#Microsoft Entra ID

The backup service for Microsoft Entra ID supports protecting the app registrations, enterprise applications, administrative units, roles and administrators, groups, users, device – bitLocker recovery keys, audit logs, and sign-in logs.

Microsoft Entra ID data recovery supports restoring the app registrations, enterprise applications, administrative units, and roles and administrators to the original location. It also supports restoring groups and users to the original location or to a new location. Refer to the tables below for supported and unsupported components and attributes of the object types you can protect in the Microsoft Entra ID.

Microsoft Entra ID service supports protecting the Device – BitLocker Recovery Keys. You can copy the BitLocker key from the backup. After December 2023 release, the Microsoft Entra ID service can also protect the extension attributes of the following objects: Users, Groups, Administrative Units, App Registrations, and Devices.

#App Registration

Refer to the table below for the data recovery state for app registrations:

• The Photo and Secrets cannot be kept. The restore job will generate new secrets and key IDs and will record the information in the job report.

• The Created date and the Created on behalf of cannot be restored.

Component	Details
Branding	Supported
Authentication	Supported
Certificates	Supported
Client secrets	Supported
Federated credentials	Supported
Token configuration	Supported
API permissions	Partially Supported *Note : The API grant status is currently unsupported. *Note: In the data center operated by 21Vianet in China, the existing API permissions are supported. The API permissions that are temporarily or permanently deleted are partially supported.
Expose an API	Supported
App roles	Supported
Owners	Supported
Roles and administrators	Unsupported
Manifest	Unsupported
Extension attributes	Supported *Note : Extensions attributes are unsupported in the data center operated by 21Vianet in China.

#Object Attributes

Attribute	Standard Entra ID	Entra ID Express	Comment
publisherDomain	Supported	Supported
requiredResourceAccess	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
signInAudience	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
spa	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
tags	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
tokenEncryptionKeyId	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
verifiedPublisher	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
web	Supported	Unsupported
createdOnBehalfOf	Unsupported	Unsupported
publicClient	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
passwordCredentials	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
parentalControlSettings	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
optionalClaims	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
addIns	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
api	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
appId	Partially Supported	Unsupported	The appId can be kept if the app has not yet been permanently deleted from your Microsoft Entra tenant. In 21v environment, the existing attribute is a read-only property. The attribute that is temporarily or permanently deleted is unsupported.
applicationTemplateId	Unsupported	Unsupported
createdDateTime	Partially Supported	Unsupported	The createdDateTime can be kept if the app has not yet been permanently deleted from your Microsoft Entra tenant. In 21v environment, the existing attribute is a read-only property. The attribute that is temporarily deleted is supported. The attribute that is permanently deleted is unsupported.
description	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
disabledByMicrosoftStatus	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
identifierUris	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
info	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
isDeviceOnlyAuthSupported	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
isFallbackPublicClient	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
keyCredentials	Unsupported	Supported
notes	Supported	Supported
groupMembershipClaims	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
Name	Supported	Supported
Logo	Supported	Unsupported
Home page URL	Supported	Unsupported
Terms of service URL	Supported	Unsupported
Privacy statement URL	Supported	Unsupported
Service management reference	Unsupported	Supported
OAuth 2.0 authorization endpoint (v2)	Unsupported	Unsupported
OAuth 2.0 token endpoint (v2)	Unsupported	Unsupported
OAuth 2.0 authorization endpoint (v1)	Unsupported	Unsupported
OAuth 2.0 token endpoint (v1)	Unsupported	Unsupported
OpenID Connect metadata document	Unsupported	Unsupported
Microsoft Graph API endpoint	Unsupported	Unsupported
Federation metadata document	Unsupported	Unsupported
WS-Federation sign-on endpoint	Unsupported	Unsupported
SAML-P sign-on endpoint	Unsupported	Unsupported
SAML-P sign-out endpoint	Unsupported	Unsupported

#Enterprise Application/Service Principal

Refer to the table below for the data recovery state for enterprise applications:

Note that the following properties cannot be restored:

• App owner organization ID

• Sign-in audience

• Key credentials

• Oauth2 permission scope

Component	Details
Properties	Supported
Owners	Supported
Roles and administrators	Unsupported
Users and groups	Supported
Single sign-on	Supported
Provisioning	Supported *Note : Provisioning is unsupported in the data center operated by 21Vianet in China.
Application proxy	Unsupported
Self-service	Unsupported

