Deleted is not always recoverable
Microsoft keeps deleted users, groups, apps and Conditional Access policies for 30 days. Other object types are gone at once and have to be created again by hand.
Works with
Entra ID decides who can log in. We keep a copy you can go back to.
Users, groups, apps, roles and access rules decide who can work. As an option with our Microsoft 365 backup we copy your Entra ID configuration to our data centre in the UAE, outside Microsoft, and our engineers do the restore when you ask.
Example
Group Finance-EditorsDeleted with an admin account
deletedoutside the tenant
Our copyNot touched, immutable
intacton your request
Group recreatedWith its 18 members
restoredWhy a separate copy of Entra ID?
Microsoft keeps the service running. What is in your directory, and whether you can go back to an earlier state, is up to you.
A change is harder than a deletion
A wrong access rule or a removed role locks people out without anything being deleted. Microsoft’s built-in backup keeps up to seven days of history.
Attackers start with identity
Whoever takes over an admin account can change groups, apps and access rules. Our copy is outside your tenant and cannot be changed from it.
Source: Microsoft Learn, Recover from deletions and Microsoft Entra Backup and Recovery, checked in November 2026.
What is in the backup.
Which objects are covered and how each of them is restored is fixed in your service before we start.
Always
Users, groups, app registrations and enterprise apps, roles and role assignments, domains and licences.
Where your licence allows
Admin units, Conditional Access and named locations, authentication policies, PIM and Identity Protection.
In the same run
SharePoint tenant settings, Purview labels, Intune configuration (preview) and the daily sign-in and audit logs.
For as long as you agree
You set the retention, separate from Microsoft. Sign-in and audit logs that Microsoft keeps for 7 or 30 days stay available in our copy for the agreed period.
What goes wrong, and what we do then.
You don’t have to find the right version or run the restore yourself. You call or email, and our engineers do it.
- A group or a user was deleted.We look up the last version in which it was complete and put it back, a group with its members.
- An access rule was changed and people are locked out.We show you how the rule stood on a day it still worked. Whether we set it back or you rebuild it from our copy is agreed per type of object.
- An app registration is gone and an application stops working.We restore what the service covers for that type of object, tell you what has to be set up again by hand and help you get the application working again, where possible.
- An admin account was taken over.Together we pick the last moment before the takeover, so you can see how users, groups, roles and rules stood then.
- After an incident someone asks who logged in, and when.The daily sign-in and audit logs are in our copy for the agreed period, also after Microsoft has removed them.
- A leaver’s account was removed too early.We restore the account from the copy, or its mail and files to another account if the user is already gone.
After every restore we check what came back and report it in the ticket.
Who does the work
You ask, we restore.
Entra ID backup is an option with our Microsoft 365 backup. We set up the connection with you, watch the daily runs and do the restores you ask for.
Microsoft 365 backupAt the start
You give our backup service access to your tenant. We set the retention and do a first restore test with you.
Every day
We copy what changed and check that the run succeeded. Your users notice nothing.
When you need something back
One call or one email. We pick the moment with you, restore and check the result.
After the restore
A restored object does not always work straight away: an app needs new keys, a recreated group needs its rights on sites and teams again. With a tool or SaaS service that is usually left to you. Our engineers help you put it back to work, where possible.
Questions we get a lot
Something else? Send us your question and an engineer will reply.
Microsoft has its own Entra backup now. Why a second one?
Microsoft’s built-in backup keeps up to seven days of history, inside Microsoft, and needs an Entra ID P1 or P2 licence. Our copy is kept outside Microsoft for as long as you agree, sits next to the backup of your mail, files, sites and Teams, and comes with engineers who do the restore.
Can you rebuild our whole Microsoft 365 or Entra tenant?
Not with one button. We back up much more than mail and files: users, groups, apps, roles, Conditional Access, Intune and more. What can be restored, and how, we confirm per type of object before we start. Don’t count on rebuilding an entire tenant automatically.
Is Entra ID backup included in Microsoft 365 backup?
It is an option. If you add it, your Entra ID configuration is in every backup, next to mail, files, sites and Teams.
Where is the backup stored?
In our own private cloud in the UAE, separate from your Microsoft 365 environment.
How many users are in your tenant?
Tell us the number of users and which licences you have. We tell you which Entra ID objects are covered and how each of them is restored.