Data Backed Up in Entra ID

Microsoft Entra ID is an Identity as a Service (IDaaS) solution, a cloud-based identity and access management service that Microsoft users can use to access external resources. Example resources include Microsoft 365, the Azure portal, and thousands of other SaaS applications. Microsoft Entra ID also helps users access internal resources like apps on in their organizational intranet, and any cloud apps developed for their organization.

To learn the differences between Active Directory and Microsoft Entra ID, see Compare Active Directory to Microsoft Entra ID. You can also refer to Microsoft Cloud for Enterprise Architects Series posters to better understand the core identity services in Azure like Microsoft Entra ID and Microsoft 365.

The following tables describe the Entra ID objects protected by Barracuda Cloud-to-Cloud Backup.

Entra ID Backup

• Users

• Groups

• Administrative Units

• Roles

Entra ID Backup Premium

• Application Registrations

• Audit Logs

• Authentication Method Policies

• Authentication Strength Policies

• BitLocker Keys

• Conditional Access Policies

• Device Management

  • Device Compliance Policies

  • Device Configuration Policies

• Enterprise Applications

• Named Locations

Entra ID Backup

Users

User objects are digital profiles that represent people in an organization. These profiles store important information about each user, such as their name, email address, job title, and permissions.

For example, a user object might include:

• The user’s login credentials (username and password).

• Their role (e.g., regular employee or admin).

• Groups they belong to (e.g., "Sales Team").

• Access permissions for apps and data.

User objects are like ID cards in the digital world, helping the system know who someone is and what they are allowed to do.

Backup:

The object and all attributed detailed below are backed up.

Restore:

The object is updated/created.

Limitation:

Photos backed up need to be exported and restored manually.

Groups

Group objects are digital collections of users, devices, or other groups that help manage access to apps, data, and resources more efficiently.

For example:

• Instead of giving access to an app to 50 employees one by one, you can add all 50 to a group and assign the app to the group.

• Groups can also be used to apply specific policies, like blocking access from certain locations.

There are two main types of groups in Entra ID:

1. Security groups: Used to control access to resources (e.g., files, apps).

2. Microsoft 365 groups: Used for collaboration (e.g., in Teams, SharePoint).

There are two additional groups where Entra ID plays a role in their creation and synchronization. Mail-Enabled Groups and Distribution Groups are primarily managed in Exchange Online or the Microsoft 365 Admin Center, rather than directly in Entra ID.

Group objects are like "folders" for people and devices, making it easier to organize and manage access.

Backup:

• The object and all attributes detailed below are backed up.

• Group members are backed up.

Restore:

• The object is updated/created.

• Existing members are added/removed.

Limitation:

Microsoft allows the back up of all 4 group types, however, only Microsoft 365 groups and Security groups can be restored. See the table below for details.

Group Types

Group Attributes

Administrative Units

User objects are digital profiles that represent people in an organization. These profiles store important information about each user, such as their name, email address, job title, and permissions.

For example, a user object might include:

• The user’s login credentials (username and password).

• Their role (e.g., regular employee or admin).

• Groups they belong to (e.g., "Sales Team").

• Access permissions for apps and data.

User objects are like ID cards in the digital world, helping the system know who someone is and what they are allowed to do.

Backup:

• The object and all attributed detailed below are backed up.

• Members are backed up.

Restore:

• The object is updated/created.

• Existing members are added/removed.

Roles

Roles are like job titles that define what someone is allowed to do in your organization’s systems.

For example:

• If you want someone to manage user accounts but not have access to billing information, you can assign them a User Administrator role. If someone needs full control over all settings, you can assign them the Global Administrator role.

Roles come with specific permissions that determine what tasks a person can perform, helping you control access and responsibilities.

Roles are how you assign the right level of access to people, so they can do their job without having unnecessary permissions.

Backup:

• The object and all attributes as detailed below are backed up.

• The users are backed up.

Restore:

• The object is updated/created.

• Existing users are added/removed.

Entra ID Backup Premium Objects

The Entra ID Backup Premium tier supports the backup and restore of the following attributes for each object type, where possible. 

App Registrations

App registrations are like creating a digital ID for an app so it can securely connect to your organization's systems or other services. This process allows apps to access resources, like user data or APIs, in a controlled and secure way.

For example:

• If your company has a custom app that needs to access Microsoft 365 data (like calendars or emails), you’d register the app in Entra ID.

• During registration, the app gets credentials (like a username and password for apps) and permissions (what the app is allowed to do).

App registrations are how you let apps "log in" and securely interact with your organization’s data, just like users have to.

Backup:

• The object and all attributes as detailed below are backed up.

• The owners (users) are backed up.

Restore:

• The object is updated/restored (see details under Enterprise Applications).

• Existing owners are added/removed.

Limitations:

• For hard deleted app registrations, the following attributes cannot be restored, so they must be added by the user after restore:

  1. Redirect URI Settings

  2. Identifier URIs

• See notes under Enterprise Applications.

• Secrets and Certificates need to be created manually after restoration.

