Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID

Recoverability Overview

27 June 2026Updated+15 / −8 lines

In brief

The impact of deletions depends on the object type.

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

The impact of deletions depends on the object type.

You can soft delete object types that include Users, Microsoft 365 Groups, cloud security groups, and applications can be soft deleted.applications. Soft-deleted items are sentgo to the Microsoft Entra ID recycle bin. While in the recycle bin, items aren't available for use. However,use, but they retain all their properties andproperties. You can be restored viarestore them with a Microsoft Graph API call or infrom the Azure portal. ItemsMicrosoft Entra admin center. If you don't restore items in the soft-delete state that aren't restored within 30 days are permanently, or hard, deleted.days, Microsoft Entra ID permanently hard-deletes them. Recover from deletions in Microsoft Entra ID provides a table of objects that support soft deletion.

Diagram that shows that users, Microsoft 365 Groups, cloud security groups, and applications are soft deleted and then hard deleted after 30 days.

For more information on misconfigurations and how to recover from them, see Recover from misconfigurations.

Unlike deletions, misconfigurations modify objects in place rather than moving them to the recycle bin. For supported affected object types, use Microsoft Entra Backup and Recovery difference reports to identify changed attributes and link edits. You can then run a recovery job to roll an object back to a previous state. For configurations that Microsoft Entra Backup and Recovery doesn't support, reapply settings from your documented known-good state.

Shared responsibility

Recoverability is a shared responsibility between Microsoft as your cloud service provider and your organization.

Document known good states

DocumentRegularly document and maintain the state of your tenant and its objects regularly. Then ifin an external versioned repository. If a hard delete or misconfiguration occurs, you have ayour documentation serves as your roadmap to recovery. The following tools

Select required APIs and export technology based on your deployed resources. Although you can help you document your current state:directly call resource-specific Microsoft Graph APIs, other Microsoft and non-Microsoft options can abstract and streamline configuration export and download processes.

  • Microsoft Graph APIsConfiguration snapshots—The snapshot APIs in unified tenant configuration management (TCM) APIs in Microsoft Graph simplify extracting current configurations across multiple workloads within a tenant (such as Microsoft Entra, Microsoft Intune, and Exchange Online). The tenant stores snapshots for seven days so that you can be used to export the current statedownload them for external retention. The TCM schema supports a subset of many Microsoft Entra configurations.resources and properties. Review the subset list to determine if TCM provides sufficient coverage rather than directly calling Microsoft Graph APIs.
  • Microsoft Entra Exporter is a tool you can use*Microsoft Graph APIs—Use Microsoft Graph APIs to regularly export configurations of all critical directory objects that TCM doesn't yet support. To export your configuration settings.settings, use the open-source tool, Microsoft Entra Exporter.
  • Tenant Configuration Management APIs in Microsoft Graph let you defineThird‑party solutions—To export, normalize, and store Microsoft Entra configurations in declarative formats, evaluate non-Microsoft configuration baselines, monitor tenants for drift,management and generate snapshotsinfrastructure‑as‑code tools. These solutions might abstract underlying APIs, simplify large‑scale configuration capture, and support repeatable comparison and settings reapplication as part of current settings. You can download snapshots as JSON files for reference or to restore many settings to a previous state.
  • Conditional Access APIs can be used to manage your Conditional Access policies as code.recovery workflows.

InStore configuration baselines in a version-controlled repository (such as Azure DevOps or GitHub) with a sufficient retention period. Logically separate and independently manage configuration extracts that you obtain using different capture mechanisms. For example, while TCM snapshots and direct Microsoft Graph API exports can contribute to an overall known good state, don't combine them, even when they have the rare casesame format (such as JSON). The reason is that an API is not available for a certainthe TCM snapshot scope limits them to supported resources and properties that you can't rely upon to recreate or reapply configuration setting, screenshot(s) can be taken to enable manual recovery.outside that supported scope.

Commonly used Microsoft Graph APIs

The Microsoft Entra audit log contains information on all delete and configuration operations performed in your tenant. We recommend that you export these logs to a security information and event management tool such as Microsoft Sentinel. You can also use Microsoft Graph to audit changes and build a custom solution to monitor differences over time. For more information on finding deleted items by using Microsoft Graph, see List deleted items - Microsoft Graph v1.0.

To identify changes for objects that Microsoft Entra Backup and Recovery supports, create a difference report. Difference reports complement audit logs and configuration snapshots by showing recoverable additions, attribute edits, link edits, and soft deletes since the last backup. Difference reports don't show hard-deleted objects.

Audit logs

The Audit log always records a "Delete <object>" event when an object in the tenant is removed from an active state, either from active to soft deleted or active to hard deleted.

:::image type="content" source="media/recoverability/deletions-audit-log.png" alt-text="Screenshot that shows Audit log detail." lightbox="media/recoverability/deletions-audit-log.png":::

A Delete event for object types that support soft delete (such as applications, service principals, users, Microsoft 365 Groups, and cloud security groups isgroups) indicates a soft delete. For any other object type, it'stypes, a Delete event is a hard delete.

Object type Activity in log Result

The Cross-tenant access activity workbookcan help you monitor which applications in external tenants your users are accessing and which applications in your tenant external users are accessing. Use this workbook to look for anomalous changes in either inbound or outbound application access across tenants.

Microsoft Entra Backup and Recovery is a built-in capability that provides the lowest-effort, highest-fidelity restore path for supported object types and configuration changes within its retention window. Microsoft Entra Backup and Recovery supports a set of tenant object types and recoverable properties. It automatically creates backups of supported objects at Microsoft-defined fixed intervals. You can view available backups, create difference reports, recovery objects, and review recovery history.

Operational security

Preventing unwanted changes is far less difficult than needing to re-create and reconfigure objects. Include the following tasks in your change management processes to minimize accidents: