In this blogpost we're going to talk about Entra Backup and Recovery. What is Entra Backup and Recovery, what are the requirements and how do I configure and use this? Also how does this compare with the soft delete option? 

1. What is Entra Backup and Recovery?

Microsoft has a new feature that was sillently introduced in March 2026. This feature enables you to restore backups from your Entra ID environment. Included in these backups are:

• Applications;
• Authentication Method Policy;
• Authorization Policy;
• Conditional Access Policies;
• Groups (note: group ownership changes and dynamic group rule changes are not in scope);
• Named Location Policies;
• Organization;
• Service Principals, App Role Assignments, OAuth2 Permission Grants;
• Users (also your Agent ID) (note: manager and sponsor changes are not in scope).

At this time of writing the following is configured by default:

• Backup time is daily (once at 12:00 AM)) without the option to adjust this;

• It will create snapshots from the objects described above;

• The backup stays in the same geo location.

2. Requirements Entra Backup and Recovery

The following requirements are needed to be able to use Entra Backup and Recovery:

License:

• Microsoft Entra ID P1 or P2.

3. Great! How Can I Use This Feature?

Follow these steps to use this feature:

• Go to the Entra admin center (entra.microsoft.com);

• Browse to Entra ID -> Backup and recovery;

From the Entra Backup and recovery overview page, you will see three different options where you can browse to:

• Backups: From this menu you can view your backups. By default there will be a backup of 7 days available to restore or to create a difference report from;
  
  
• Difference Reports: From this menu you can create a difference report. This helps you compare your current situation versus your previous state; 
  
  
• Recovery History: From this menu you can review all your ongoing and completed recovery.

First let's check out the "Backups" overview. When we select "Backups" we see a list of our 7 days backups. From here we can create a "Difference Report". Select one of the backups and select "Create difference report".

On the next screen you are able to choose which objects you want to create a difference report for. For this blog I will only select " Groups" and "Users". Next select "Create difference report". Note that you can only generate one report at a time!

Your report will now be created. You can see that your report is generating by selecting "Difference Reports" from the side menu. The time it will take creating a difference report depends on the number of objects you have in your tenant:

After the report has been created you will be able to open the report and browse through all changes that have been made between the time stamps. In my case any change regarding Users and Groups.

Select the generated report. From this report you will see all objects that are recoverable.

From the report we can see the different objects that we can recover. From the report you will see the recovery action and which objects have been changed. So if we select our Data Security Triage Agent we will see what type of change has been made. If we want, we can now recover this object by selecting "Recover this object".

After you selected "Recover this object", you can view the status of the recovery by selecting "Recovery History".

3.1 Can I Also Recover All Changes?

I don't think this will happen often, but you can also recover everything. If you want to do this we go back to our difference report where we select "Recover". 

4. But Wait, What About Soft Delete?

With Soft Delete you can quickly recover a deleted user, CA policy or group (for 30 days). But when you want to recover multiple objects or config changes, Entra Backup and Recovery will be best option to use. To explain this a bit more:

Soft Delete:

• Recover deleted objects (MS Learn Objects);
• Retention 30 days;
• Invididual Objects.

Entra Backup and Recovery:

• Recover deleted objects;
• Recover config changes;
• Recover multiple unwanted changes;
• Retention 7 days (MS Managed);
• Tenant wide supported Entra objects and settings.

4.1 Where Can I Find Soft Delete?

Soft delete is available on various locations in Entra depending on the type of deletion (for example CA, Users, Groups). For this blog I will show the Soft Delete for conditional access policies:

• Go to the Entra admin center (entra.microsoft.com);

• Browse to Entra ID -> Conditional Access;

From the overview screen you will find "Deleted Policies". From here you are able to recover (soft) deleted CA policies. You will find this "Deleted" option also for "Groups" and "Users". 

5. Wrap-up

Entra Backup and Recovery can be your go to if you accidentally deleted or changed something in your organization. Still be aware that the data stays in your own tenant, so I would recommend always saving your backup through another supplier. Also you aren't able to adjust your retention window (7 days only). Hybrid AD is also not supported (yet?). Nevertheless this feature is a great addition for your environment if you want to perform a "quick" and simple restore.