Microsoft Entra ID Gets New Security Feature That Blocks Account Deletion for 7 Days

Microsoft has introduced a new security feature for Microsoft Entra ID that prevents administrators from permanently deleting protected accounts and other supported objects for seven days.

The feature, called Hard Deletion Protection, is currently available in public preview. It aims to help organizations recover accounts that administrators accidentally delete or attackers maliciously remove.

Microsoft Entra ID blocks permanent deletion for seven days

According to Microsoft’s documentation, Hard Deletion Protection prevents administrators from permanently deleting protected objects during the first seven days after soft deletion.

Normally, administrators can permanently remove deleted Entra ID accounts. The new feature introduces a mandatory seven-day protection period, giving organizations additional time to recover affected objects.

However, Microsoft warns that the protection is permanent. Once an administrator enables Hard Deletion Protection for an object, they cannot disable it, even after restoring the deleted object.

The restriction applies to permanent deletion, meaning administrators can still soft-delete protected objects.

How to enable Hard Deletion Protection in Microsoft Entra ID

Administrators need at least the Microsoft Entra Backup Administrator role to configure the feature.

To enable it, open the Microsoft Entra admin center, go to Backup and recovery > Hard deletion protection, and select Add protection. Choose an object type, select up to 20 objects of that type, review the warning, and click Save.

Microsoft recommends carefully selecting which objects to protect because administrators cannot reverse the configuration.

Hard Deletion Protection is available in public preview

Microsoft Entra ID Hard Deletion Protection is currently in public preview, and the company has not announced a general availability date.

The feature provides an additional safeguard against accidental deletion and malicious administrative activity, particularly for organizations that need more time to recover critical accounts.

However, the irreversible configuration means administrators should evaluate which objects require protection before enabling it.

In other news, Microsoft recently announced new MFA, security, and AI agent features for Entra.

The company also introduced telephony providers ahead of the 2027 SMS retirement and urged Entra ID users to switch from SMS authentication to passkeys.

Via Neowin