Why does Microsoft Entra ID require a dedicated backup solution?

Microsoft Entra ID (formerly Azure Active Directory) is critical infrastructure that controls access to all organizational systems and data, yet Microsoft does not provide native long-term backup or granular restore capabilities for identity objects. Microsoft's built-in recycle bin retains deleted objects for only 30 days and does not protect against accidental or malicious bulk deletion of users, groups, or conditional access policies. A dedicated backup solution ensures that identity data can be recovered to any point in time, protecting against ransomware attacks, administrative errors, and insider threats affecting directory services.

What is the difference between Veeam Data Cloud for Entra ID and Veeam Backup for Microsoft Entra ID?

Veeam Data Cloud for Entra ID is a fully managed SaaS solution where Veeam handles the backup infrastructure, storage, and service maintenance, making it accessible without requiring the organization to deploy any on-premises components. Veeam Backup for Microsoft Entra ID is a self-managed solution that organizations deploy in their own environment with full control over storage location, retention policies, and infrastructure. The SaaS model provides faster time to protection and lower administrative overhead, while the self-managed option offers greater control for organizations with specific data sovereignty or compliance requirements.

What Entra ID objects and data can be protected and restored using Veeam's solution?

Veeam's Entra ID backup solution protects all directory object types including user accounts, groups, service principals, application registrations, conditional access policies, role assignments, and administrative unit memberships. Granular restore allows recovery of individual objects or attributes rather than requiring a full tenant restore, which would affect all users simultaneously. This granularity enables rapid recovery of accidental attribute changes or deletions without disrupting the broader organization's identity and access management environment.

What compliance and governance requirements support the need for Entra ID backup?

NIS2 and ISO 27001 both require organizations to protect critical IT systems and ensure recovery capabilities for all essential infrastructure, which includes identity management systems. DORA specifically requires financial institutions to maintain recovery capabilities for operational systems within defined recovery time objectives. Entra ID as the foundation of all identity and access management in Microsoft environments qualifies as critical infrastructure under all these frameworks, making its protection a compliance obligation rather than just a best practice.

Veeam Data Cloud for Microsoft Entra ID

Microsoft Entra ID is a critical IT infrastructure element, and its protection requires a dedicated backup solution. Veeam offers two approaches: Veeam Data Cloud (SaaS) and Veeam Backup for Microsoft Entra ID (self-managed). In this article, we’ll present a comprehensive guide to both options, with special focus on the SaaS model.

Quick Navigation

Veeam Data Cloud vs Veeam Backup - which option is for you?
Veeam Data Cloud for Entra ID Architecture
What does Veeam protect for Entra ID?
Key solution features
Step-by-step deployment process
Integration with Veeam Backup for Microsoft 365
Licensing and packages
Best practices and recommendations

Veeam Data Cloud vs Veeam Backup - which option is for you?

Veeam offers two Entra ID protection deployment models:

Veeam Data Cloud for Microsoft Entra ID (SaaS)

Aspect	Description
Model	Backup-as-a-Service
Infrastructure	Managed by Veeam
Storage	Unlimited, included
Maintenance	Updates and security patches by Veeam
Deployment	Zero infrastructure - web browser
Ideal for	Organizations preferring SaaS

Veeam Backup for Microsoft Entra ID (self-managed)

Aspect	Description
Model	Self-managed software
Infrastructure	Own - on-prem or cloud VM
Storage	Own - disk, NAS, object storage
Maintenance	Your responsibility
Deployment	Windows Server
Ideal for	Organizations with own data center

How to choose?

