Your Entra ID tenant, fully recoverable.

Enterprise-grade, automated backup & recovery for Microsoft Entra ID (Azure AD) — users, groups, applications, conditional access, devices, roles. Restore in minutes, not days.

23 object typesDelta queriesRecycle bin awareCross-tenant restoreEU-hosted

Why CYBBACK

Microsoft's recycle bin alone won't save you

Incremental forever

Microsoft Graph delta queries fetch only what changed. Daily backups complete in seconds, not hours.

23 object types restorable

Users, groups, applications, service principals, conditional access, devices, roles, OUs, policies — all restorable individually.

Recycle bin + recreate

Smart hybrid restore: pulls from Microsoft's 30-day recycle bin first, recreates beyond that — with full attribute fidelity.

AES-256-GCM encryption

Tenant credentials and backup files encrypted at rest. Encryption keys stored in Google Secret Manager (EU).

Cross-tenant restore

Recover into a different Entra tenant — perfect for M&A, tenant migrations or disaster scenarios.

Compliance-ready

GDPR-aligned, EU data residency, full audit trail and exportable evidence on demand.

What gets backed up

Your entire Entra ID directory

Users & guestsProfile, MFA methods, license assignments

GroupsSecurity, M365, dynamic, distribution

Applications & service principalsApp registrations, secrets metadata, API permissions

Conditional access policiesConditions, controls, named locations

Roles & assignmentsBuilt-in & custom directory roles

DevicesRegistered, joined, compliance state

Administrative unitsScoped administration containers

Policies & settingsAuthentication, authorization, branding

Technical specifications

Built on Microsoft Graph

Authentication	App registration with Application permissions (client credentials flow) — encrypted in CYBBACK vault
API	Microsoft Graph v1.0 + beta where required. Throttling-aware with automatic backoff
Backup mode	Incremental forever via delta queries. Force-full mode available on demand
Frequency	Manual, daily, weekly, or custom cron expression
Storage backend	Default: CYBBACK secure storage (EU). Optional: BYOB — any S3-compatible provider
Encryption at rest	AES-256-GCM, optional per-user toggle. Manifest excluded from encryption
Restore granularity	23 object types — full tenant · object class · individual object
Restore strategy	Recycle-bin first (objects deleted < 30 days), recreate-from-backup beyond. Cross-tenant supported
Restore options	Dry-run · overwrite · prefix · target tenant override (tenantId, clientId, secret)
Drift detection	3 severity levels (info / warning / critical). Configurable thresholds per object type
Notifications	In-app · email · Slack · webhooks
Hosting region	Google Cloud — europe-west1 (Belgium)
Audit & compliance	Full activity log, exportable. RGPD/GDPR-aligned. Customer data never leaves the EU

Trust & compliance

Security you can prove

GDPR-alignedEU residency, DPA on request

AES-256-GCMIndustry-standard encryption

Audit logsEvery action is traceable

EU hostingBelgium (europe-west1)

Start your free trial

Connect your Entra tenant in under 5 minutes and run your first secured backup today.

Start free trial