Microsoft Entra introduces seven-day hard deletion protection for critical identities
Microsoft Entra has launched Hard Deletion Protection in preview, a feature that provides a seven-day safeguard window preventing the permanent deletion of critical directory objects such as cloud-only groups, users, applications, and service principals. This protection allows administrators to recover selected identities that have been soft deleted but not permanently erased, mitigating risks from accidental or malicious deletions. While the initial deletion (soft delete) still disables the object and can disrupt services, Hard Deletion Protection blocks permanent removal within the first seven days, after which permanent deletion is permitted unless the object is restored, which renews the protection window. The feature is configurable by administrators with the Microsoft Entra Backup Administrator role and requires careful review as protection cannot be disabled once enabled. Microsoft advises monitoring deletion events using Entra audit logs integrated with SIEM tools like Microsoft Sentinel, and supplementing security via Conditional Access policies for sensitive actions including permanent deletions.
Linha do tempo
-
Microsoft Entra introduces seven-day hard deletion protection for critical identities
ler a análise desta fonte ocultar
Microsoft Entra has launched Hard Deletion Protection in preview, a feature that provides a seven-day safeguard window preventing the permanent deletion of critical directory objects such as cloud-only groups, users, applications, and service principals. This protection allows administrators to recover selected identities that have been soft deleted but not permanently erased, mitigating risks from accidental or malicious deletions. While the initial deletion (soft delete) still disables the object and can disrupt services, Hard Deletion Protection blocks permanent removal within the first seven days, after which permanent deletion is permitted unless the object is restored, which renews the protection window. The feature is configurable by administrators with the Microsoft Entra Backup Administrator role and requires careful review as protection cannot be disabled once enabled. Microsoft advises monitoring deletion events using Entra audit logs integrated with SIEM tools like Microsoft Sentinel, and supplementing security via Conditional Access policies for sensitive actions including permanent deletions.