Topic starter
24/06/2026 10:46 pm
TL;DR: Entra ID recovery often fails when teams restore users and groups but leave behind device identities, Intune policies, and custom security attributes that drive real access decisions, according to Semperis. Recovery that ignores those layers can preserve directory objects while still breaking Conditional Access, endpoint posture, and business access continuity.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Hardening Entra ID Recovery and Identity Security Resilience”.
Key questions
Q: What breaks when Entra ID recovery restores users but not device identities?
A: Users may authenticate on paper, but Conditional Access and device-based trust checks can fail because the recovered tenant no longer has the device context it uses to decide whether access is safe.
Q: Why do Intune policies matter during identity recovery?
A: Intune policies define the endpoint compliance and configuration posture that many access decisions rely on.
Q: How do custom security attributes affect access after an Entra ID restore?
A: Custom security attributes often carry the business context that applications use to grant or deny access, such as tenant markers, business-unit tags, or entitlement flags.
Practitioner guidance
- Map recovery scope to the full access plane Extend Entra ID recovery planning beyond users and groups to include device objects, Intune policy state, and user-level custom attributes that applications depend on for access decisions.
- Test Conditional Access after restore Validate that restored device identities still satisfy Conditional Access rules and do not force emergency policy weakening to bring users back online.
- Preserve custom attribute dependencies Inventory which applications and tenant workflows read user-level custom security attributes, then verify those attributes are included in backup and restore coverage.
Bottom line: The main risk is not losing users and groups, but losing the device and attribute layers that make Entra ID access decisions work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:35 am
Identity recovery fails when teams treat Entra ID as a user directory rather than an access system. The article shows that users and groups are only the visible part of the control plane. Device objects, Intune state, and custom security attributes all participate in runtime access decisions, so restoring only directory objects creates a false recovery state.
A question worth separating out:
Q: What should identity teams include in a tenant recovery plan beyond users and groups?
A: They should include device objects, Intune configuration state, and any custom attributes that applications use in authorisation decisions. That gives the organisation a chance to restore real-world access and posture, not just directory completeness, after an incident or misconfiguration.
👉 Read our full editorial: Entra ID recovery depends on restoring devices and attributes