While this is a large and growing user base for Microsoft, many enterprises struggle with managing this new, evolving identity environment, especially as the majority of organizations maintain hybrid identity infrastructure (both on-premises Active Directory and Entra ID). They turn to Quest to help migrate, manage, protect, back up, and restore these new cloud-based identities as part of their overall Identity Threat Detection and Response (ITDR) practice, including utilizing Quest On Demand Recovery, a SaaS-based Entra ID backup and recovery solution.

Based on analysis of anonymized telemetry data from the Quest On Demand Recovery, we found several interesting insights into the backup and recovery trends of cloud-based identities.

Massive Volume of Data Backed Up

Over the past year, organizations have collectively backed up around 37 billion objects within Entra ID. including:

• Groups (35%): 13 billion objects backed up, reflecting the importance of managing and preserving group configurations. Entra ID groups are critical for controlling permissions and streamlining security across multiple resources.
• Devices (34%): Another 13 billion device objects backed up, showing the growing number of devices being managed. This includes new customer onboarding and a growing shift of organizations transitioning more devices from on-premises-joined to Entra ID-joined through their hybrid journey.
• Users (27%): 10 billion user objects, including guest users, protecting the objects that end users need to interact with all systems—i.e., this is the core of identity management.
• Service Principals and Applications: Smaller, yet critical components that are also regularly backed up. This includes applications or services like those provided by On Demand Recovery to access Microsoft 365 for backup and recovery scenarios. These are key elements that allow users to interact and use services and tools required for their daily tasks.

Backup Growth Rates Show Expansion

The total objects backed up have grown by nearly 30% over 12 months, with device backups growing even faster at 44%.

Backup Automation Drives Consistency and Reliability

Nearly 99.74% of organizations automate their backups, reducing the risk of errors and ensuring that data is protected without manual intervention.

Full restores still critical, but shift toward differential restores

• A large majority (75%) of organizations perform full restores monthly, ensuring that entire objects can be fully recovered when needed, providing peace of mind that data can be restored completely.
• 25% of organizations use differential restores, and this number is increasing, reflecting a trend toward more efficient, granular recovery processes. Differential restores allow organizations to restore only what has changed, reducing downtime and resource use. As organizations become more familiar with their restore options, they are shifting toward more targeted, efficient differential restores, demonstrating that they are embracing the advanced capabilities of the platform.

Understand Shared Backup and Recovery Responsibilities

As organizations continue to grow their usage of Entra ID due to the inherent security and incentives like the MACC program, they will need to understand and evaluate where Microsoft’s responsibilities for backup and restore ends and what is and is not covered. While new skillsets are being developed for cloud deployments, existing processes and proven methods should be leveraged as much as possible to accelerate adoption even further.

Mind the Gaps in Native Restore Options

Microsoft offers various backup and recovery strategies and tools, but it’s a shared responsibility with the end user per the service agreement. In other words, it’s incomplete and requires PowerShell scripting and deep knowledge of Entra ID APIs. For this reason, many organizations turn to third-party providers like Quest to fill the gaps in backup and recovery. Those gaps include soft deleted items in the Recycle Bin. These items are only retained for 30 days and then they are hard deleted (and cannot be recovered by native tools). Also, changes to objects do not go into the Recycle Bin, making it impossible to recover them using native tools.

Furthermore, the Recycle Bin only covers limited restores of users, groups and application registrations. For example, linked objects and relations such as group members and role assignments are not restored. Administrators must manually restore these relationships, which can be a complex and time-consuming process. Additionally, Conditional Access Policies are also not saved and restored within the Recycle Bin, which breaks the security of Entra ID for the restored user.

Protect the Growing Set of Cloud-Joined Devices

Additional gaps exist around device objects. Organizations have a growing set of Entra ID-joined devices through their own endpoint modernization and Active Directory modernization journeys, which means its critical for user productivity and organizational security to back up and restore device objects. Entra ID device objects manage access, enforce security policies and ensure only compliant devices can access corporate resources. When these objects are missing or corrupted, users will lose access to applications and services, thus impacting productivity.

As organizations continue to adopt cloud services and SaaS solutions, the need for a robust Entra ID backup and recovery strategy becomes increasingly critical to maintain productivity and organizational security.

Complete Active Directory and Entra ID recovery are essential for every organization in today’s cloud-based IT infrastructure. With businesses increasingly deploying hybrid cloud environments, a solid on-premises AD recovery plan alone isn’t sufficient any longer. Organizations now have more users and business data across Entra ID that need to be protected, including cloud-only objects such as Microsoft 365 and Entra ID groups, Azure B2B accounts, conditional access policies and more. On Demand Recovery will help your organization realize a complete Entra ID recovery plan that encompasses your entire hybrid environment, from on-premises data centers to the cloud.

As organizations continue to adopt cloud services and SaaS solutions, the need for a robust Entra ID backup strategy becomes increasingly critical. Our scalable solution adapts to your evolving business needs, whether you're operating in a public cloud, private cloud, or hybrid environment. By leveraging virtualization technologies and offering cloud storage options, we provide a flexible, as-a-service model that simplifies provisioning and management of your recovery infrastructure.

Our comprehensive Entra ID recovery solution integrates seamlessly with popular cloud platforms like AWS, ensuring compatibility with your existing IT infrastructure. Whether you're managing virtual machines or physical servers, our system provides the tools necessary to streamline your data protection and access management processes. By centralizing these functions, we help you reduce complexity, minimize risk, and ensure that your business-critical data and applications remain available and secure at all times.