#Object Attributes

Attribute	Standard Entra ID	Entra ID Express	Comment
accountEnabled	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
addIns	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
alternativeNames	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
appDescription	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
appId	Supported	Unsupported	The attribute is a read-only property in the data center operated by 21Vianet in China.
applicationTemplateId	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
appOwnerOrganizationId	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
appRoleAssignmentRequired	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
description	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
disabledByMicrosoftStatus	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
homepage	Supported	Unsupported
keyCredentials	Partially Supported	Unsupported	The attribute relates to the SSO configuration of the enterprise application. If the enterprise application has not yet been permanently deleted, the setting can be restored. Otherwise, you have to choose to allow AvePoint to generate a certificate for SSO configuration or import the certificate manually while configuring restore settings. The attribute is unsupported in the data center operated by 21Vianet in China.
loginUrl	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
logoutUrl	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
notificationEmailAddresses	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
oauth2PermissionScopes	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
passwordCredentials	Partially Supported	Unsupported	The passwordCredentials can be kept if the app has not yet been permanently deleted from your Microsoft Entra tenant. The attribute is unsupported in the data center operated by 21Vianet in China.
preferredSingleSignOnMode	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
preferredTokenSigningKeyThumbprint	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
replyUrls	Supported	Unsupported
samlSingleSignOnSettings	Supported	Supported
servicePrincipalNames	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
servicePrincipalType	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
signInAudience	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
ServicePrincipalTag	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
tokenEncryptionKeyId	Supported	Unsupported
ServicePrincipalName	Supported	Supported
Object ID	Partially Supported	Unsupported	The object ID can be kept if the app has not yet been permanently deleted from your Microsoft Entra tenant. In the data center operated by 21Vianet in China, the object ID is a read-only property. The object IDs that are temporarily deleted can be restored. The object IDs that are permanently deleted cannot be restored.
Enabled for users to sign-in	Supported	Unsupported
Logo	Supported	Unsupported
Assignment required	Supported	Unsupported
Visible to users	Supported	Unsupported
Notes	Supported	Supported
Permission	Partially Supported	Unsupported	The admin consented permissions can be kept if the app has not yet been permanently deleted from your Microsoft Entra tenant.

#Administrative Units

Data Type	Status
Properties	Supported
Users	Supported
Groups	Supported
Devices	Supported
Roles and administrators	Unsupported
Extension attributes	Supported *Note : Extension attributes are unsupported in the data center operated by 21Vianet in China.
membershipRule	Supported *Note : The membershipRule is unsupported in the data center operated by 21Vianet in China.
membershipType	Supported *Note: The membershipType is unsupported in the data center operated by 21Vianet in China.
membershipRuleProcessingState	Supported *Note: The membershipRuleProcessingState is unsupported in the data center operated by 21Vianet in China.

#Object Attribute

Attribute	Status
Description	Supported
Visibility	Supported *Note: The attribute is unsupported in the data center operated by 21Vianet in China.

#Roles and Administrators

Object Type	Status
Assignment	Supported *Note: Currently, only the eligible assignments and active assignments are supported. The expired assignments are unsupported.
Description	Supported
Role settings	Supported

#Object Attributes

Attributes	Status
description	Supported
isBuiltIn	Supported
isEnabled	Supported
rolePermissions	Supported
templateId	Partially Supported *Note: The templateId can be kept if the roles and administrators have not yet been permanently deleted from your Microsoft Entra tenant.
version	Supported
visibility	Supported

#Groups

Refer to the table below for the data recovery state for groups:

• The backup service for Microsoft Entra ID can protect the following types of Microsoft Entra groups: Microsoft 365 Group, Distribution List, Security Group, and Mail-Enabled Security Group.

• The Microsoft 365 Groups with dynamic users are supported, but the Dynamic distribution group type is not supported.

• The Phone, Mail, and Sensitivity Label cannot be restored.

• The assigned labels cannot be restored.

• The created time and expiration time cannot be kept.

• If the group is synchronized from the on-premises active directory, the synchronization information cannot be restored. It will be restored as the cloud only group.

• The assigned licenses can be restored if there are enough available licenses.

Data Type	Status
Properties	Supported
Photo	Supported *Note: The photo is unsupported in the data center operated by 21Vianet in China.
Members	Supported
Owners	Supported
Roles and administrators	Unsupported
Administrative units	Supported
Group memberships	Supported
Applications	Supported
Azure role assignments	Supported *Note: To protect the Azure role assignments, you must grant the service app the User Access Administrator role in the corresponding subscription. *Note: The Azure role assignments are unsupported in the data center operated by 21Vianet in China.
Extension attributes	Supported

