vambrisDeploy Solution
Back to Knowledge Base

Getting started with EIDGuard: deployment and your first backup

Applies to: EIDGuard for Microsoft Entra External ID

Microsoft Entra External ID has no first-party backup. EIDGuard fills that gap: it continuously exports your tenant's configuration — users, groups, apps, Conditional Access, user flows, identity providers, branding, and more — into versioned recovery points you can compare against and restore from, all from a web dashboard.

Setup is browser-based end to end: deploy from the Azure Marketplace, open the dashboard, and follow the wizard. No scripts, no command line. Plan for about 20 minutes.

What you'll need

Requirement Details
An Azure subscription Rights to deploy a Marketplace managed application (Contributor on the target subscription or resource group). EIDGuard's resources are created here, in your subscription.
A workforce-tenant administrator For the one-time first-run setup — the account needs permission to create app registrations in your organization's workforce tenant.
An administrator in each External ID tenant Tenant onboarding grants admin consent in the tenant being protected, so the signing-in account needs rights to create app registrations and consent there.

Step 1 — Deploy from the Azure Marketplace

Find EIDGuard in the Azure Marketplace and select Create. The portal wizard asks for everything up front:

  • Basics — subscription, region, and a name for the deployment.
  • Backup configuration — how often to back up (your recovery point objective), how long to keep recovery points, the email address for alerts, and whether to run nightly verification.
  • Networking (optional) — keep the default public configuration, or choose Private Link to keep all traffic on your virtual network.

Deployment takes a few minutes. Everything EIDGuard uses — Key Vault, backup storage, the automation engine, and the dashboard itself — is created inside a managed resource group in your subscription. Your backups never leave your environment, and the publisher's standing access is read-only, with any elevation requiring your explicit just-in-time approval.

Step 2 — First-run setup

When the deployment finishes, open its Outputs blade in the Azure portal. You'll find two values: the dashboard URL and a one-time setup key.

  1. Open the dashboard URL. Because no sign-in exists yet, EIDGuard shows the Set up EIDGuard screen.
  2. Paste the setup key and select Begin setup.
  3. Follow the device-code prompt: open the verification link, enter the code, and sign in with your workforce-tenant administrator account.

The wizard creates the dashboard's sign-in application in your tenant, grants your account the Admin role, and restarts the service with authentication enabled. The setup key is single-use and expires the moment setup completes. Nothing in this step is shared with the publisher.

Step 3 — Onboard your first External ID tenant

From the dashboard, open Tenants and enter the tenant you want to protect. EIDGuard walks through the onboarding steps on screen, live:

  1. Sign in to the tenant and consent to Graph access.
  2. Create the backup app (read-only) and the restore app (read-write).
  3. Grant their Microsoft Graph application permissions.
  4. Issue certificates inside Key Vault — private keys are born in your vault and never leave it; no secrets are ever downloaded to the browser.
  5. Attach the public certificates to the apps and start a validation backup.

When the validation backup completes, your first recovery point appears on the dashboard — proof the tenant is protected, not just configured. Repeat for each additional tenant; each one gets its own app pair and certificates.

Step 4 — Check the Overview

The Overview page now shows your protection posture at a glance: backup health per tenant, the latest recovery point and its age, certificate countdowns, and the next scheduled run (backups run automatically on the schedule you chose at deployment). Use Run backup in the header any time you want an immediate recovery point — before a change window, for example.

Add your team

Assign roles in the Azure portal under Microsoft Entra ID → Enterprise applications → EIDGuard → Users and groups:

Role Can
Viewer See the dashboard, browse recovery points and objects, read reports and job history.
Operator Everything Viewer can, plus run backups, comparisons, restore previews, and missing-only restores.
Admin Everything Operator can, plus overwrite (Full-mode) restores, certificate rotation, and settings.

Good to know

  • Backups can never change your tenant. They run as the read-only app created during onboarding. The read-write identity is used only when an Admin or Operator explicitly applies a restore.
  • Some material can't be exported by Microsoft Graph and is therefore not in any backup: user passwords, app client secrets and private keys, per-user MFA and passkey registrations, federation signing keys, and branding image binaries. See Restoring from a recovery point for how restores handle each of these.
  • Offboarding is built in. Removing a tenant from the Tenants page deletes the apps EIDGuard created in that tenant and disables its certificates — existing recovery points are kept.