with a Difference Report
Admins can use the Difference Report to gain visibility into attribute changes, with a clear, itemized view across affected users.
The generated Difference Report clearly shows which users were affected and exactly which attributes changed, giving the team an immediate, actionable view of the impact.
To ensure the correct scope before recovery, the team applies granular filters to narrow the recovery to the affected users and attributes. This allows them to precisely target the recovery job without overwriting unrelated or valid updates made elsewhere in the directory.
You can apply granular filters in the difference report to quickly pinpoint the exact object that needs recovery.
After examining the changes and applying the right filters, administrators initiate the recovery job. Throughout execution, they monitor progress from the recovery history page, which surfaces real‑time status through the modified objects column, giving teams clear visibility into recovery progress and scope.
Once the HR system configuration is corrected, inbound provisioning is resumed with confidence, knowing the directory has been returned to a previously known good state and the organization can trust the accuracy of its identity data going forward, and normal operations continue without prolonged disruption.
Scenario 3: Recovering after malicious changes to identity configurations
In this scenario, a compromised privileged account is used to make malicious changes to identity configurations. MFA requirements are weakened and sensitive group memberships tied to critical applications are altered. Security teams detect suspicious activity and escalate the incident for investigation and remediation.
Once the immediate threat is contained, the identity team must determine exactly what changed and restore trusted configurations as quickly as possible. Manually reviewing and rebuilding identity settings across multiple objects would be time consuming and increases the risk of missing subtle but impactful changes. In addition to malicious configuration changes, malicious actors may also delete critical identity objects, which Microsoft Entra Backup and Recovery can restore by integrating with soft‑deletion as part of the same recovery process.
To assess the impact, the team uses Microsoft Entra Backup and Recovery to compare the current tenant state with a backup that reflects the last known good configuration prior to the compromise.
Execute the recovery job with confidence
You can quickly verify configuration changes and execute the recovery job with Microsoft Entra Backup and Recovery.
Once admins identify which directory object they want to recover, they select Recover this object, to remove the attacker’s malicious modifications and restore the trusted configuration. After running the recovery job, trusted configurations are reinstated and malicious modifications are removed, and the team verifies that MFA enforcement, access conditions, and group memberships have been returned to their expected state without requiring manual cleanup or reconstruction.
By using Microsoft Entra Backup and Recovery to quickly identify and revert malicious changes, the organization limits the blast radius of the incident, restores confidence in its identity environment, and resumes normal operations with minimal disruption.
Getting started with Microsoft Entra Backup and Recovery
Microsoft Entra Backup and Recovery is available today in Public Preview. If you’re a Microsoft Entra customer with Entra ID P1 or P2 license, you can start using these capabilities immediately in the Microsoft Entra admin center.
Microsoft Entra Backup and Recovery is built as an API‑first, extensible platform that gives customers the flexibility to design backup and recovery workflows aligned to their operational needs. These same APIs enable independent software vendors (ISVs) to integrate and deliver complementary solutions that extend Entra with their domain expertise.
To get started, sign-in to the Microsoft Entra Admin center as an Entra Backup Administrator role. In the left navigation, select Backup and Recovery to explore your automatic backups, generate Difference Reports, and run recovery jobs. From here, you can review your snapshot history, investigate configuration changes across your directory, and begin restoring objects as needed.
Identity resilience isn’t optional—it’s essential. With Microsoft Entra Backup and Recovery, you can minimize downtime, protect your tenant, and recover confidently from accidental changes or security compromises. Start using Entra Backup and Recovery in Public Preview today and join the conversation in the Microsoft Entra Tech Community.
-Joseph Dadzie
Vice President, Product Management
Additional resources
- Learn more about Microsoft Entra Backup and Recovery
- Register for our upcoming webinar: Recover with Confidence using Entra Backup and Recovery
- Read more about Microsoft's commitment to resiliency
- Read more about Microsoft Entra Innovations announced at RSAC 2026
Learn more about Microsoft Entra
Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.
Microsoft