Soft-delete is a separate recovery option
Microsoft Entra provides soft-delete for certain object types. Microsoft documents a retention period of thirty days and a separate recovery path. A soft-deleted object temporarily exists in a deleted state and can be restored within the supported period. This is different from Microsoft Entra Backup and Recovery; supported object types and relationships must be checked for each scenario.
What Microsoft Entra Backup and Recovery provides
Microsoft automatically backs up supported directory objects once a day and retains up to seven days of backup history. Administrators with the required roles can view available backups, generate a difference report, initiate recovery within a selected scope and review recovery history. The functionality requires a workforce tenant with Microsoft Entra ID P1 or P2 licences; External ID and Azure AD B2C tenants are not supported.
Functional and technical boundaries
Recovery applies only to object types, properties and relationships supported by Microsoft. Hard-deleted objects cannot be restored or reconstructed. Changes to objects synchronised from Active Directory Domain Services may appear in a difference report, but objects whose source of authority is on-premises cannot be restored through this cloud functionality. Microsoft 365 content and Azure resources are outside Microsoft Entra Backup and Recovery.
Depending on the method and scenario, user authentication methods may be included when restoring a user object. Backup and Recovery does not restore passwords. A Temporary Access Pass is time-limited and must be reissued where necessary. Following suspected compromise, restored authentication methods must not be trusted without assessment.
Applications and service principals can be restored within the scope supported by Microsoft. Existing application secrets may be retained or restored in certain recovery cases. Changed, deleted or potentially compromised secrets require review and rotation where necessary; unsupported application properties must be restored separately.
How suXus complements the native functionality
suXus inventories critical identity objects, dependencies, administrator roles, emergency access and unsupported components. suXus helps interpret difference reports, document recovery decisions, organise authorisation and change control, and practise representative scenarios. For identity configuration, see Microsoft Entra ID management; for broader preparation against misuse, see ransomware recovery.
Responsibilities
Responsibilities
Microsoft operates the Entra platform, creates native backups and determines which tenants, object types, properties, relationships and recovery actions are supported.
suXus assists with design, documentation, change control, assessment of difference reports, recovery preparation and guidance within the available Microsoft functionality. This does not make suXus the supplier or owner of the Microsoft backup service.
The customer authorises recovery actions, appoints decision-makers and object owners, sets governance and risk decisions, and ensures that on-premises sources and unsupported components are protected separately.
Outcomes
Outcomes
A documented scope, allocation of roles, assessment and decision procedure, recovery sequence and exercise plan for representative supported objects. This does not guarantee that the entire tenant, every object or every incident can be recovered.
Technology
Technology used in these services
- Microsoft Entra Backup and Recovery
- Microsoft Entra ID
Frequently asked questions
Is soft-delete the same as Microsoft Entra Backup and Recovery?
No. Soft-delete temporarily retains certain deleted objects in a recoverable state. Backup and Recovery uses separate Microsoft-managed backups to compare and reverse supported changes.
Can all Microsoft Entra objects be restored?
No. Only object types, properties and relationships supported by Microsoft fall within native recovery coverage. Current tenant and object support must be checked before a recovery action.
Can a hard-deleted object be restored?
No. Microsoft Entra Backup and Recovery does not restore or reconstruct hard-deleted objects. Unsupported scenarios require additional recovery preparation documented in advance.