Microsoft is strengthening the recovery side of cloud identity management with the general availability of Entra Backup and Recovery. The capability automatically protects critical directory objects and gives administrators a way to restore a tenant after malicious changes, configuration errors or operational accidents.
The service is enabled by default and creates daily backups of supported objects, with seven days of retention for organizations holding Microsoft Entra ID P1 or P2 licenses. Protected items include users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, agent identities and authentication or authorization policies.
Identity recovery becomes a security control
Identity systems are often treated as configuration platforms rather than production data stores. That distinction becomes dangerous during an incident. A compromised administrator can remove accounts, alter Conditional Access rules, change application permissions or disrupt authentication across an organization without encrypting a single server.
Entra Backup and Recovery allows administrators to examine snapshots, compare changes and run restoration jobs. This can reduce the time required to rebuild essential identity controls after an attack and provide evidence of what changed.
In my view, this is an important shift. Prevention remains necessary, but identity environments also need tested recovery objectives. Organizations routinely rehearse the restoration of databases and virtual machines while assuming that cloud directory settings will always remain available and trustworthy.
Additional identity protections
Microsoft's July update includes several other security changes. Microsoft Authenticator is gaining default detection that prevents Entra credentials from being added or used on jailbroken or rooted mobile devices. Entra Conditional Access is also receiving more precise controls for AI agents using user accounts, including policies based on agent risk, device compliance, network location and custom security attributes.
The update additionally introduces or expands support for:
- Kerberos key rotation with improved authentication resilience.
- Global Secure Access on Entra-registered bring-your-own Windows devices.
- Domainless SAML federation for external users.
- Central restrictions on changes to selected Active Directory groups.
- SCIM provisioning APIs in Microsoft U.S. Government Cloud.
Preparation still matters
Automatic backups do not remove the need for disciplined administration. Security teams should document who can initiate a recovery, protect those accounts with phishing-resistant authentication and monitor restoration activity as a high-risk event.
I believe organizations should also test the feature using a controlled recovery scenario. They need to understand which objects are supported, how dependencies are handled and what must still be rebuilt manually. A seven-day retention period is useful for quickly detected incidents, but it may not cover attacks that remain hidden for weeks.
Microsoft's move gives identity teams a valuable safety net. Its real value, however, will depend on whether customers turn the new capability into a rehearsed and monitored part of their incident response program.