Microsoft Entra ID Backup

Veeam Data Cloud for Microsoft Entra ID takes the complexity out of data protection for your Entra ID tenant. This SaaS backup solution provides comprehensive backup and restore for Entra ID users, groups, application registrations and other objects. Discover the power of an all-in-one cloud service — with unlimited storage included — built within a modern, unified UI for a seamless user experience.

Microsoft operates on a shared responsibility model: while Microsoft secures the cloud infrastructure, customers are responsible for protecting their identity and configuration data. According to the Microsoft Digital Defense Report 2024, identity compromise remains one of the most prevalent cloud attack vectors, often driven by token theft, phishing-resistant MFA bypasses, and misconfigured Conditional Access policies.

Veeam Data Cloud for Microsoft Entra ID mitigates this by continuously backing up users, groups, directory roles, application registrations, and device settings, enabling quick restoration after accidental deletion, ransomware, or policy corruption. 

Learn more about the Entra ID Shared Responsibility Model and the 6 Reasons for Microsoft Entra ID Backup.

Veeam Data Cloud backs up the mission-critical Entra ID objects that form the foundation of identity management, including:

• Users including user profiles and directory attributes.
• Groups including Microsoft 365 Groups, security groups, dynamic groups, and group properties. 
• Group memberships including nested groups, user members, owners, and administrative unit memberships. 
• Directory roles and role assignments including built-in and custom directory roles. 
• Applications and service principals including application objects, service principals, and app role assignments. 
• Conditional Access policies when the required Microsoft Graph permissions are enabled. 
• Administrative units including administrative unit objects and their memberships. 
• Directory settings including B2B collaboration, self-service password reset, access reviews, and other tenant-level configuration. 
• Audit logs and sign-in logs which can be exported for investigation and compliance needs. 
• Intune policies including configuration profiles, compliance policies, app protection policies, enrollment restrictions, device categories, filters, and other supported Intune policy types when Intune protection is enabled.

These are stored using native Microsoft Graph APIs for data consistency and recoverability, mirroring the structure of your live tenant to ensure minimal reconfiguration during recovery. For more details, visit the Veeam Data Cloud for Microsoft Entra ID User Guide.

Veeam Data Cloud connects securely to your Microsoft tenant using Microsoft Graph API with least-privilege authentication. It captures and encrypts Entra ID metadata in Azure Storage, allowing for recovery directly through a web console or export for audit review.

All operations are managed within Veeam’s SaaS infrastructure — no agents or on-prem components required. The system uses incremental backups and retention tiering to optimize performance, following best practices similar to those outlined in Microsoft 365 Backup Best Practices. 

Try our Interactive Walkthrough to see it in action.

Veeam Data Cloud utilizes Azure Storage to safeguard your Microsoft Entra ID backup data. Your data residency, regulatory compliance requirements, and performance optimization needs often dictate where your organization's data can be stored. With Veeam, you can choose your preferred Azure data region, ensuring that you can meet your specific data location requirements. 

If you’re an EU customer, you can choose a datacenter location within Microsoft’s EU Data Boundary, ensuring that data stays within Europe and maintains European regulatory standards for data integrity, security and privacy.  

In addition to location choice, Azure storage offers world-class resiliency and service-level immutability. Veeam Data Cloud provides zone-redundant storage (ZRS), which is replicated three times within a single data center in the primary region and cannot be altered or deleted. When bundled with Microsoft 365 in Veeam Data Cloud for Microsoft 365 Premium, you can reduce the risk of data loss by meeting the industry standard 3-2-1 rules of data protection best practices with redundant copies of data stored on two separate media and one in a separate location.  
 
For more information, check out our user guide. 

Veeam Data Cloud automatically performs daily backups, retaining copies per your configured policy. Incremental backups ensure changes to roles, groups, or policies are quickly captured, minimizing recovery point objectives (RPOs).

For administrators managing critical access systems, aligning backup frequency with your identity update cycles ensures protection against accidental misconfigurations or malicious privilege escalation attempts. 

Yes. Built on Microsoft Azure infrastructure, Veeam Data Cloud meets ISO/IEC 27001, SOC 2 Type II, and GDPR standards. Data is encrypted both in transit and at rest, and customers can choose Azure regions within or outside the EU Data Boundary for data residency compliance.

The Microsoft Digital Defense Report emphasizes that “data security accountability is increasingly central” to modern cybersecurity — Veeam helps organizations operationalize that accountability by offering immutable storage and fine-grained retention controls. 

See more at the Veeam Trust Center.

Yes. Veeam Data Cloud for Microsoft Entra ID offers special licensing for Microsoft 365 Education tenants. For every paid faculty user license, you can protect up to six student users at no additional cost. This 1:6 ratio provides flexible coverage for both staff and student accounts under a single plan.

For detailed pricing or to confirm eligibility, please contact Veeam Sales. 

Veeam takes a zero-trust approach to ensure the security of your data, including but not limited to encrypting data in transit and at rest, always using multi-factor authentication, and having strict security controls for users and administrators.

Veeam Data Cloud for Microsoft Entra ID includes service-level immutability capabilities on the primary backup, at no additional cost to the customer, based on how the data is protected.

Once the data is backed up, it cannot be altered, tampered with, or deleted by users, including administrators or attackers.

Veeam ensures end-to-end encryption, role-based access control (RBAC), and immutable storage, protecting identity data from cyber threats.

To explore deployment options and pricing tailored to your needs, click the link below:
https://www.veeam.com/products/veeam-data-cloud/purchasing-options.html#entra-tab

Yes. Veeam Data Cloud for Microsoft Entra ID offers special licensing for Microsoft 365 Education tenants. For every paid faculty user license, you can protect up to six student users at no additional cost. This 1:6 ratio provides flexible coverage for both staff and student accounts under a single plan.

For detailed pricing or to confirm eligibility, please contact Veeam Sales.