• Photos for internal applications are backed up, however, they currently cannot be exported or restored.

Audit Logs

Audit logs in Entra ID are like activity trackers that record what’s happening with sign-ins and directory changes in your organization.

For example:

• If you want to see who signed in to your system, from where, and whether the attempt was successful, you’d check the sign-in logs.

• If you need to know who added a new user or changed permissions, you’d check the directory audit logs.

These logs provide detailed records to help monitor security, troubleshoot issues, and meet compliance requirements.

Sign-in and directory audit logs are how you keep track of what’s happening in your organization’s systems for security and transparency.

Note:

Entra ID has two types of logs, Sign-In and Directory Audit.

Backup:

The object and the attributes as detailed below are backed up.

Restore:

User and Audit logs are captured for historical audit purposes only and cannot be restored to the tenant; they can only be exported.

Limitation:

To back up logs, the customer must have a P1 or P2 license applied to the tenant. For more information on Entra ID and the license types, see https://learn.microsoft.com/en-us/entra/fundamentals/whatis.

Authentication Method Policies

Authentication method policies are like rules that control how users verify their identity when signing in to your organization's systems.

For example:

• If your company requires employees to use multi-factor authentication (MFA), like entering a password and approving a notification on their phone, you can set up an authentication method policy.

These policies define which methods are allowed (e.g., passwords, biometrics, or security keys) and ensure users follow your organization’s security requirements.

Authentication method policies are how you decide the "how" behind signing in, making sure it’s secure and meets your organization’s needs.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The object is updated/created.

Limitation:

There is currently no support for non built-in policies.

Authentication Strength Policies

Authentication strength policies are like setting the "security level" required for users to sign in, based on the sensitivity of what they’re accessing.

For example:

• If your company has sensitive financial data, you might require employees to use stronger authentication methods, like multi-factor authentication with a password and a physical security key, instead of just a password.

These policies let you define the level of authentication needed for different scenarios, ensuring that higher security is used where it matters most.

Authentication strength policies are how you match the security of sign-ins to the importance of the data or apps being accessed.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The object is updated/created.

BitLocker Keys

BitLocker keys are recovery codes that help a user unlock and access encrypted devices if something goes wrong.

For example:

• If your company uses BitLocker to encrypt work laptops for security, and an employee forgets their password or the device has an issue, the BitLocker key acts as a backup to unlock it.

When devices are joined to Entra ID, their BitLocker keys are stored securely, so admins can retrieve them if needed.

BitLocker keys are the "spare keys" to unlock encrypted devices, kept safe in Entra ID for emergencies.

Notes:

• To effectively back up BitLocker keys, it is also necessary to back up Devices. However, Microsoft does not offer a way to restore Devices; they are captured solely for display purposes.

• The number of nodes displayed under a Device within the user interface is the number of encrypted volumes. For example, one device with a C and D drive will display two nodes, each with their own recovery key.

• The display name of BitLocker nodes for each Device consists of a combination of the GUID and a unique value generated during enumeration.

• Backing up BitLocker keys may result in a noticeable increase in audit log events.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

For security purposes, BitLocker keys cannot be restored to the tenant; they can only be exported.

Conditional Access Policies

Conditional access policies are like digital security rules that help protect an organization. They ensure that only the right people, using the right devices, in the right situations, can access company apps and data.

For example:

• A company might allow employees to access work apps only if they’re logging in from a company-approved device or a secure network.

• If someone logs in from an unusual location (like a different country), they might need to verify their identity with a second step, like a text message code.

These policies act as smart guards that balance security and convenience based on the situation.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The object is updated/created.

Limitations:

• To back up logs, you must have a P1 or P2 license applied to the tenant. For more information on Entra ID and the license types, see https://learn.microsoft.com/en-us/entra/fundamentals/whatis.

• Authentication Strength grant access controls cannot be restored.

• If there are no session controls and no grant controls set except Auth Strength, the policy will be restored but set to Blocked Access and Reporting Only. User action is required to activate the policy.

• Named Location Policies can be restored, but without their relationship to conditional access policies, if any exist.

• Certain preview features that can be enabled in the tenant are not currently supported by the Microsoft API and will result in a backup failure.

  • Known examples:

    • Strictly enforce location policies (preview)

    • Require token protection for sign-in sessions (preview)

Device Management

Device Management (also known as Intune) contains policies that control how devices are used within your organization to keep data secure. These policies enforce rules, like requiring device encryption, restricting app usage, or controlling how company data is shared.

Intune policies are how you manage and protect devices in your organization, ensuring data is secure and used appropriately.

Device Management contains two policy types related to device controls, Device Compliance Policies and Device Configuration Policies, which are defined below.

Device Compliance Policies

Device compliance policies are like a set of rules that help ensure devices and users meet your organization's security and compliance requirements before accessing sensitive data or apps.

For example:

• If your company requires employees to use devices with up-to-date antivirus software and encryption, you can create a compliance policy in Entra ID.

• This policy checks devices to ensure they meet these standards. If a device doesn’t comply (e.g., it’s missing antivirus software), access to company apps or data can be blocked until the issue is resolved.

