Entra ID Coverage Overview

Keepit offers the following Microsoft 365 Entra ID backup coverage:

  • Entra ID Advanced: 
    Protects users, groups, administrative units, roles, service principals    , app registrations, policies, devices, and activity logs.


Keepit's legacy backup coverage:

  • Entra ID Basic:
    Protects users, groups, administrative units, roles, and activity logs.
  • Entra ID Standard: 
    Protects users, groups, administrative units, and roles.


Supported Object Attributes

Each object (user, group, administrative unit, role, service principal, policy, and app registration) has a set of attributes that we protect. For the full list, go to Supported object attributes. 


Metadata Backup Scope

Metadata for objects can only be backed up and restored in relation to other objects included in the backup.

For instance, if a user is a member of 10 groups in Entra ID but only 5 of those groups are selected for backup in the connector configuration, the metadata of only those 5 groups will be backed up for the user. 

Entra ID Advanced

Object Metadata


Users

  • Ownerships
  • Memberships
  • Manager
  • Role assignments
  • Licenses
  • Photo


Groups

  • Owners
  • Members
  • Memberships
  • Role assignments
  • Licenses
  • Photo


Administrative Units

  • Members
  • Scoped-role assignments


Roles 

  • Role assignments

Note: Ownerships, owners, memberships, members, managers, role assignments, or scoped-role assignments are relationships (links) an object has to another object. 

App registrations

  • Owners
  • Photo


Service principals

  • Owners
  • Assignments
  • Photo


Additional data

Policies

  • Conditional access policies
  • Compliance policies
  • Configuration profiles
  • Authentication methods
  • Authentication strengths
  • Named locations
  • Account protection policies


Backup limitations

  • Due to API limitations, some types of configuration profiles cannot be backed up.
  • We do not support the backup of configuration policies based on administrative templates. 


Devices

  • BitLocker recovery keys
  • Windows LAPS


Activity Logs

  • Audit logs
  • Sign-in logs

Note: Sign-in logs cannot be backed up without also backing up audit logs.