In short: Commvault Cloud Backup & Recovery for Active Directory protects on-premises Active Directory and Microsoft Entra ID, including users, groups, Group Policy and conditional access policies. It is licensed per enabled user, and one licence covers both directories. Standard covers object, attribute and Entra ID recovery; Enterprise adds automated forest recovery with runbooks.
What it is
Commvault Cloud Backup & Recovery for Active Directory protects your identity systems: on-premises Active Directory and Microsoft Entra ID (formerly Azure AD). When identity fails, nothing else works. Users cannot sign in, servers cannot authenticate and restoring other backups becomes slow or impossible, which is why attackers so often target domain controllers first.
The service backs up directory objects and settings, shows exactly what changed between two points in time and restores anything from one overwritten attribute to a whole forest. Its control plane is delivered as SaaS and runs independently of your Active Directory, so recovery tools stay available when your directory does not. It is part of the Commvault Cloud platform.
What is included in each edition
| Capability | Standard | Enterprise |
|---|---|---|
| Backup and recovery of AD objects: users, groups, computers, OUs, contacts, sites and configuration | Yes | Yes |
| Group Policy protection, including settings, links and security | Yes | Yes |
| Interactive, domain-wide comparison of objects and attributes between two points in time | Yes | Yes |
| Rollback of overwritten attributes across thousands of objects at once | Yes | Yes |
| Entra ID recovery: users, groups, licences, conditional access and role assignments | Yes | Yes |
| Automated Active Directory forest recovery | No | Yes |
| Visual AD topology for recovery planning | No | Yes |
| Orchestration of the multi-step recovery, including AD restores, domain controller promotion and AD hygiene tasks | No | Yes |
| Interactive runbooks for regular disaster recovery testing | No | Yes |
Commvault's feature list also covers Entra ID app registrations and recovery onto clean virtual machines; we confirm which edition you need for those in your quote. The comparison reports are the feature admins use most day to day: you can see every change in the domain between two backups and undo deleted objects or overwritten attributes straight from the report.
How it is licensed
The service is licensed per enabled user, in the Standard or Enterprise edition. One licence covers the same user in both Active Directory and Entra ID, so hybrid organisations do not pay twice: if you protect both, you license the enabled user accounts in the AD domains the service manages. Commvault states there are no capacity limits and backup retention is unlimited.
Backup storage is either your own Azure storage or Commvault Air Gap storage. Air Gap storage is licensed separately, by capacity, and we include it in the quote if you want Commvault to host the copies. Commvault licences are subscriptions; we confirm the term and billing frequency in your quote. Ask us for a quote for your enabled user count.
Requirements and deployment
The management platform is SaaS. On-premises Active Directory needs Commvault software in your network so the service can reach your domain controllers; Entra ID is connected through application permissions in your tenant. Commvault's documentation lists a United Kingdom region for Entra ID workloads.
Forest recovery planning is where the Enterprise edition earns its place. The visual topology and interactive runbooks let you rehearse a recovery that would otherwise involve dozens of manual steps, and test it on a schedule rather than for the first time during an incident. We recommend testing it at least once a year, in line with your business continuity plan.
Who it suits
Standard suits organisations that want protection from accidental deletions, bad Group Policy changes and Entra ID misconfiguration, with quick rollback. Enterprise suits organisations where a lost forest would stop the business, such as those with many sites, regulatory recovery obligations or cyber insurance questions about identity recovery. Pair it with Microsoft 365 backup so identities and their data can be recovered together, and with strong sign-in controls from our identity and access category.
How we help
We count enabled users, choose the edition and storage, deploy the components, connect Entra ID and set up comparison reports and alerts. For Enterprise customers we help build and test the forest recovery runbook. See also disaster recovery options.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does one Commvault licence cover Active Directory and Entra ID?
Yes. Commvault licenses per enabled user, and one licence covers that user in both on-premises Active Directory and Microsoft Entra ID.
Can Commvault restore an entire Active Directory forest?
Yes, in the Enterprise edition. It automates Active Directory forest recovery, orchestrating steps such as AD restores and domain controller promotion, with a visual topology and interactive runbooks you can use to test the process regularly.
Does Commvault back up Entra ID conditional access policies?
Yes. Entra ID protection in both editions covers users, groups, licences, conditional access policies and role assignments.
Where are Commvault Active Directory backups stored?
In your own Azure storage or in Commvault Air Gap storage, which is licensed separately by capacity. Commvault lists a United Kingdom region for Entra ID workloads.