#Object Attributes

Attribute	Standard Entra ID	Entra ID Express	Comment
classification	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
deletedDateTime	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
description	Supported	Supported
groupTypes	Supported	Supported
deducedGroupType	Unsupported	Unsupported
mailEnabled	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
mailNickname	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
mail	Supported	Supported
membershipRule	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
membershipRuleProcessingState	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
preferredDataLocation	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
preferredLanguage	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
resourceBehaviorOptions	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
resourceProvisioningOptions	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
securityEnabled	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
securityIdentifier	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
theme	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
visibility	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
isAssignableToRole	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
Membership type	Supported	Unsupported
Source	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
Type	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
Object ID	Partially Supported	Unsupported	The object ID can be kept if the group has not yet been permanently deleted from your Microsoft Entra ID. In the data center operated by 21Vianet in China, the object ID is partially supported. The object IDs that are temporarily deleted can be restored. The object IDs that are permanently deleted cannot be restored.
Created at	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
Email	Supported	Unsupported
Direct members	Supported	Unsupported
Group memberships	Supported	Unsupported
Group name	Supported	Unsupported
Group description	Supported	Unsupported
Group writeback state	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.

#Users

Refer to the table below for the data recovery state for users:

• The guest users can also be protected in the Microsoft Entra Users category.

• The creation time of the user profile and the creation type cannot be kept.

• If the user is synchronized from the on-premises active directory, the synchronization information cannot be restored. It will be restored as the cloud only user.

• For the users who have not yet been permanently deleted, the restore job will fail if any role assignments are not supported for restore.

Component	Status
Profiles	Supported
Photo	Supported *Note: Due to the API limitation, the photo cannot be reverted to empty. Therefore, the restore job will skip the photo if the photo in the backup is empty.
Assigned roles	Supported *Note: Currently, only the eligible assignments and active assignments are supported. The expired assignments are unsupported.
Administrative units	Supported
Groups	Supported
Applications	Supported
License	Supported
Devices	Unsupported
Azure role assignments	Supported *Note: To protect the Azure role assignments, you must grant the service app the User Access Administrator role in the corresponding subscription. *Note: The Azure role assignments are unsupported in the data center operated by 21Vianet in China.
Authentication methods	Partially Supported *Note: The Alternative Phone belongs to MFA. The backup and restore of MFA properties are not supported. *Note: The authentication methods are fully supported in the data center operated by 21Vianet in China.
Extension attributes	Supported

#Object Attributes

Attributes	Standard Entra ID	Entra ID Express	Comment
accountEnabled	Supported	Supported
ageGroup	Supported	Supported
businessPhones/TelephoneNumber	Supported	Supported
city	Supported	Supported
companyName	Supported	Supported
consentProvidedForMinor	Supported	Supported
country	Supported	Supported
createdDateTime	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
creationType	Unsupported	Unsupported	Read-only property in Microsoft Entra ID. If the user account was created as a local account for an Azure Active Directory B2C tenant, the value is LocalAccount or nameCoexistence.
deletedDateTime	Unsupported	Unsupported
department	Supported	Supported
employeeHireDate	Unsupported	Supported	Read-only property in Microsoft Entra ID.
employeeId	Supported	Supported
employeeLeaveDate	Supported	Supported
employeeOrgData	Supported	Supported
employeeType	Supported	Supported
externalUserState	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
externalUserStateChangeDateTime	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
faxNumber	Supported	Supported
givenName	Supported	Supported
identities	Supported	Unsupported
jobTitle	Supported	Supported
lastPasswordChangeDateTime	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
mail	Supported	Supported
mailNickname	Supported	Supported
mobilephone	Supported	Supported
officeLocation	Supported	Supported
onPremisesImmutableId	Supported	Unsupported	The attribute is unsupported in the data center operated by 21Vianet in China.
onPremisesProvisioningErrors	Unsupported	Unsupported
otherMails	Supported	Supported
passwordPolicies	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
PerUserMfaState	Unsupported	Supported
PhysicalDeliveryOfficeName/OfficeLocation	Supported	Supported
postalCode	Supported	Supported
preferredDataLocation	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
preferredLanguage	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
showInAddressList	Unsupported	Unsupported
state	Supported	Supported
streetAddress	Supported	Supported
surname	Supported	Supported
usageLocation	Supported	Supported
userPrincipalName	Supported	Supported
userType	Supported	Supported	The attribute is unsupported in the data center operated by 21Vianet in China.
Manager	Supported	Unsupported	Read-only property in Microsoft Entra ID.
Display name	Supported	Supported
Object ID	Supported	Unsupported	The object ID can be kept if the user has not yet been permanently deleted from your Microsoft Entra tenant. In the data center operated by 21Vianet in China, the object ID is partially supported. The object IDs that are temporarily deleted can be restored. The object IDs that are permanently deleted cannot be restored.
Sign in sessions valid from date and time	Unsupported	Unsupported	Read-only property in Microsoft Entra ID.
Authorization info	Supported	Unsupported
Legal age group classification	Supported	Unsupported