Ask an incident responder what an identity attack looks like inside Entra ID and you will not hear "they deleted the users." You will hear about persistence: a conditional-access policy edited to exclude the attacker's session, a service principal handed a client secret, an OAuth consent grant that survives a password reset, a PIM eligibility added so privilege can be re-acquired on demand. The users are still there. The tenant is compromised anyway, because the thing that was manipulated is the policy graph.
That is why "back up Entra ID" cannot mean "export the users and groups." A recovery has to be able to see, and put back, the whole graph — and to remove what an attacker added without locking the tenant's own operators out in the process.
A directory is a graph of relationships
Objects in Entra ID reference each other. A conditional-access policy names groups and named locations. A role assignment points at a principal and a role definition. An app registration owns credentials and is paired with a service principal that carries the real permission grants. Restore an object without its references and you get an orphan; restore the references in the wrong order and the write fails. So a faithful backup captures a set of related types together — in our snapshot, thirty-three of them — spanning principals and access, PIM assignments and policy, conditional access and its inputs, app registrations and consent grants, tenant configuration, and device and endpoint management.
License-gated types, such as PIM without a P2 license, are recorded as not-applicable rather than as failures, and a permission-denied read is surfaced as a re-consent prompt rather than a silent gap. Delta-queried categories carry prior items forward, so a snapshot with no changes never shrinks.
Ranked drift is the detection surface
Capturing the graph on a schedule means any two snapshots can be compared — and the changes ranked. A deleted conditional-access policy or a newly created Global Administrator is CRITICAL; a modified CA policy is HIGH; a changed app registration, service principal, or PIM setting is MEDIUM; routine user, group, and device edits are LOW. In an active incident, that ranking is the difference between spotting the one persistence change and scrolling past it in a thousand routine edits.
Four ways to put an object back
From the recycle bin. Within Microsoft's 30-day window, a soft-deleted object is restored in place. The first thing to try.
Field-level. When a single attribute is wrong — a flipped account-enabled flag, a changed sign-in setting — you can revert that one field of that one object to its snapshot value without touching anything else.
Recreate from backup. When an object is hard-deleted or has aged past the recycle bin, it is rebuilt from the snapshot, with attributes, licenses, manager, and memberships re-applied and new identifiers remapped so the references still resolve.
Exact-state (destructive) rollback. When the problem is objects an attacker created, reverting means deleting what should not exist — so it is fenced. It is blocked outright while a legal hold is in force, it refuses to delete the last Global Administrator, and it refuses to delete a registered break-glass account. A recovery must not be able to lock you out of your own tenant.
Emergency-access accounts are a first-class object: registered, health-checked for MFA and sign-in alerts, password-rotated on a schedule, with credentials in escrow and an access log. That is what lets a destructive rollback safely refuse to touch them.
The boundary we are deliberate about
This is cloud identity protection — Entra ID — not on-premises Active Directory forest recovery. We capture the on-prem-reflected attributes Entra exposes on cloud objects so a recreate is faithful, but we do not back up domain controllers or rebuild an AD forest; that is a different discipline with its own specialists. What VentraID is built for is the tenant most US managed-service providers actually run: cloud-first, Entra-centered, changing daily, and sitting right beside the Microsoft 365 data already under backup — protected from one console, with drift you can rank and rollbacks that refuse to lock you out.