Sign In
365 Backup · Microsoft Entra ID

Users getthirty days.Policies get nothing.

Deleted users and groups sit in the directory recycle bin for a limited time. For conditional access policies, role assignments and app registrations there is no recovery at all. Conbool captures the directory on a schedule and shows the differences as a change plan you can read.

Request a demoSee 365 Backup

Why the directory belongs in the backup

Four cases no recycle bin catches.

Sign-in policies have no recovery

Delete a conditional access policy and it is lost. That is the kind of loss that takes down the whole sign-in on a Monday morning, and Microsoft offers no way back.

The clock runs while nobody is looking

Users and groups stay recoverable for a limited time. Notice the loss later, during an audit for instance, and the window has long since closed.

A changed group goes unnoticed

Members removed from a group, an altered membership rule, a changed visibility: such edits raise no alarm and cannot be reconstructed afterwards.

Role assignments are the quiet case

Who held administrative rights is recorded nowhere you can look up. After an incident that is the first question asked.

Directory change planagainst today
12missing
3changed
47additional
Group Sales Northmissing
Policy MFA externalchanged

Nothing is deleted. Whatever exists today and not in the backup is reported and left alone.

Read first, write second

A plan a person reads.

The comparison between the backed up and today's directory names every finding on its own: what is missing, what differs and in which fields, and what exists on top.

Differing fields are spelled out

Additional objects are reported, not removed

Write-back only after two approvals

Every change then stands under a person's name

How the backup runs

One unit per Microsoft tenant, on the same schedule as every other source.

1. Read

Every run reads users, groups, directory roles, applications, service principals, administrative units and conditional access policies, plus the memberships of groups and roles.

2. Compare

On request a change plan is produced against today's state: what is missing, what differs and in which fields, and what exists on top.

3. Decide

The plan is there to be read. If you want to, users and groups can be written back from it, after two separate approvals. The default is the plan.

What makes the directory backup

Six points that make the difference.

Seven object kinds, not just users

Users, groups, directory roles, applications, service principals, administrative units and conditional access policies, each with the fields that count after a loss.

Memberships are the actual substance

Restoring a group without its members produces an empty shell, and for a role it would mean nobody is an administrator any more. Memberships are therefore carried along.

A change plan instead of blind write-back

A directory restore is rare and consequential. So a plan comes first, one a person reads, with the differing fields spelled out.

Nothing is deleted

Objects that exist today and not in the backup are reported and explicitly not proposed for removal. A restore that clears away newer objects would be a step backwards.

Microsoft's own path first

If a deleted user is still in the directory recycle bin, they are brought back from there, with their original identifier and therefore with mailbox, licences and memberships intact. Creating anew is the second choice, not the first.

No seat of its own

The directory belongs to no user. It runs as exactly one unit per Microsoft tenant and takes no licence seat.

With and without a backup of your own

What is possible either way.

 
With Conbool
Microsoft 365 only
Look up a deleted conditional access policy
yes, from the backed up state
no
Restore a user after the retention window
yes, as a new object
no
See group memberships as they were
yes
no
Differences against today's state as a list
yes
no
Role assignments from an older state
yes
no

Statements about Microsoft 365 follow its publicly documented recovery features. Deleted users and groups stay recoverable there for a limited time.

Frequently asked questions

What exactly is captured from Entra ID?
Users, groups, directory roles, applications, service principals, administrative units and conditional access policies. For groups and roles the memberships come along. Per kind a deliberately narrow field selection is captured, namely the fields someone will want to restore or look up after a loss.
Does Conbool write into the directory on its own?
Not on its own. The default is the change plan; nothing is written unless you start it. That takes two separate approvals: a setting in your tenant and a consent of its own per Microsoft organisation. The consent you grant includes write permissions on users and groups, without which write-back would not be possible at all. Without a plan and an approval they are never used, and every operation is logged.
What happens when a deleted user is written back?
First it is checked whether they are still in the directory recycle bin. Brought back from there they keep their identifier, and with it mailbox, licences and memberships. Once that window has closed, a new object with a new identifier is created. Gone then are group memberships, licences, the mailbox and every permission that hung on the old identifier. The account gets a one-time password nobody knows, which the administrator replaces.
Why are policies and role assignments not written back?
Because restoring them is more dangerous than losing them. Bring back a sign-in policy that was deliberately deleted three weeks ago and you lock out half the workforce on Monday. They are in the backed up state and in the change plan and can be read there; creating them is left to a person.
What happens to objects that only exist today?
They are reported in the plan as additional and are not proposed for removal. A restore deletes nothing.
Which permissions does the backup need?
For the backup, read permissions on users, groups and the directory; for write-back, additional write permissions on users and groups. Without the read permissions the run reports each affected object kind explicitly as unreadable, instead of recording an empty backup as a success. Whatever could not be read is named with its reason in the report.
Does the directory cost an extra seat?
No. The directory belongs to no user and runs as one unit per Microsoft tenant, without a licence seat of its own.

Related solutions

Microsoft 365 Backup

Acht Quellen in einem Zeitplan, Rückholung einzelner Elemente.

Exchange Online Backup

Postfächer sichern, wenn die Aufbewahrungsfrist nicht reicht.

Teams und SharePoint sichern

Kanäle, Dateien und Dokumentbibliotheken wiederherstellbar halten.

Teams Chat Backup

Persönliche Chats und Gruppenchats sichern und lesbar herausgeben.

Microsoft Planner Backup

Pläne, Buckets und einzelne Aufgaben sichern und zurückholen.

Backup oder Archivierung

Zwei verschiedene Aufgaben, und was das Gesetz jeweils verlangt.

GoBD-konforme Archivierung

Die gesetzliche Aufbewahrung, die ein Backup nicht erfüllt.

See the change plan against your own directory

We connect a test tenant and show the comparison between the backed up and today's state, before you decide.

Request a demoSee 365 Backup