Operations
Backup
Tenant configuration backup
In a Microsoft 365 or Azure tenant context, backup does not mean file or mailbox data backup in the traditional sense, since Microsoft's own retention and recovery mechanisms largely cover that.
Why Backup matters in a Microsoft estate
Backup matters when teams need repeatable day-two work rather than one-off fixes. Definitions in this area should help readers connect reporting, review, remediation, backup, drift, and evidence capture to a controlled operating model.
How Backup shows up in practice
Here it means a saved, timestamped record of the tenant's configuration state, capturing settings across Entra ID policies, Conditional Access rules, Intune compliance and configuration profiles, and related administrative settings. This is taken on a schedule so that state can be compared, restored from, or used as evidence later. This kind of configuration backup exists to answer a specific and recurring operational question: what did this policy look like before it changed, and can we get back to that state quickly if the change turns out to be wrong.
Tenant configuration changes happen constantly and rarely through a single controlled process, since admins make one-off changes to unblock a user, third-party tools push their own policy changes, and Microsoft's own default settings shift over time. Without a saved baseline to compare against, most tenants have no reliable way to answer what changed or when, which is exactly the gap tenant configuration drift describes. A useful backup implementation takes scheduled, versioned snapshots rather than a single point-in-time export, and supports pinning a specific snapshot as the trusted baseline that later drift gets measured against.
Critically, it also supports per-policy restore rather than only an all-or-nothing rollback, since a real-world recovery need is usually narrow, one Conditional Access rule that got tightened incorrectly, one compliance policy that broke device enrolment, not a wholesale return to a prior tenant state that would undo other legitimate changes made since. Backup and drift detection work as a pair: the backup is the historical record, and drift detection is the comparison logic that walks forward from a pinned baseline to flag what has changed, by whom where that is available, and how significant the change is. This turns a passive archive into an active early-warning signal, rather than something only consulted after an incident. For audit and compliance purposes, this record carries weight independent of its recovery value.
Being able to show an assessor a dated snapshot of Conditional Access and compliance policy state at a point in time, alongside evidence of what changed and when since, is direct, credible support for frameworks like ISO 27001 or Cyber Essentials that expect configuration management and change control to be demonstrable rather than asserted. For MSPs running many tenants, consistent scheduled configuration backup across every customer also removes a specific kind of operational risk: a single admin mistake or a bad third-party integration push no longer means manually reconstructing what a tenant's policies used to look like from memory, change logs, and hope.