Does Microsoft back up Microsoft Entra External ID?

Microsoft runs Entra External ID as a highly available, replicated service, but it does not keep a copy of your tenant's configuration that you can restore. Some deleted objects can be recovered for 30 days; most configuration cannot be recovered at all once it is deleted or changed. This article explains where that line falls.

Availability is not recoverability

Microsoft is responsible for keeping the service running. You are responsible for the configuration inside your tenant: user flows, identity providers, branding, applications, policies and users. Replication protects against the loss of a datacenter. It does not protect against a change made in your tenant, because the change is replicated too.

What Microsoft can recover: soft delete

When some object types are deleted, Microsoft Entra keeps them in a soft-deleted state for 30 days, with their properties, and you can restore them during that time. After 30 days they are deleted permanently.

According to Microsoft's Recover from deletions in Microsoft Entra ID, soft delete covers:

• users
• Microsoft 365 groups and cloud security groups
• application registrations and service principals
• administrative units

Microsoft's documentation also describes soft delete for Conditional Access policies and named locations, which are restored from Conditional Access > Deleted policies in the Microsoft Entra admin center. Microsoft updates this list over time, so check the current version of that article before you rely on it.

What Microsoft cannot recover: hard delete

Other object types are hard deleted: removed immediately, with no recycle bin. Microsoft's guidance is that hard-deleted items can't be restored by your administrators or by Microsoft, and must be re-created.

In an External ID tenant, much of the sign-in experience falls in this category, including:

• user flows
• identity providers
• company branding
• custom user attributes
• API connectors
• authentication methods and authorization policy settings
• token lifetime and claims mapping policies

Changes are not deletions

Soft delete applies only when an object is deleted. If an object is changed, for example a user flow loses an identity provider or a Conditional Access policy is turned off, nothing enters the recycle bin and the previous value is not kept. There is also no way to return an object, or a tenant, to its state on a given date.

Microsoft Entra Backup and Recovery

Microsoft Entra Backup and Recovery takes daily backups of supported objects in a tenant and can show differences and recover changes made within a short retention window. According to the Microsoft Entra Backup and Recovery overview, it requires a workforce tenant with Microsoft Entra ID P1 or P2: External ID tenants and Azure AD B2C tenants are not supported. It also cannot recover hard-deleted objects.

What to protect yourself

Microsoft's recoverability guidance recommends documenting the known-good state of your configuration, monitoring deletions in the audit log, and preparing to re-create what cannot be restored. For an External ID tenant, that means:

1. Know what you would have to rebuild: the user flows, identity providers, branding, attributes and policies your applications depend on.
2. Keep versioned copies of that configuration, taken often enough that the newest is close to current.
3. Detect unexpected changes quickly, since changes leave no trace in the recycle bin.
4. Be able to restore selectively, and to see what a restore would do before it runs.

EIDGuard does this from your own Azure subscription. See the EIDGuard documentation for how it works, and Plan disaster recovery for Microsoft Entra External ID for deciding what to protect and how often.