Two answers to “can we undo this?”

Microsoft Entra Backup and Recovery is now in public preview, and it changes the conversation about Entra ID backup. For the first time, Microsoft provides a native, always-on safety net that backs up supported directory objects daily and can recover them from the Entra admin centre. So where does a third-party tool such as EntraExportRestore still fit?

The short answer: they protect different moments. Microsoft’s feature is reactive — it recovers from yesterday’s automatic backup after something has gone wrong. EntraExportRestore is proactive — it captures a snapshot of exactly the attributes you choose, immediately before a planned change, stored locally for as long as you need it.

What Microsoft Entra Backup and Recovery provides

The preview (available with Microsoft Entra ID P1 or P2 licences) is built around a simple model:

• Automatic daily backup — one snapshot of supported tenant objects per day, taken by Microsoft. Administrators cannot change the schedule, and the backups cannot be disabled, edited, or deleted.
• Five-day retention — each backup is available for up to five days from its timestamp.
• Broad object scope — users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, and authentication and authorisation policies.
• Difference reports — compare a backup against the live tenant state and review changed objects, with old-versus-current attribute values.
• Recovery jobs — restore all changes, a single object type, or an individual object ID. Added objects are soft-deleted, updated objects are reverted, and soft-deleted objects are restored.

Recovery requires the Microsoft Entra Backup Administrator role, runs one job at a time, and is scoped to workforce tenants. On-premises synchronised objects are excluded — their source of authority remains on-premises Active Directory.

What EntraExportRestore does differently

EntraExportRestore is an attribute-level backup and restore tool for Entra ID, built around administrator-controlled snapshots rather than a fixed platform schedule:

• Pre-change snapshots — export on demand or on your own schedule, typically minutes before a bulk PowerShell script, Microsoft Graph job, provisioning run, or delegated-admin change.
• Retention you control — snapshots live in a local SQLite database on your Windows host. Keep them for a week or a year; copy the file off-host for audit history beyond Microsoft’s five-day window.
• Attribute-level selection — an attribute catalog defines what is exportable, restorable, and sensitive. You choose object types and individual attributes; restore previews every value before anything is written back through Microsoft Graph.
• Difference report export — compare a snapshot against live Graph data and export the result as HTML, JSON, or CSV for audit evidence or automation pipelines.
• CLI automation — scripted export, restore preview, and restore with documented exit codes and structured JSON output, suitable for scheduled tasks and orchestration.
• Local-first security model — no vendor-operated service holds your directory data; authentication uses your tenant’s Graph permissions, with support for customer-owned app registrations and certificate auth.

Its object scope is deliberately operational: users, groups, devices, organisational contacts, named locations, and Conditional Access policies. It does not cover applications, service principals, or managed identities — for those, use Microsoft’s native backup.

At a glance

When to use which

Match the control to the failure mode:

• Yesterday’s mistake, discovered today — Microsoft’s daily backup is your best starting point, provided you are inside the five-day retention window.
• A bulk change you are about to run — take an EntraExportRestore snapshot first. The native backup may be up to 24 hours old and will not reflect the state immediately before your change.
• A change discovered weeks later — only a snapshot you retained yourself can help; the native window will have closed.
• Application or service principal recovery — Microsoft’s preview covers these object classes; EntraExportRestore does not.
• Scheduled exports feeding a pipeline — the EntraExportRestore CLI produces structured JSON and difference reports suited to automation and SIEM ingestion.
• Reverting one attribute on thousands of users — attribute-level restore with preview avoids touching anything else on the object.

Using them together

A practical layered workflow for identity teams:

• Leave Microsoft Entra Backup and Recovery on (it cannot be disabled) and confirm your team holds the Backup Administrator role and knows the recovery procedure.
• Add a pre-change snapshot step to your bulk-change runbook: export the affected object types and attributes with EntraExportRestore, record the snapshot ID, and only then run the change.
• After the change, run a restore preview or difference report against the snapshot to verify the change did what was intended — and keep the report as audit evidence.
• Copy snapshot databases off-host on a schedule if your retention or compliance requirements exceed five days.

Limits both share

Neither approach replaces a tenant-wide disaster-recovery programme, and neither restores on-premises synchronised attributes — those are governed by the source of authority and must be corrected in on-premises Active Directory. Hard-deleted objects are out of scope for both. Microsoft’s feature is preview-licensed under its preview terms; validate behaviour in your tenant before relying on either tool in an incident.