Microsoft Entra ID · Remaining Built-in Roles
Entra Backup Administrator
Manages all aspects of Microsoft Entra Backup including creating recovery jobs and managing backup snapshots for directory data.
Scope: Full administration of Microsoft Entra Backup for directory data protection and recovery
Permissions
- Create and manage recovery jobs for Entra directory data
- Manage backup snapshots and retention
- View backup job status and history
- Configure backup settings and schedules
- Restore directory objects from backup
Common use cases
- Restoring accidentally deleted users or groups
- Recovering from bulk directory changes
- Disaster recovery for Entra ID directory data
- Scheduled backup management for compliance
- Point-in-time recovery of directory objects
Best practices
- Test recovery procedures regularly
- Document backup schedules and retention policies
- Monitor backup job completion status
- Coordinate with identity team on recovery procedures
- Maintain runbooks for common recovery scenarios
Security considerations
- Recovery operations can restore deleted objects including privileged accounts
- Backup data may contain sensitive directory information
- Restoration could override recent intentional changes
- Monitor for unauthorized recovery attempts
Common questions
When should I assign the Entra Backup Administrator role?
Assign Entra Backup Administrator when you need to: Restoring accidentally deleted users or groups; Recovering from bulk directory changes; Disaster recovery for Entra ID directory data; Scheduled backup management for compliance; and Point-in-time recovery of directory objects. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Entra Backup Administrator role do?
The Entra Backup Administrator role grants permissions including: Create and manage recovery jobs for Entra directory data; Manage backup snapshots and retention; View backup job status and history; Configure backup settings and schedules; and Restore directory objects from backup. See the Permissions section above for the full list.
What are the security risks of the Entra Backup Administrator role?
Key considerations when assigning Entra Backup Administrator: Recovery operations can restore deleted objects including privileged accounts; Backup data may contain sensitive directory information; Restoration could override recent intentional changes; and Monitor for unauthorized recovery attempts. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.