Entra ID backup coverage

Entra ID Coverage Overview

Keepit offers the following Microsoft 365 Entra ID backup coverage:

• Entra ID Advanced: 
  Protects users, groups, administrative units, roles, service principals, app registrations, policies, devices, and activity logs. 

Keepit's legacy backup coverage:

• Entra ID Basic: 
  Protects users, groups, administrative units, roles, and activity logs.
• Entra ID Standard: 
  Protects users, groups, administrative units, and roles.

Supported Object Attributes

Each object (user, group, administrative unit, role, service principal, policy, and app registration) has a set of attributes that we protect. For the full list, go to Supported object attributes. 

Metadata Backup Scope

Metadata for objects can only be backed up and restored in relation to other objects included in the backup.

For instance, if a user is a member of 10 groups in Entra ID but only 5 of those groups are selected for backup in the connector configuration, the metadata of only those 5 groups will be backed up for the user. 

Object Metadata

Users

• Ownerships
• Memberships
• Manager
• Role assignments
• Licenses
• Photo

Groups

• Owners
• Members
• Memberships
• Role assignments
• Licenses
• Photo

Administrative Units

• Members
• Scoped-role assignments

Roles 

• Role assignments

App registrations

• Owners
• Photo

Service principals

• Owners
• Assignments
• Photo

Note: Ownerships, owners, memberships, members, managers, role assignments, or scoped-role assignments are relationships (links) an object has to another object. 

Additional data

Policies

• Conditional access policies
• Compliance policies
• Configuration profiles
• Authentication methods
• Authentication strengths
• Named locations
• Account protection policies
  

Backup limitations

• Due to API limitations, some types of configuration profiles cannot be backed up.
• We do not support the backup of configuration policies based on administrative templates. 

Devices

• BitLocker recovery keys
• Windows LAPS

Activity Logs

• Audit logs
• Sign-in logs

Note: Sign-in logs cannot be backed up without also backing up audit logs.