Supported resource types
Every recovery point covers the Microsoft Entra External ID resource types below, read through Microsoft Graph with the tenant's read-only backup app. This page lists what is captured, which restore type in the restore wizard covers it, and what no backup can contain.
Identity and access#
| Resource | Captured with it | Restore type |
|---|---|---|
| Users | Identities, custom sign-up attribute values and extensions | Users |
| Groups | Members and owners | Groups |
| App registrations | Owners, federated identity credentials and extension properties | Applications |
| Enterprise applications (service principals) | App role assignments and OAuth2 permission grants | ServicePrincipals |
| Directory roles | Role assignments and custom role definitions | DirectoryRoles |
| Administrative units | Members and scoped role assignments | AdministrativeUnits |
Sign-in experience#
| Resource | Captured with it | Restore type |
|---|---|---|
| User flows | Linked applications | UserFlows |
| User flow attributes | Custom attribute definitions | UserFlowAttributes |
| Identity providers | Configuration (client secrets cannot be exported) | IdentityProviders |
| Custom authentication extensions | CustomAuthExtensions | |
| API connectors | Configuration (credentials are restored as placeholders) | ApiConnectors |
| Company branding | Localizations (logo and background images are not captured) | Branding |
Conditional Access#
| Resource | Notes | Restore type |
|---|---|---|
| Conditional Access policies | A policy the restore has to create is created disabled | ConditionalAccess |
| Named locations | ConditionalAccess | |
| Custom authentication strengths | ConditionalAccess | |
| Authentication context class references | ConditionalAccess |
Tenant policies and settings#
| Resource | Notes | Restore type |
|---|---|---|
| Authentication methods policy and authorization policy | Overwritten only in Full mode | Policies |
| Cross-tenant access policy | Default settings (Full mode only) and partner settings | Policies |
| Token lifetime and claims mapping policies | Recreated without their application assignments | Policies |
| Token issuance, home realm discovery and activity-based timeout policies | TenantPolicies | |
| App management policies | Including the tenant default | TenantPolicies |
| Permission grant policies | Including include and exclude sets | TenantPolicies |
| Feature rollout policies | Including the objects they apply to | TenantPolicies |
| Admin consent request policy | TenantPolicies | |
| Security defaults enforcement policy | TenantPolicies | |
| Group settings | Tenant-wide directory settings | GroupSettings |
Tenant-wide policies that exist exactly once per tenant (the authentication methods policy, the authorization policy, the cross-tenant access default settings, the default app management policy, the admin consent request policy and the security defaults enforcement policy) are overwritten only by a Full restore.
Captured for reference only#
These are in every recovery point, so you can browse and compare them, but they are not restored.
| Resource | Why |
|---|---|
| Organization settings | Captured for reference |
| Domains | Domain verification cannot be restored |
| Devices | Exported for audit; device trust cannot be restored |
What no backup contains#
Microsoft Graph does not export the following, so no backup of any kind contains them:
- user passwords
- application client secrets and certificate private keys
- per-user MFA and passkey registrations
- identity provider client secrets
- federation signing keys
- company branding image files
A restore recreates the affected objects without this data and lists the follow-up work. See What a restore cannot bring back.
Cloud availability#
User flows are backed up through the Microsoft Graph authentication events flow API, which is available only in the global Microsoft cloud. It is not available in Microsoft Azure Government or in Azure operated by 21Vianet. For the Graph permissions each app holds, see Permissions.