Choose Veeam Data Cloud when:

You prefer a SaaS model without infrastructure management
You want predictable costs (unlimited storage included)
You don’t have a team to manage backup
You already use Veeam Data Cloud for Microsoft 365

Choose Veeam Backup (self-managed) when:

You have data residency requirements for a specific location
You prefer full control over infrastructure
You already have Veeam Data Platform and want integration
You use Veeam Universal License (VUL)

📚 Read the complete guide: Backup: Zasada 3-2-1 i najlepsze praktyki backupu

Veeam Data Cloud for Entra ID Architecture

Solution components

┌─────────────────────────────────────────────────────────────┐
│                    Veeam Data Cloud Platform                │
├─────────────────────────────────────────────────────────────┤
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐    │
│  │   M365   │  │ Entra ID │  │  Azure   │  │Salesforce│    │
│  └──────────┘  └──────────┘  └──────────┘  └──────────┘    │
├─────────────────────────────────────────────────────────────┤
│  Shared Services:                                           │
│  • Backup/Restore  • AI Acceleration  • Actionable Insights │
│  • Embedded Security  • Operational Excellence              │
├─────────────────────────────────────────────────────────────┤
│  Cloud-native SaaS Platform (Microsoft Azure)               │
│  • Unlimited Storage  • Built-in Redundancy                 │
│  • Data Sovereignty (region selection)                       │
└─────────────────────────────────────────────────────────────┘

Data flow

Authentication: OAuth 2.0 to Microsoft Entra ID
Backup: Scheduled or on-demand backup of objects and logs
Storage: Encrypted storage in selected region
Restore: Granular restore through web console

Security

Encryption at rest (AES-256)
Encryption in transit (TLS 1.3)
OAuth 2.0 authentication
RBAC - role-based access control
Audit logging of all operations
Data sovereignty - EU/US region selection

What does Veeam protect for Entra ID?

Objects

Object	Backup	Restore	Notes
Users	✓	✓	All attributes, including custom
Groups	✓	✓	Security, M365, Dynamic groups
Group memberships	✓	✓	Membership recovery
App Registrations	✓	✓	Critical - no native Recycle Bin
Service Principals	✓	✓	Enterprise applications
Administrative Units	✓	✓	Delegated administration
Role assignments	✓	✓	RBAC assignments

Logs

Log type	Microsoft retention	Veeam
Sign-in logs	30 days (P1/P2)	Unlimited
Audit logs	30 days (P1/P2)	Unlimited
Provisioning logs	30 days	Unlimited

Long-term log retention is key for:

DORA compliance
NIS2 requirements
Forensic investigations
Security audits

Key solution features

Accelerated Change Detection

One of Veeam’s unique features - the ability to quickly compare the current tenant state with backup:

Use cases:

Identify changes after a security incident
Detect unauthorized modifications
Forensic investigation - what changed and when
Audit trail for compliance

How it works:

Veeam compares objects in the tenant with the latest backup
Displays differences: added, deleted, modified objects
Ability to drill-down to attribute level
One-click restore of selected changes

Granular Restore Options

Veeam enables precise recovery:

User restore:

Entire user with all attributes
Single attributes (e.g., department, manager)
Group memberships
Role assignments

Group restore:

Entire group with members
Membership only (to existing group)
Group attributes

App Registration restore:

Full registration with credentials (secrets)
Permissions (API permissions)
Reply URLs
Owners

Automated Backup Scheduling

Backup schedule configuration:

Frequency: every 1, 2, 4, 6, 8, 12 or 24 hours
Full vs incremental: automatic management
Retention: configurable retention policy
Notifications: email alerts about status

Data Sovereignty

Choice of data storage region:

EU - for European organizations (GDPR)
US - for American organizations
Other regions - depending on availability

Step-by-step deployment process

Step 1: Preparation

Prerequisites:

Veeam Data Cloud account
Global Administrator in Entra ID tenant (for initial consent)
Decision on data storage region

Planning:

Define RTO/RPO for Entra ID
Backup retention policy
Log retention policy

Step 2: Connection configuration

Log in to Veeam Data Cloud console
Select “Add Organization” → Microsoft Entra ID
Log in as Global Admin to the tenant
Approve required permissions for Veeam
Select data storage region

Required permissions:

Directory.Read.All
AuditLog.Read.All
User.Read.All
Group.Read.All
Application.Read.All

Step 3: Backup job configuration

Create a new backup job
Configure schedule (recommended: every 4-8h)
Enable log backup (sign-in, audit, provisioning)
Configure retention policy
Configure email notifications

