Microsoft is introducing Hard Deletion Protection for Entra ID. This new security feature prevents protected accounts and other Entra objects from being permanently deleted for seven days after a temporary deletion.
When Hard Deletion Protection is enabled, an object can still be temporarily deleted and restored. However, it cannot be permanently deleted during the first seven days following the temporary deletion.
Normally, an account in Entra ID remains recoverable for thirty days after being deleted by an administrator, as Neowin explains. This is called soft deletion. However, administrators can also permanently delete an account before that period expires, making recovery impossible.
Notably, the new protection feature is irreversible. Once enabled for an object, it cannot be disabled, even if the object is restored. Microsoft states that administrators who accidentally activate the protection have only one option: to temporarily delete the object and wait a week before it can be permanently deleted.
This gives organizations more time to respond when an important account is deleted accidentally or by malicious actors. The security feature is currently still in the preview phase. Microsoft has not announced when the feature will become generally available.
Enabling protection
Administrators who want to enable the feature must follow these steps:
- Sign in to the Microsoft Entra Admin Center with at least the role of Microsoft Entra Backup Administrator.
- Go to Backup and Restore > Protection Against Permanent Deletion.
- Select Add protection.
- Select one supported object type.
- Search for and select up to 20 objects of that type.
- Read the warning about permanent protection, and then select Save.
- Check the number of protected objects on the Protection against permanent deletion page. Select the corresponding link to view protected objects of a specific type.
Because protection cannot be disabled once activated, administrators must carefully consider which objects to enable this feature for.