What is backed up with Datto Backup for Microsoft Entra ID
Datto Backup for Microsoft Entra ID protects a wide range of Microsoft Entra ID objects and their
attributes.
This article explains which object types are covered and
highlights the key properties that are included in backup and restore.
Protected object types
Entra Backup currently protects the following object types:
- Users
- Groups
- Roles
- Service principals
- Devices
- Contacts
- Applications
- Administrative units
- Conditional access policies
- Authentication methods configuration
- Conditional access authentication contexts
For each object type, Datto Backup for Microsoft Entra ID captures a set of properties (fields).
Some properties are read-only in Microsoft Entra ID and are therefore
visible in backup data but cannot be changed during restore.
In some
cases, relationships are restored indirectly as part of other related
objects.
Users
User objects include identity, contact, organizational, licensing, and
relationship information.
Many of these values can be restored directly to
the user. Some relationship-based properties are restored indirectly
through other objects (for example, group membership).
| Property | Relationships | Notes |
|---|---|---|
| AccountEnabled | Indicates whether the user account is enabled. | |
| AgeGroup | Age classification for the user. | |
| AppRoleAssignments | Microsoft Graph: user appRoleAssignments | Captured in backup. Restored as part of other related app role objects. |
| AssignedLicenses | Licenses assigned to the user. | |
| BusinessPhones | Business phone numbers for the user. | |
| City | User's city. | |
| CompanyName | Company associated with the user. | |
| ConsentProvidedForMinor | Minor consent status where applicable. | |
| Country | User's country or region. | |
| CreatedDateTime | Read-only in Entra ID; cannot be modified on restore. | |
| Department | Department within the organization. | |
| DirectReports | Microsoft Graph: user directReports | Organizational reporting relationships. |
| DisplayName | User's display name. | |
| EmployeeId | Internal employee identifier. | |
| EmployeeType | Employment type (for example, full-time, contractor). | |
| FaxNumber | User's fax number. | |
| GivenName | User's first name. | |
| Identities | Collection of identity types and sign-in methods. | |
| JobTitle | User's job title. | |
| Primary email address. | ||
| MailNickname | Alias used in the mail system. | |
| Manager | Manager relationship for the user. | |
| MemberOf | Microsoft Graph: user memberOf | Group and directory role membership. Restored as part of other membership-related objects. |
| MobilePhone | User's mobile phone number. | |
| OfficeLocation | Office or site location. | |
| OnPremisesDistinguishedName | On-premises DN; read-only in Entra ID. | |
| OnPremisesDomainName | On-premises domain; read-only in Entra ID. | |
| OnPremisesExtensionAttributes | Custom extension attributes synced from on-premises. | |
| OnPremisesImmutableId | Immutable identifier for hybrid identity. | |
| OtherMails | Additional email addresses associated with the user. | |
| OwnedObjects | Microsoft Graph: user ownedObjects | Objects owned by the user. Restored as part of the corresponding dependent objects. |
| PasswordPolicies | Password policy configuration for the user. | |
| PostalCode | Postal or ZIP code. | |
| PreferredDataLocation | Preferred data residency location. | |
| State | State or province. | |
| StreetAddress | Street address for the user. | |
| Surname | User's last name. | |
| UsageLocation | Country or region where the user consumes services. | |
| UserPrincipalName | User sign-in name (UPN). | |
| UserType | User classification such as Member or Guest. |
Groups
Group objects include core group properties and membership-related
information.
Some attributes are read-only in Microsoft Entra ID and can
be viewed but not changed during restore.
