In short: Keepit for Entra ID backs up Microsoft Entra ID objects and policies, including users, groups, roles, app registrations, Conditional Access, Intune policies, BitLocker keys and audit logs, into Keepit's immutable cloud. It is licensed per seat, based on enabled users, and can restore to the same tenant or to a second tenant.
Why back up Entra ID
Microsoft Entra ID (formerly Azure AD) controls who can sign in to Microsoft 365 and every application connected to it. If a user, group, app registration or Conditional Access policy is deleted or changed by mistake, or by an attacker, people stop being able to work, and Entra ID's own recycle bin covers only some object types for a limited time.
Keepit for Entra ID keeps an independent, immutable copy of your identity configuration so you can see what changed and put it back. It is a separate service from Keepit for Microsoft 365, which protects mail, files and Teams.
What is covered
Keepit's current Entra ID coverage, which its documentation calls Entra ID Advanced, includes:
| Area | Included |
|---|---|
| Objects | Users, groups, administrative units, roles, service principals and app registrations |
| Policies | Conditional Access, compliance policies, configuration profiles, authentication methods and strengths, named locations, account protection and Intune antivirus |
| Device attributes | BitLocker recovery keys and Windows LAPS passwords |
| Logs | Audit logs and sign-in logs (sign-in logs need audit logs enabled too) |
Through 2025 and 2026 Keepit widened its Intune coverage to include Settings Catalog and software update profiles, device scripts, Autopilot profiles, assignment filters and managed app policies. Keepit notes some limits: certain configuration profile types cannot be backed up because of Microsoft API restrictions, and policies based on administrative templates are not supported. The older Basic and Standard coverage levels are legacy.
Restore options
- In place: restore an object or its properties to the original tenant
- Bulk restore: put back many objects or properties in one job
- Sub-object restore: recreate missing sub-objects along with their parent
- Cross-tenant restore: added in February 2026, restore objects into a separate tenant with their relationships, for testing or to keep working if the primary tenant is unavailable. The target tenant needs licences that cover the restored objects, and the account used must hold the Global Administrator role there
- Download and share: export objects or folders, or share them through secure links
Since July 2026 a soft-deleted Conditional Access policy restored from the recycle bin keeps its original policy ID, and Keepit has extended restore of app registrations and service principals, including their certificates and keys.
How it is licensed
Keepit for Entra ID is licensed per seat, and Keepit offers two ways of counting them:
| Counting model | How seats are counted |
|---|---|
| User objects | Every enabled user in the Entra ID organisation is a seat. Disabled users and guests are not counted; non-user objects with a Microsoft licence, such as shared mailboxes or Teams Rooms, are |
| Microsoft 365 seat count | If you also back up Microsoft 365 with Keepit, your Microsoft 365 seat count can cover Entra ID too, with the same full, light, faculty and student seat types. Keepit offers this on term-based contracts |
We check which model suits your tenant before quoting. Retention follows the tier: up to 5 years on Core Continuity, up to 10 years on Business Resilience or Enterprise Resilience, and unlimited retention as an add-on to those two. The Keepit overview compares support and onboarding across the tiers. Taking Entra ID alongside Microsoft 365 qualifies for Keepit's bundle discount.
Who it suits and how we help
Entra ID backup matters most where identity is complex: many Conditional Access policies, app registrations for line-of-business systems, devices managed through Intune, or several administrators making changes. It is also part of a sensible ransomware recovery plan, because restoring mailboxes is little use if nobody can sign in.
We set up the connector with the permissions Keepit needs, choose the UK region, agree retention and walk through a test restore. Pair it with multi-factor authentication such as Cisco Duo to reduce the chance of needing it.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Keepit's Microsoft 365 backup include Entra ID?
No. Entra ID is a separate Keepit connector and licence, though the two can be bundled, and on term-based contracts your Microsoft 365 seat count can cover Entra ID too.
Can Keepit restore a deleted Conditional Access policy?
Yes. Conditional Access policies are backed up, and since July 2026 a soft-deleted policy restored from the recycle bin keeps its original ID.
Does it back up Intune settings?
Keepit covers Intune compliance policies, many configuration profile types, antivirus policies, Autopilot profiles and device scripts. Some profile types and administrative template policies are excluded because of Microsoft API limits.
Can I restore into a different tenant?
Yes. Cross-tenant restore, added in February 2026, restores Entra ID objects into a second tenant with their relationships intact.
Do guest users count as seats?
No. Under the user-object model only enabled users count, plus non-user objects that have a Microsoft licence assigned.