Why back up Entra ID?
Entra ID holds far more than user accounts: groups, roles, app registrations, Conditional Access policies and the settings that keep your tenant secure. One mistake, a malicious insider or a compromised admin account can undo it.
It happens. In a US case from 2018, a former IT contractor deleted more than 1,200 of a company's 1,500 Microsoft 365 user accounts. The business was shut down for two days, and the court ordered $567,084 in restitution.
What Microsoft includes – and where it stops
- Recycle bin – deleted users, Microsoft 365 groups and app registrations can be restored for 30 days. After that, they're permanently removed.
- Microsoft Entra Backup and Recovery – included with Entra ID P1 and P2. Takes a backup once a day and keeps up to seven days of history, stored in the same region as your tenant. It can't recover objects that have been permanently deleted.
- Microsoft Entra Connect – keeps on-premises Active Directory in sync with Entra ID. It isn't a backup and doesn't cover cloud-only objects such as guest accounts.
- Audit logs – record what changed, but can't roll your tenant back.
Microsoft's tools are useful for fixing recent mistakes. They aren't designed for long-term recovery, and every copy stays inside Microsoft's environment.
What Keepit adds
- Independent cloud – backups stored separately from Microsoft
- Long-term retention – 12 months, or unlimited on Enterprise Unlimited and Governance Plus plans
- Wider coverage – users, groups, admin units, roles, enterprise apps, app registrations, Conditional Access policies, Intune device compliance and configuration policies, BitLocker recovery keys and activity logs
- Flexible restores – restore in place, in bulk, individual sub-objects, or to a secondary tenant (cross-tenant restore)
- Immutable backups – protected against tampering and ransomware
- UK or EU data – UK data centre in Slough, or European data centres in Germany, Switzerland and Denmark, with four copies across at least two physical locations in your chosen region
Microsoft Entra Backup and Recovery vs Keepit
| Microsoft Entra Backup and Recovery | Keepit | |
|---|---|---|
| Backup history | Up to 7 days | 12 months or unlimited |
| Where backups are stored | Inside Microsoft, same region as your tenant | Independent cloud, UK or EU |
| Permanently deleted objects | Can't be recovered | Restore from any backup in your retention period |
| Also covers | Core directory objects and policies | Adds Intune policies, BitLocker keys, activity logs |
| Restore to another tenant | No | Yes |
| Cost | Included with Entra ID P1/P2 | Subscription – ask for a quote |
Protect Microsoft 365 too
Entra ID backup works alongside our Microsoft 365 backup for Exchange, OneDrive, SharePoint and Teams.
Frequently asked questions
Is Entra ID the same as Azure AD?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. It's the same service.
Doesn't Microsoft back up Entra ID now?
Microsoft Entra Backup and Recovery, included with Entra ID P1 and P2, takes a daily backup and keeps up to seven days of history. It's useful for recent mistakes. Keepit adds long-term retention, an independent copy outside Microsoft and wider coverage.
What happens after Microsoft's 30-day recycle bin?
Deleted objects are permanently removed from Entra ID. With an independent backup, you can still restore them from your backup history.
Can you back up Conditional Access policies?
Yes. Conditional Access policies are included, along with users, groups, roles, app registrations and more.
Where is my backup stored?
In the region you choose – the UK (Slough) or Europe (Germany, Switzerland or Denmark) – with four copies across at least two physical locations.
Book a free demo and see how Entra ID backup and recovery works for your tenant.