Microsoft Entra adds a seven-day safeguard against irreversible identity deletion

Microsoft has launched a new feature called Hard Deletion Protection in its Entra identity management platform, currently in preview. This tool provides administrators with a seven-day window to recover certain types of identities before they are permanently deleted. The feature aims to help organizations manage accidental or malicious deletions of important directory objects, offering a crucial safeguard to prevent irreversible loss.

The new Hard Deletion Protection feature is designed to support identities that are exclusively managed in the cloud, such as cloud-only users, groups, applications, and service principals. It also covers Entra Agent ID objects through their underlying identity types. Typically, Entra retains soft-deleted objects for a period of 30 days, during which administrators can restore them. However, objects can be permanently deleted before this period ends, cutting off the opportunity for recovery.

The feature works by blocking the permanent removal of an object during the first seven days after it has been soft-deleted. While it does not stop the initial deletion, which renders the object inactive and may disrupt related services, it offers a critical buffer period to reverse the process. If an object is restored within this window, the protection is reset, and any subsequent deletion would again trigger a new seven-day safeguard.

Microsoft has clarified that once an object is permanently deleted, it cannot be recovered using Entra's Backup and Recovery. Such objects must be recreated and reconfigured, which involves assigning new identifiers and re-establishing access relationships. To enable Hard Deletion Protection, administrators must have the Microsoft Entra Backup Administrator role and activate the feature through the Entra Admin center. This protection can be applied to up to 20 objects of a supported type per operation, and the activation is recorded in audit logs.

Administrators are advised to carefully review the objects they choose to protect, as once the feature is enabled, it cannot be disabled. If a protected object needs to be permanently deleted later, it must first undergo the soft deletion process, followed by the mandatory seven-day waiting period. Microsoft recommends using Entra audit logs to track deletion events and suggests exporting these logs to a security information and event management platform like Microsoft Sentinel for enhanced oversight.