Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Hard Deletion Protection helps protect critical Microsoft Entra objects from immediate permanent deletion. When you enable protection for an object, the object can still be soft deleted and restored. However, it can't be permanently deleted during the first seven days after it's soft deleted.
Identity administrators can use this article to enable Hard Deletion Protection and view protected objects. To complete the task, you need the Microsoft Entra Backup Administrator role and an existing supported object.
Important
Hard Deletion Protection is in preview.
Protection is permanent. After you enable Hard Deletion Protection for an object, you can't remove or undo the protection.
If you enable protection unintentionally, soft delete the object and wait seven days before you permanently delete it.
Prerequisites
- An active Microsoft Entra user with the Microsoft Entra Backup Administrator role.
- No additional license is required for the currently supported object types.
Hard Deletion Protection supports:
- Users (on-premises synchronized users aren't supported).
- Cloud-only groups.
- Applications.
- Service principals.
Note
Microsoft Entra Agent ID objects are supported through their underlying user, application, and service principal object types.
Understand deletion and restoration behavior
Hard Deletion Protection doesn't prevent soft deletion. It gives you time to investigate and restore an object before permanent deletion is allowed.
- The seven-day protection window starts at the time the object is soft deleted.
- Attempts to permanently delete the object during the seven-day window are blocked.
- After the seven-day window ends, the object can be permanently deleted.
- If you restore the object, Hard Deletion Protection remains enabled.
- If the restored object is soft deleted again, a new seven-day protection window starts.
- Enabling Hard Deletion Protection is recorded in the Microsoft Entra audit logs.
When a selected set includes a protected object, the permanent-deletion action is blocked.
Enable Hard Deletion Protection
In the Microsoft Entra admin center, you can protect up to 20 objects of one object type in each operation. Objects that already have protection enabled aren't available for selection.
Sign in to the Microsoft Entra admin center as at least a Microsoft Entra Backup Administrator.
Browse to Backup and recovery > Hard deletion protection.
Select Add protection.
Select one supported object type.
Search for and select up to 20 objects of that type.
Review the permanent-protection warning, and then select Save.
Review the protected-object counts on the Hard deletion protection page. To view protected objects of a specific type, select the corresponding link.