Entra ID Finally Gets an Undo Button: Inside Backup and Recovery

Until March 2026, deleting the wrong security group in Entra ID was a permanent mistake. No recycle bin, no soft-delete window, no rollback. A misconfigured Conditional Access policy meant a manual rebuild. A corrupted service principal meant starting from scratch. The recovery toolkit was audit logs (which tell you what happened but cannot undo it), screenshots if someone thought to take them, and Graph API export scripts if your team had built them.

That changed when Microsoft quietly dropped Entra Backup and Recovery into public preview in March 2026. Here is what it covers, how a recovery actually runs, and the limits to understand before you depend on it.

What you get, at a glance#

Who actually needs this? Two scenarios#

The accidental change. The most common recovery scenario for MSPs: a junior admin deletes the wrong group, a bulk user update script runs with bad data, or a CA policy gets modified during a change window and locks out a subset of users. These incidents happen fast and are usually caught within hours, well inside the five-day window. The recovery path is now straightforward: browse to the backup, run a difference report, scope the recovery, restore.

The attacker with a foothold. The more dangerous scenario is not the accident. It is the attacker who has already gained access and is quietly modifying the environment to maintain persistence, such as disabling Conditional Access policies or adding exclusions to them.

This technique is cataloged as MITRE ATT&CK T1556.009, Modify Authentication Process: Conditional Access Policies. Tactics: Persistence (TA0003), Defense Evasion (TA0005), Credential Access (TA0006). Documented actors include Scattered Spider and Storm-0501. Reverting those modifications used to mean reconstructing the policy from memory. Now it can mean restoring it from yesterday's backup.

What the backups actually cover#

The following object types are selectable in the recovery portal, matching what is available in the admin center UI:

• Applications
• Authentication Method Policy
• Authentication Strength Policies
• Authorization Policy
• Conditional Access Policies
• Groups
• Named Location Policies
• Organization
• Service Principals, App Role Assignments, and OAuth2 Permission Grants (grouped as one recoverable unit)
• Users

One important precision point: this is property-level recovery, not a complete full-state rollback of every attribute on an object. Each object type has a defined set of recoverable properties. For groups, for example, you can recover DisplayName, Description, SecurityEnabled, and MailEnabled, but group ownership changes and dynamic group membership rules are explicitly out of scope. Review the supported objects and properties reference (opens in new tab) before you rely on this in a recovery scenario.

Running a recovery, start to finish#

1. Browse your restore points#

In the Entra admin center, navigate to Backup and recovery > Backups. You see up to five restore points representing the previous five days. From here you can select one and create a difference report.

2. Run a difference report (do not skip this)#

Before recovering anything, generate a difference report comparing the selected backup against the current state of the tenant. It shows attribute-level changes: exactly what changed, on which objects, and how. This is how you scope a recovery precisely and avoid rolling back legitimate changes alongside the ones you actually want to fix.

Preview caveat: difference report generation can take 25 minutes or more on larger tenants. The first time you access a backup, whether through a report or a recovery, the service loads that backup's data, which takes fixed time regardless of tenant size. Subsequent operations on the same backup are faster. Run reports proactively in your environment so you know the wait time before you are in a live incident.

3. Scope and trigger the recovery#

Three recovery scopes are available:

• Recover all objects: full restore of all supported objects in the backup
• Recover by object type: scope to a specific category, e.g. Conditional Access Policies only
• Recover specific objects by Object ID: precision targeting of up to 100 individual objects

The report lists every object changed since the previous backup:

From here you can recover all items, all items of a type (groups, CA policies, and so on), or a specific object. Below is a Conditional Access policy that was disabled and had a new user added to its exclusions. Recovering this object reverts it to its state before the change:

All recovery actions are logged to the audit trail and appear in the Recovery History pane. Recovery history is retained for five days after job completion, so document your actions if you need a longer record for compliance or post-incident reporting.

Who can restore what#

Two new roles ship with the feature:

The honest limits list#

This is a meaningful feature. It is also a preview, with real constraints worth being upfront about with your team and your clients.

Behavior may change before general availability. For the full technical reference, see the Entra Backup and Recovery documentation (opens in new tab) and the supported objects and properties reference (opens in new tab).