Microsoft has quietly released one of the most requested Identity features in years: Microsoft Entra Backup and Recovery, now available in public preview.

For organisations that rely on Microsoft 365, Entra ID (Azure AD), and Conditional Access, this new capability provides something that has historically been missing: native, point-in-time recovery for critical Identity objects, without relying entirely on manual recreation or third-party tools.

This article explains what the feature does, what licensing is required, what it doesn’t replace, and why it matters in real-world environments.

Why Identity recovery has always been hard

Until now, recovering from identity-related incidents has often meant:

•Manually recreating Conditional Access policies from audit logs
•Rebuilding applications or service principals after accidental changes
•Attempting to reverse provisioning mistakes made at scale
•Reconstructing access models after privileged accounts were misused

While Microsoft has long protected the availability of Entra ID as a platform, customer configuration inside the tenant has largely been the customer’s responsibility.

Entra Backup and Recovery is Microsoft’s first built-in answer to this gap.

What is Microsoft Entra Backup and Recovery?

Microsoft Entra Backup and Recovery is an always-on, Microsoft-managed service designed to help organisations recover from accidental changes or malicious updates to their Entra tenant.

During public preview, it automatically takes daily backups of supported directory objects and allows administrators to:

•View available backup snapshots
•Generate difference reports to see what has changed
•Restore objects to a previously known good state

Supported objects in preview include:

•Users and groups
•Applications and service principals
•Managed identities
•Conditional Access policies
•Named locations
•Authentication and authorisation policies

Importantly, backups cannot be disabled, deleted, or modified by tenant administrators, even those with the highest privileges. This makes them resistant to both mistakes and insider threats.

Licensing and availability

Microsoft Entra Backup and Recovery is not available to all tenants. During public preview, the requirements are:

•A workforce Entra ID tenant
•Microsoft Entra ID P1 or P2 licensing
•Appropriate admin roles (Global Admin or Entra Backup roles)

Tenants without P1/P2 (such as Entra ID Free) do not receive these backups. External ID (CIAM) and Azure AD B2C tenants are not supported at preview.

If a tenant meets the licensing requirement: one backup is taken daily, backups are retained for five days, and recovery can be initiated through the Microsoft Entra admin center.

What this feature is (and isn’t)

Entra Backup and Recovery is significant, but it’s important not to misunderstand what it covers.

What it provides:

•Native, point-in-time recovery for Identity configuration
•Fast rollback of misconfigurations
•Visibility into what changed before restoring
•A Microsoft-managed safety net for Entra objects

What it does not replace:

•Long-term retention or historical archives
•Identity governance, access reviews, or change control
•Third-party backup solutions for other workloads (Exchange, SharePoint, OneDrive)
•Good administrative discipline

It reduces recovery time. It does not eliminate the need for strong Identity management practices.

Real-world scenarios where this helps

This feature is particularly valuable in scenarios such as:

•A Conditional Access policy is modified and locks out users
•A scripted change unintentionally updates identities at scale
•An application or service principal is misconfigured
•Named locations or authentication policies are deleted
•A compromised privileged account makes unauthorised changes

In these situations, admins can now review what changed and recover quickly, rather than rebuilding configurations manually.

Why this matters for businesses using Microsoft 365

Identity is now the control plane for:

•Email and collaboration access
•Application sign-in
•Conditional security enforcement
•External access and integrations

When Identity breaks, business stops.

Entra Backup and Recovery strengthens tenant resilience, especially for organisations that rely heavily on Microsoft 365 and Entra ID for daily operations.

A quick note on public preview

This capability is currently in public preview, which means:

•Features and behaviour may change before General Availability
•Preview services do not carry standard SLAs
•It should not be treated as a sole disaster recovery mechanism

That said, its inclusion in the Entra admin center and always-on design strongly suggest Microsoft sees this as a core Identity capability going forward.

Final thoughts

Microsoft Entra Backup and Recovery fills a long-standing gap in Identity resilience. For P1/P2-licensed tenants, it provides a much-needed safety net against common (and often high-impact) Identity incidents.

As with any security or recovery feature, its real value comes when it’s understood, monitored, and used appropriately.

If you rely on Microsoft Entra ID and Microsoft 365 to run your organisation, this is a feature worth being aware of, and planning around.

Microsoft Entra Backup and Recovery (Preview): A Built-In Safety Net for Identity