| Property | Relationships | Notes |
|---|---|---|
| AllowExternalSenders | Controls whether external senders can email the group. | |
| AppRoleAssignments | Microsoft Graph: group appRoleAssignments | Captured but not currently available for restore. |
| AssignedLabels | Sensitivity or classification labels applied to the group. | |
| AssignedLicenses | Licenses assigned at the group level. | |
| Classification | Business classification of the group. | |
| CreatedDateTime | Read-only creation timestamp in Entra ID. | |
| Description | Text description of the group. | |
| DisplayName | Group display name. | |
| GroupTypes | Specifies group type (for example, Microsoft 365, Security). | |
| IsAssignableToRole | Read-only flag indicating if group can be used for role assignments. | |
| Group email address; read-only in Entra ID. | ||
| MailEnabled | Indicates whether the group is mail-enabled (read-only). | |
| MailNickname | Alias used for the group in mail. | |
| MemberOf | Microsoft Graph: group memberOf | Parent groups and roles; restored through related membership objects. |
| Members | Microsoft Graph: group members | Users, devices, and other entities that belong to the group. |
| MembershipRule | Dynamic membership rule for dynamic groups. | |
| MembershipRuleProcessingState | Status of membership rule processing. | |
| OnPremisesDomainName | On-premises domain; read-only in Entra ID. | |
| Owners | Microsoft Graph: group owners | Users or service principals that own the group. |
| PreferredDataLocation | Preferred data residency location for the group. | |
| SecurityEnabled | Indicates whether the group is security-enabled. | |
| Theme | Visual theme applied to the group (where supported). | |
| Visibility | Group visibility (for example, Public, Private). |
Roles
Role objects define directory roles and their permissions.
Certain
properties, such as whether a role is built in, are read-only.
| Property | Relationships | Notes |
|---|---|---|
| Description | Describes the purpose and usage of the role. | |
| DisplayName | Human-readable name for the role. | |
| InheritsPermissionsFrom | Indicates roles whose permissions are inherited. | |
| IsBuiltIn | Read-only flag indicating built-in Microsoft Entra roles. | |
| IsEnabled | Indicates whether the role is enabled for assignments. | |
| ResourceScopes | Defines the scopes where the role can be applied. | |
| RolePermissions | Collection of permissions granted by the role. | |
| TemplateId | Identifier for the role template. | |
| Version | Version indicator for the role definition. |
Service principals
Service principals represent applications and services in Microsoft Entra
ID.
Datto Backup for Microsoft Entra ID captures both core identity properties and configuration
details such as credentials and SSO settings.
| Property | Relationships | Notes |
|---|---|---|
| id | Unique identifier of the service principal. | |
| deletedDateTime | Timestamp for soft-deleted service principals, if applicable. | |
| accountEnabled | Controls whether the service principal is enabled. | |
| alternativeNames | Alternative or legacy names for the service principal. | |
| appDisplayName | Display name of the associated application. | |
| appDescription | Description of the application. | |
| appId | Application ID associated with the service principal. | |
| applicationTemplateId | Template ID if created from an application gallery template. | |
| appOwnerOrganizationId | Identifier of the owning organization. | |
| appRoleAssignmentRequired | Indicates whether users or groups require app role assignments to sign in. | |
| createdDateTime | Creation timestamp for the service principal. | |
| description | Additional description for the service principal. | |
| disabledByMicrosoftStatus | Indicates if Microsoft has disabled the principal. | |
| displayName | Display name of the service principal. | |
| homepage | Application home page URL. | |
| loginUrl | Custom sign-in URL for the application. | |
| logoutUrl | Custom sign-out URL for the application. | |
| notes | Internal notes about the service principal. | |
| notificationEmailAddresses | Email addresses used for notifications. | |
| preferredSingleSignOnMode | Preferred SSO mode (for example, SAML or OIDC). | |
| preferredTokenSigningKeyThumbprint | Thumbprint of the preferred token signing certificate. | |
| replyUrls | Reply URLs (redirect URIs) for the application. | |
| servicePrincipalNames | SPNs used to identify the service principal. | |
| servicePrincipalType | Type of service principal (for example, Application). | |
| signInAudience | Audience allowed to sign in (for example, AzureADMyOrg). | |
| tags | Tags applied to the service principal. | |
| tokenEncryptionKeyId | Identifier of the key used for token encryption. | |
| samlSingleSignOnSettings | SAML SSO configuration for the application. | |
| addIns | Additional add-in configuration for the application. | |
| appRoles | Application roles defined for the service principal. | |
| info | Additional informational properties. | |
| keyCredentials | Key-based credentials (certificates, keys). | |
| oauth2PermissionScopes | OAuth2 permission scopes exposed by the API. | |
| passwordCredentials | Password-based credentials (client secrets). | |
| resourceSpecificApplicationPermissions | Permissions defined for specific resources. | |
| verifiedPublisher | Information about the verified publisher of the app. |
Devices
Device objects capture device identity, compliance, management, and
operating system information.