Step 4: Verification

Run first backup manually
Verify all objects are protected
Conduct test restore (e.g., single user)
Document procedures

Integration with Veeam Backup for Microsoft 365

Veeam Data Cloud is a unified platform - one interface for backup of:

Microsoft 365 (Exchange, SharePoint, OneDrive, Teams)
Microsoft Entra ID

Integration benefits

Unified management:

One management portal
Consistent retention policies
Consolidated reporting
Single pane of glass

Cross-workload protection:

Shared responsibility model applies to both
Consistent approach to data protection
Easier compliance reporting

Bundles and promotions:

Possible discounts when purchasing both workloads
Simplified licensing

Migration from existing M365 backup

If you already use Veeam Data Cloud for Microsoft 365:

Add Entra ID as a new workload
Configure backup job
No additional infrastructure required
Storage is shared (but logically separated)

Licensing and packages

Veeam Data Cloud for Entra ID

Model: Per-user subscription
Billing: Monthly or annual
Storage: Unlimited, included
Minimum: Depends on current offer

Veeam Backup for Entra ID (self-managed)

Option 1: Standalone

Per-user licensing
1-5 year subscriptions
Foundation Edition: Object backup
Advanced/Premium: Object + Sign-in/Audit logs

Option 2: As part of Veeam Data Platform

Veeam Universal License (VUL)
1 VUL instance = 10 Entra ID users
Sold in packs of 10
Foundation/Advanced/Premium tiers

Option 3: VCSP (for partners)

Rental SKU through Veeam Cloud & Service Provider
10 points per 10 Entra ID users
Enterprise Plus Edition for audit/sign-in logs

Best practices and recommendations

Backup schedule

Organization type	Recommended schedule	RPO
Enterprise (1000+ users)	Every 4 hours	4h
Mid-market (100-1000)	Every 6-8 hours	6-8h
SMB (<100 users)	Every 12-24 hours	12-24h

Retention

Recommendations:

Objects: minimum 1 year
Sign-in logs: minimum 2 years (compliance)
Audit logs: minimum 2 years (compliance)

Monitoring and alerting

Configure alerts for:

Failed backup jobs
Unusual change detection (high number of changes)
Storage utilization (for self-managed)
Restore operations

Restore testing

Test schedule:

Monthly: test single user restore
Quarterly: test group and App Registration restore
Annually: full DR test (full tenant simulation)

Documentation

Document:

Backup architecture
Retention policies
Restore procedures
Runbooks for incident response
Roles and responsibilities

Summary

Veeam Data Cloud for Microsoft Entra ID is a mature, enterprise-ready solution for digital identity protection. Key benefits:

For organizations:

Critical IAM infrastructure protection
Compliance with regulations (DORA, NIS2, GDPR)
Fast recovery after incidents
Forensic and audit capabilities

For IT:

Zero infrastructure management (SaaS)
Unified platform with M365 backup
Accelerated change detection
Granular restore options

For security:

Point-in-time restore
Long-term log retention
Change tracking and alerting
Incident investigation support

Need help deploying Veeam Backup for Entra ID? As a Veeam partner, we offer comprehensive services: from assessment through deployment to operational support. Contact us to discuss details.

Learn key terms related to this article in our cybersecurity glossary:

CSPM (Cloud Security Posture Management) — CSPM (Cloud Security Posture Management) is a category of cloud security tools…
Cloud Environment Security — Cloud environment security refers to the technologies, procedures, policies,…
Cloud Data Protection — Cloud data protection refers to a set of practices, technologies, and policies…
Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…

Learn More

Explore related articles in our knowledge base:

Explore Our Services

Need cybersecurity support? Check out:

Cloud Security Audit - cloud environment security assessment
AWS Migration - secure cloud migration
AWS Management - comprehensive AWS services

Explore Our Products

Solutions mentioned in this article that can help protect your organization:

Veeam Data Cloud for Microsoft Entra ID — Veeam
Veeam Backup for Microsoft 365 — Veeam
Veeam Data Platform — Veeam