Backup for Microsoft Entra External ID
Microsoft keeps Entra External ID available, replicated and durable. What it does not keep is a restorable copy of your tenant's configuration. EIDGuard captures that configuration into versioned recovery points, held in storage inside your own Azure subscription.
What Microsoft keeps, and what it does not
Microsoft Entra soft-deletes a specific list of object types for 30 days. Everything outside that list is hard deleted the moment it is removed, Microsoft's own documentation states that hard-deleted items cannot be restored by your administrators or by Microsoft.
| Recoverable for 30 days | Hard deleted, no recycle bin |
|---|---|
| Users | User flows |
| Microsoft 365 Groups | Identity providers |
| Cloud security groups | Company branding |
| Application registrations | Custom user attributes |
| Service principals | API connectors |
| Administrative units | Authorization policy settings |
| Conditional Access policies | Claims mapping policies |
| Named locations | Terms of use documents |
What a recovery point contains
Every EIDGuard backup is a full point-in-time export rather than an increment, so any single recovery point is enough to restore from. It captures the objects that define how your customers sign in: users and groups, applications and service principals, Conditional Access policies, user flows, identity providers, branding, and custom attribute definitions.
Recovery points are written as versioned JSON into protected Azure Blob Storage in your subscription. You can browse the objects inside a recovery point before committing to it, and compare one against another to see exactly what changed between two dates.
Backups stay inside your tenant
- Deployed as an Azure managed applicationEIDGuard's resources are created in a managed resource group in your own subscription. Backup data never leaves your environment.
- Read-only collectionBackups run with tenant-approved permissions that cannot modify your configuration. Restores are a separate, deliberate action using a different identity.
- Credentials in your Key VaultAuthentication certificates live in a Key Vault inside your subscription, with expiry tracked on the dashboard and rotation as a single action.
How often backups run
Backups run on a schedule you choose at deployment, which sets your recovery point objective. Retention is configurable, and the dashboard shows whether every protected tenant has a recovery point within its RPO alongside the last 30 days of runs.
You can also take an on-demand backup at any time. The most useful moment is immediately before a planned configuration change: it turns a risky change window into a recoverable one, and gives you a precise before-and-after comparison afterwards.
Protect your tenant before you need to recover it.
Connect your Entra External ID tenant, set a schedule, and establish your first known-good recovery point.