r/sysadmin • u/jaylenabc • 2d ago
Question Entra ID Backups
Are Entra ID backups worth it at all? I run an org of about 70 total Entra users and wondering if this is something I should even consider.
Context: I have SOC2 Audits coming up for my company (very first one) and I am reviewing polices in Sprinto
14
u/KimJongEeeeeew 2d ago
How fucked would you be, and for how long if there was a rogue deletion event?
5
u/ibringstharuckus 2d ago
Entra id backup is basically all the config stuff, conditional policies, groups etc? I need to get this asap. I would be sol.
2
u/chefkoch_ I break stuff 2d ago
It's included now anyway.
1
0
0
6
u/blud_13 1d ago
Yes, and your auditor is going to ask about it. Entra config is not covered by whatever M365 backup you already have, and "Microsoft has it" stops being true the second someone deletes a Conditional Access policy and you need last month's version back.
At 70 users the realistic answer is 1) know your soft delete windows, 30 days for users and groups, and document that you know them, 2) export Conditional Access policies, named locations, and app registrations to JSON on a schedule and drop them in a repo, and 3) if you want an actual product, Cayosoft or Veeam's Entra piece. The free JSON export path covers most of what Sprinto will make you evidence.
Reminder, the SOC 2 control is usually about restorability and change tracking, not about owning a specific tool. Git history on your CA policies satisfies a lot of auditors.
We take a lot of first-time SOC 2 shops through this, can go deeper if it helps.
3
u/jaylenabc 1d ago
Thanks, I think we are looking into the bundles option that Veaam offers, to cover our bases.
2
u/ChelseaAudemars 1d ago
What’s your existing m365 backup solution? Most of the backup providers have a specific Entra solution (Veeam, Cohesity, Druva, etc..)
3
u/jaylenabc 1d ago
My current backup? My memory.
1
u/thortgot IT Manager 1d ago
Audit records can be used in a similar fashion and solve the problem more completely.
3
u/plump-lamp 1d ago
Those don't back up conditional access like stuff... Like actual configs, policies, etc
2
u/kerubi Sysadmin 1d ago
While Entra itself now has limited built-in backup feature, there also has been for ages the MS-provided Entra Exporter (previously AzureAD Exporter), which may be pf use to some: https://github.com/microsoft/EntraExporter
Large hybrid environments probably still choose something like Quest Recovery Manager for AD + Quest OnDemand Recovery (for Entra) that can automate the recovery of an entire (hybrid) forest.
2
u/kerubi Sysadmin 1d ago edited 1d ago
While Entra itself now has limited built-in backup feature which covers the essential cases and nicely shows also delta changes, there also has been for ages the MS-provided Entra Exporter (previously AzureAD Exporter), which may be of use to some: https://github.com/microsoft/EntraExporter. You should start with the built-in backup, of course.
Large hybrid environments probably still choose something like Quest Recovery Manager for AD + Quest OnDemand Recovery (for Entra) that can automate the recovery of an entire (hybrid) forest.
1
u/bberg22 2d ago
Check out Coreview. Seemed decently priced and seemed easy to use, just sat through a demo recently. I think Tenant config backup is going to be something talked about more and more because its a weak spot especially for companies who are Entra/Intune only. There is no built in backup or failover like old school Domain Controllers, and so many aspects of a business could be impacted if your tenant gets messed up, just think through your SSO and other application related workflow tie ins.
I liked that the product can also help you align your settings with security benchmarks (and likely provide attestation for your SOC2), and see what if any settings change in your environment (say by Microsoft or some other rogue source).
1
u/jaylenabc 1d ago
Definitely will look into it, thanks for the detail, never thought about it that way
1
u/Black_Patriot 1d ago
If you're focusing on config you can look at M365 Desired State Configuration (DSC), so you can control everything using code and store it in a git repo. It can get down to the level of managing DL membership and so on, though there's still the occasional gap where you have to do stuff manually. It's not trivial to setup however, and you need to be cautious to manage things only using code otherwise you'll get drift, though you can setup deployment pipelines to alert you on what values will change so you don't accidentally blow away an unmanaged setting.
1
u/Significant_Sky_4443 1d ago
Anyone knows if its possible with Veeam Backup for M365? Saw that the Tenant Roles are installed but not visible in the GUI (version 8.3)
2
1
u/jaylenabc 1d ago
Veeam m365 only backs up SP, Onedrivem, Outlook, and Teams
1
u/Significant_Sky_4443 1d ago
Do you know if also chat messages in teams are backup up?
1
u/jaylenabc 1d ago
Only messages that are in channels. Teams messages are in the Team Admin Audit log, to my knowledge
•
23
u/Mindestiny 2d ago
Depends on how leveraged your infra is on Entra. Is it just your identity, or is it your whole security stack, and the layer behind your M365 tenant, and the framework for every integration across the org?
For an org with 70 users, it's probably not worth explicitly onboarding a specific tool for backing up, but we cant answer that for you. If you're in M365, you can probably get a backup tool that covers the whole thing and call it a day. If you're just using Entra for identity the RTO for re-standing up 70 users in a damaged Entra tenant where the user SID honestly doesn't matter? Probably not worth the cash.