These properties are important for restoring
device-based access policies and inventory.
| Property | Relationships | Notes |
|---|---|---|
| id | Unique identifier for the device. | |
| deletedDateTime | Timestamp for soft-deleted devices, if applicable. | |
| accountEnabled | Indicates whether the device is enabled. | |
| approximateLastSignInDateTime | Approximate time of the last sign-in from this device. | |
| complianceExpirationDateTime | Compliance validity or expiration date. | |
| createdDateTime | Creation timestamp for the device object. | |
| deviceCategory | Category of the device (for example, Mobile, Desktop). | |
| deviceId | Device identifier used by Microsoft Entra ID. | |
| deviceMetadata | Additional metadata available for the device. | |
| deviceOwnership | Ownership information (for example, Company, Personal). | |
| deviceVersion | Version indicator for the device object. | |
| displayName | Friendly name of the device. | |
| domainName | Domain that the device is joined to, where applicable. | |
| enrollmentProfileName | Name of the enrollment profile used. | |
| enrollmentType | How the device was enrolled (for example, MDM). | |
| externalSourceName | External source that provided the device record, if any. | |
| isCompliant | Indicates compliance state with policies. | |
| isManaged | Indicates whether the device is managed. | |
| isRooted | Indicates whether the device is rooted or jailbroken. | |
| managementType | Type of management (for example, MDM, MAM). | |
| manufacturer | Device manufacturer (for example, Microsoft, Apple). | |
| mdmAppId | Identifier of the MDM application managing the device. | |
| model | Device model. | |
| onPremisesLastSyncDateTime | Last sync time with on-premises directory, if applicable. | |
| onPremisesSyncEnabled | Indicates if synchronization with on-premises is enabled. | |
| operatingSystem | Operating system installed on the device. | |
| operatingSystemVersion | Version of the device operating system. | |
| physicalIds | Physical identifiers for the device. | |
| profileType | Type of device profile, if applicable. | |
| registrationDateTime | Timestamp when the device was registered. | |
| sourceType | Source system that created the device record. | |
| systemLabels | System-generated labels that classify the device. | |
| trustType | Indicates trust type (for example, Azure AD joined). | |
| extensionAttributes | Custom extension attributes for the device. | |
| alternativeSecurityIds | Alternative security identifiers for the device. |
Contacts
Contact objects are typically used for external identities and address
book entries.
Datto Backup for Microsoft Entra ID captures key identity, contact, and
synchronization fields.
| Property | Relationships | Notes |
|---|---|---|
| id | Unique identifier of the contact. | |
| addresses | Postal addresses associated with the contact. | |
| companyName | Company associated with the contact. | |
| department | Department for the contact, if applicable. | |
| displayName | Display name of the contact. | |
| givenName | First name of the contact. | |
| jobTitle | Job title for the contact. | |
| Primary email address of the contact. | ||
| mailNickname | Alias used for the contact in the directory. | |
| serviceProvisioningErrors | Provisioning error details, if any. | |
| onPremisesLastSyncDateTime | Timestamp of the last sync with on-premises sources. | |
| onPremisesProvisioningErrors | Provisioning errors from on-premises directory sync. | |
| onPremisesSyncEnabled | Indicates if on-premises sync is enabled for this contact. | |
| phones | Phone numbers associated with the contact. | |
| proxyAddresses | Proxy addresses used by the contact. | |
| surname | Last name of the contact. |
Applications
Application objects define application registrations in Microsoft Entra
ID.
Datto Backup for Microsoft Entra ID captures identifiers, endpoints, credentials, and access
configuration so that registrations can be restored when needed.
| Property | Relationships | Notes |
|---|---|---|
| appId | Application (client) ID. | |
| createdDateTime | Timestamp when the application registration was created. | |
| displayName | Display name of the application. | |
| publisherDomain | Publisher’s verified domain. | |
| serviceManagementReference | Reference to external service management systems. | |
| signInAudience | Who can sign in (for example, AzureADMyOrg, AzureADMultipleOrgs). | |
| samlMetadataUrl | URL for SAML metadata, if used. | |
| defaultRedirectUri | Default redirect URI for the application. | |
| id | Unique identifier for the application object. | |
| info | Additional informational properties for the app. | |
| keyCredentials | Key-based credentials (certificates, keys). | |
| passwordCredentials | Password-based credentials (client secrets). | |
| requiredResourceAccess | APIs and permissions required by the app. | |
| web | Web-specific configuration (redirect URIs, logout URLs, etc.). | |
| servicePrincipalLockConfiguration | Controls how associated service principals can be modified. | |
| spa | Single-page application configuration. |
Administrative units
Administrative units (AUs) allow you to delegate administration across
subsets of your organization.