Device compliance policies are how you make sure only secure, trusted devices and users can interact with your organization’s resources.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The object is updated/created.

Limitation:

• Not all device compliance policies are accessible via the Microsoft API. The following list contains all supported configurations; any other combination available in the configuration creator cannot be backed up:

  • "Android device administrator - Custom"

  • "Android device administrator - Device restrictions"

  • "Android Enterprise - Personally-Owned Work Profile - Custom"

  • "Android Enterprise - Personally-Owned Work Profile - Device restrictions"

  • "iOS/iPadOS - Custom"

  • "iOS/iPadOS - Device features"

  • "iOS/iPadOS - Device restrictions"

  • "iOS/iPadOS - Software Updates (aka Edition upgrade and mode switch)"

  • "macOS - Custom"

  • "macOS - Device features"

  • "macOS - Device restrictions"

  • "Windows 10 and later - Custom"

  • "Windows 10 and later - Device restrictions"

  • "Windows 10 and later - Device restrictions (Windows 10 Team)"

  • "Windows 10 and later - Edition upgrade and mode switch"

  • "Windows 10 and later - Endpoint protection"

  • "Windows 10 and later - Microsoft Defender for Endpoint (desktop devices running Windows 10 or later)"

  • "Windows 10 and later - Secure assessment (Education)"

  • "Windows 10 and later - Shared multi-user device"

  • "Windows 8.1 and later - Device restrictions"

Device Configuration Policies

Device configuration policies are like preset instructions for setting up devices or apps consistently across your organization.

For example:

• If your company wants all work laptops to have specific Wi-Fi settings, a trusted certificate installed, and a default homepage in the browser, you can create a configuration profile policy in Entra ID.

These policies automatically apply the settings to devices when they connect to your organization, so employees don’t have to set things up themselves.

Device configuration policies are how you preconfigure devices or apps to ensure they are ready for work and meet your organization’s standards right out of the box.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The object is updated/created.

Limitation:

Certain policies, such as Android Enterprise and AOSP, cannot be restored once deleted. If you attempt to restore a deleted policy that is not supported, an exception will occur, causing the restore to fail with a corresponding message captured in the job log.

Enterprise Applications

Enterprise applications (also known as Service Principals), are a subset of App Registrations, and are like a digital identity for an app within your organization. They allow apps or automated tools to "log in" and access specific resources securely, based on permissions you set.

For example:

• If you have an app that automates file sharing in Microsoft 365, it needs a way to access your files without using a person’s login. A enterprise application acts as the app’s identity.

• The enterprise application is created automatically when you register an app or manually if needed. It has its own credentials (like a username and password for apps) and can be assigned permissions, controlling what it can do.

Enterprise applications are how apps securely "act on their own" in your systems, following rules you define.

Backup:

• The object and all attributes as detailed below are backed up.

• Assignments to users and groups are backed up.

• The owners (users) are backed up.

Restore:

• The object is updated/restored (see notes below).

• Assignments to existing users and groups are added/removed.

• Existing owners are added/removed.

Additional notes on restoring:

1. If the parent app registration exists within the same tenant as the enterprise application (e.g., internal to the customer), then:

   1. If the app registration is soft or hard deleted, an exception will occur, causing the enterprise application restore to fail. In this situation, you should first restore the app registration.

   2. If the enterprise application is soft deleted (retained for 30 days), it will be restored with the same ID.

   3. If the enterprise application is hard deleted, a new enterprise application will be created with a new ID. 

2. If the parent app registration is in another tenant (eg, a 3rd party app), then:

   1. If the app registration is soft or hard deleted, an exception will occur, causing the enterprise application restore to fail.

   2. If the enterprise application is soft or hard deleted, an exception will occur, causing the enterprise application restore to fail.

3. Only enterprise applications of type ‘Application’ are restored. For other types of enterprise applications, restore of child nodes will be attempted.

4. Owners and App Role assignments for child nodes are restored if the corresponding users or groups exist. Any assignments that are not present in the snapshot will be deleted.

5. During restore, if the enterprise application exists, it will be updated to match the backup. Supported attributes are listed in this article.

Limitations:

• Microsoft does not provide the capability to back up or restore:

  • Roles and Admins

  • SSO settings

  • Permissions and consent.

• Backing up photos is currently not supported.

Named Locations

Named locations are a way to define specific geographic locations or IP ranges that your organization trusts or wants to monitor. They help enforce security rules by identifying where a user is signing in from.

For example:

• A trusted named location could be your company’s office network.

• A blocked named location might include risky regions or countries you want to restrict access from.

Named locations are used in Conditional Access policies to control access. For instance:

• Only allow users to sign in without extra verification when they're in a trusted office.

• Require extra security steps (like MFA) if someone logs in from outside the trusted locations.

Named locations are like setting boundaries to decide what locations are safe to login from, and what locations need extra protection.

Backup:

The object and all attributes as detailed below are backed up.

Restore:

The named location policy is updated/created.