Entra ID and Active Directory backup and recovery: the complete guide

Most backup plans start with files, databases and virtual machines. Identity often gets left out, because Entra ID is a Microsoft-run service and Active Directory "replicates anyway". But identity is what everything else depends on. Lose it, and you can't sign in to restore anything else.

There are three layers to protect, and each one needs a different approach:

1. Entra ID, the cloud directory.
2. On-premises Active Directory, if you run hybrid identity. It's still the source for synced users and groups.
3. The sync between them, usually Entra Connect Sync.

Entra ID: what Microsoft keeps for you

Soft delete: the 30-day recycle bin

When you delete some object types in Entra ID, they go into a soft-deleted state first. Microsoft's documentation says items "keep their properties and can be restored for 30 days". The types that support it are:

• Users
• Microsoft 365 Groups and cloud security groups
• Application registrations and service principals
• Administrative units
• Conditional Access policies and named locations

Everything else is hard deleted straight away. In Microsoft's words: "Your administrators and Microsoft can't restore hard-deleted items." To see and restore a deleted user with Microsoft Graph PowerShell:

1
2
3
4
5
6Connect-MgGraph -Scopes "User.ReadWrite.All"
# List soft-deleted users
Get-MgDirectoryDeletedItemAsUser -All |
    Select-Object Id, DisplayName, UserPrincipalName, DeletedDateTime
# Restore one by its ID
Restore-MgDirectoryDeletedItem -DirectoryObjectId "<object id>"

Entra Backup and Recovery: undoing changes

Soft delete only helps when something is deleted. A much more common problem is a bad change: a Conditional Access policy edited wrongly, group memberships wiped, or an app's settings altered. That's what Entra Backup and Recovery is for.

• It takes a backup once a day and keeps up to seven days of history.
• It covers users, groups, apps, service principals, Conditional Access policies, named locations, the authentication methods policy and selected authorization policy settings.
• It needs a workforce tenant with Entra ID P1 or P2.
• It doesn't bring back hard-deleted objects, and it doesn't protect objects that are managed in on-premises AD. Microsoft says to use a separate solution for those.

What isn't covered, and how to fill the gap

Seven days of history won't help if a bad change goes unnoticed for two weeks. And plenty of configuration isn't in scope at all. Export the settings you'd hate to rebuild from memory, on a schedule, and keep the exports outside the tenant. Conditional Access is the obvious place to start:

1
2
3
4
5
6Connect-MgGraph -Scopes "Policy.Read.All"
$out = "CA-export-$(Get-Date -Format yyyy-MM-dd)"
New-Item -ItemType Directory -Path $out | Out-Null
Get-MgIdentityConditionalAccessPolicy -All | ForEach-Object {
    $_ | ConvertTo-Json -Depth 10 | Out-File "$out\$($_.DisplayName -replace '[\\/:*?"<>|]', '_').json"
}

Treat these exports as documentation as well as backups. A dated folder of JSON files makes it easy to see exactly what changed, and when.

Keep a way in

Every recovery plan for Entra ID assumes someone can still sign in with enough rights to run it. Make sure you have emergency access accounts that don't depend on the systems that might be down.

On-premises Active Directory

If you sync from Active Directory, the on-premises directory is still the source of truth for those users and groups. Restoring them in Entra ID doesn't help if the next sync cycle overwrites them. And nothing in Entra will bring back a domain controller.

Turn on the AD Recycle Bin

The AD Recycle Bin lets you restore a deleted object with its attributes and group memberships intact, without restoring a domain controller from backup. It's off by default, and once you turn it on you can't turn it off. Enable it for the forest with:

1
2Enable-ADOptionalFeature -Identity "Recycle Bin Feature" `
    -Scope ForestOrConfigurationSet -Target "contoso.com"

To find and restore a deleted user:

1
2Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*Jane*"' -IncludeDeletedObjects |
    Restore-ADObject

Back up the system state

Replication isn't a backup. It copies a deletion or corruption to every domain controller just as quickly as a good change. Take regular system state backups of at least one domain controller in each domain. Windows Server Backup can do it from the command line:

wbadmin start systemstatebackup -backupTarget:E: -quiet

Two rules matter here:

• Keep backups younger than the tombstone lifetime. Microsoft says "the age of the backup should not exceed the Active Directory Tombstone Lifetime". If you restore an older backup, objects deleted since the backup can come back on that domain controller and never replicate anywhere else.
• Keep at least one copy out of reach. Store it offline or in immutable storage, where domain admin credentials can't delete or encrypt it. If an attacker owns your domain, they own anything a domain admin can reach.

Plan for losing the whole forest

The worst case is every domain controller wiped at once. That's what happened to Maersk in 2017, and the company was only rebuilt because one domain controller in Ghana happened to be offline. The full story is in the power cut that saved Maersk.

Microsoft's AD forest recovery guide sets out the full process: identifying the problem, choosing which domain controllers to restore, restoring one per domain into an isolated network, cleaning up, then rebuilding the rest. Read it before you need it, because the order matters.

The sync layer: Entra Connect

If your Entra Connect server dies, users keep signing in, but nothing new syncs: no new starters, no leavers disabled, and no password changes if you use password hash sync. Microsoft gives three options for recovery: rebuild when needed, keep a standby server in staging mode, or use virtual machines.

A staging server "continues to receive changes from Active Directory and Microsoft Entra ID and can quickly take over the responsibilities of another server in the event of a failure". It has its own database, so it can sit in a different datacentre. Keep these in mind:

• Only one server can be active. Entra Connect is active-passive, never active-active.
• Leave the sync running on the staging server, so it doesn't need a large catch-up if it takes over.
• Before you switch it to active, run a sync cycle and check the pending exports. Microsoft warns that switching without doing this "can have a severe impact".

Check which mode a server is in with Get-ADSyncScheduler and look at StagingModeEnabled.

What to use for what

Practise it

A recovery plan you haven't tested is a hope. At least once a year:

• Restore a soft-deleted test user and a test Conditional Access policy in Entra ID.
• Use Entra Backup and Recovery to roll back a deliberate change on a test group.
• Restore a test object from the AD Recycle Bin and check it syncs back correctly.
• Restore a domain controller from system state into an isolated network, and time it.
• Switch your Entra Connect staging server to active and back, following Microsoft's checks.

Write down how long each step took and what surprised you. That record is the real recovery plan.