Datto Backup for Microsoft Entra ID protects AU definitions and
membership settings so that delegated models can be restored.
| Property | Relationships | Notes |
|---|---|---|
| id | Unique identifier of the administrative unit. | |
| description | Describes the purpose or scope of the AU. | |
| displayName | Display name of the administrative unit. | |
| isMemberManagementRestricted | Indicates whether membership management is restricted. | |
| membershipRule | Dynamic membership rule, if configured. | |
| membershipRuleProcessingState | Status of processing for the membership rule. | |
| membershipType | Type of membership (for example, Assigned, Dynamic). | |
| visibility | Who can see the administrative unit. |
Conditional access policies
Conditional access policies define the sign-in conditions and controls
that govern access to resources.
Datto Backup for Microsoft Entra ID captures the policy
definition, including its conditions, assignments, and grant controls.
| Property | Relationships | Notes |
|---|---|---|
| Policy ID | ||
| Display name | ||
| State | ||
| Created date | ||
| Included applications | ||
| Excluded applications | ||
| Include user actions | ||
| Included groups | ||
| Excluded groups | ||
| Included users | ||
| Excluded users | ||
| Included roles | ||
| Excluded roles | ||
| Client app types | ||
| Sign-in risk levels | ||
| User risk levels | ||
| Service principal risk levels | ||
| Built-in controls | ||
| Operator | ||
| Custom authentication factors | ||
| Terms of use |
Authentication methods configuration
The authentication methods policy controls which authentication methods
are available to users and how they are enforced.
Datto Backup for Microsoft Entra ID captures
the policy settings and the configuration of each individual method.
| Property | Relationships | Notes |
|---|---|---|
| Policy ID | ||
| Display name | ||
| Description | ||
| Policy version | ||
| Last modified date | ||
| Registration campaign state | ||
| Campaign snooze duration (days) | ||
| Campaign include targets | ||
| Campaign exclude targets | ||
| Method ID | ||
| Method object type | ||
| Method state | ||
| Method include targets | ||
| Method exclude targets | ||
| FIDO2 - attestation enforced | ||
| FIDO2 - self-service registration allowed | ||
| FIDO2 - default passkey profile | ||
| FIDO2 - key restriction AA GUIDs | ||
| FIDO2 - key restriction enforcement type | ||
| FIDO2 - key restriction enforced | ||
| FIDO2 - passkey profiles | ||
| Authenticator - software OATH enabled | ||
| Authenticator - authentication mode | ||
| Authenticator - display app info state | ||
| Authenticator - display location info state | ||
| SMS - usable for sign-in | ||
| TAP - default length | ||
| TAP - default lifetime (minutes) | ||
| TAP - minimum lifetime (minutes) | ||
| TAP - maximum lifetime (minutes) | ||
| TAP - usable once | ||
| Voice - office phone allowed | ||
| Email - allow external ID email OTP | ||
| X509 - default auth mode | ||
| X509 - default affinity level | ||
| X509 - auth rules | ||
| X509 - certificate authority scopes | ||
| X509 - certificate user bindings | ||
| X509 - CRL validation state | ||
| X509 - issuer hints state | ||
| QR Code PIN - PIN length | ||
| QR Code PIN - standard QR lifetime (days) | ||
| External method - app ID | ||
| External method - display name | ||
| External method - OIDC client ID | ||
| External method - OIDC discovery URL |
External authentication methods
For each external (custom) authentication method, Datto Backup for Microsoft Entra ID also captures the following per-method configuration.
| Property | Relationships | Notes |
|---|---|---|
| Method ID | ||
| Display name | ||
| State | ||
| App ID | ||
| Include targets | ||
| Include target - ID | ||
| Include target - target type | ||
| Include target - registration required | ||
| Exclude targets | ||
| OIDC client ID | ||
| OIDC discovery URL |
Conditional access authentication contexts
Authentication contexts let you apply conditional access policies to
specific resources and actions.
Datto Backup for Microsoft Entra ID captures each
authentication context reference and its availability.
| Property | Relationships | Notes |
|---|---|---|
| Reference ID | ||
| Display name | ||
| Description | ||
| Is available |
