1555 - Supported Entra ID object attributes and recovery limitations

This article contains links to lists of the object attributes and relationships that are protected as part of Entra ID. 

Supported attributes and relationships, by object:

• Admin units
• App registrations
• Authentication method policies
• Conditional Access policies
• Enterprise applications
• Groups
• Intune device compliance policies
• Roles
• Users

Limitations of Entra ID object recovery

• Whenever you recover Entra ID objects in the RedApp, you may be asked to re-authenticate with Microsoft.
• If a group without an owner is deleted, the group can be recovered from the Entra ID admin centre, but not from the RedApp, unless you select a restore point at which the group had an owner assigned to it.
• If a global administrator user is soft-deleted, the user can be recovered from the Entra ID admin centre, but not from the RedApp.
• If a user with a user principal name that matches another active user is soft-deleted, the user can be recovered from the Entra ID admin centre, but not from the RedApp.
• Some objects in Entra (specifically users, groups and admin units) can be either soft-deleted or hard-deleted. All other objects can only be hard-deleted.
  • Recovering a soft deletion entails taking the same deleted object out of the Recycle Bin and returning it to its original location.
  • Recovering a hard deletion entails creating a new object (a copy of the object from before deletion) and substituting this for the deleted object in the original location. In the RedApp, the original object will be greyed out and shown as deleted alongside the new object with the same name. Restored hard-deleted objects will have a new ID and creation time. Read more on Microsoft's knowledge base here.
• With regard to relationships, we backup and recover only the supported relationships listed here.
• Recovery is not supported for mail-enabled security groups and mail distribution groups.
• Dynamic groups are backed up, but cannot be recovered.