Description

This article provides an overview of Microsoft Entra ID backup through Dropsuite (now branded NinjaOne SaaS Backup). It covers what the product protects, how it's licensed, the permissions required, and current limitations partners should be aware of before deploying it for their customers.


Requirements

  • A Dropsuite / NinjaOne SaaS Backup Partner Portal login with Owner, Super Admin, or Admin role
  • An existing Backup or Archive plan (Entra Backup is an add-on, not a standalone product)
  • Global Administrator access to the customer's Microsoft 365 tenant to grant the required permissions during setup
  • Either an active NFR licence (for testing) or a paid Entra plan assigned to the organisation


The Process

What Entra Backup Protects

The Entra Backup module covers the key Microsoft identity components in the customer's tenant:

  • Users
  • Groups
  • Roles
  • Admins

Key features include snapshot search, attribute-level restore, and live data comparison, which allow you to identify exactly what's changed and restore specific items rather than rolling back the whole directory.

Licensing and Plan Structure

Entra Backup is sold as an add-on to a standard Backup or Archive plan. The two plan types are:

  • Backup Entra (Backup + Entra)
  • Archiver Entra (Archive + Entra)

Notes on plan changes:

  • Backup Entra can be upgraded to Archiver Entra at any time
  • Downgrading requires a support ticket
  • Once an organisation is on an Entra plan, it cannot be switched back to a non-Entra plan

Creating and Assigning an Entra Plan

  1. Log in to the Partner Portal
  2. Navigate to the Create New Plan page
  3. In the Product Type field, select Backup Entra or Archiver Entra (if the Entra SKU isn't visible, contact support to have it activated)
  4. Set the plan name, currency, periodicity (monthly or yearly), and assign to the relevant partner
  5. Save the plan

Once created, the plan will appear in the plan list with the Entra label and can be assigned to new or existing organisations.

Permissions Required in the Customer Tenant

When setting up Entra ID backup, the following permissions must be granted to the Dropsuite / NinjaOne app:

  • Sign in and read user profiles
  • Read and write custom security attribute assignments
  • Read and write all group memberships
  • Read organisation information
  • Read and write all directory RBAC settings
  • Read and write all users' complete profiles
  • Read and write to all groups

Device Management Policies Covered

Only the following four device management policy types are backed up:

  • DeviceCompliancePolicies
  • CompliancePolicies
  • ConfigurationPolicies
  • DeviceConfiguration

Any other policy type is not supported.

Managing an Entra Organisation

Once an organisation is set up with an Entra plan, the following management actions are available from the Partner Portal:

  • Edit general info (name, email, organisation details)
  • View API token
  • Update subscriptions (plan type or seat count)
  • Suspend subscriptions (login disabled, backups continue)
  • Unsubscribe (login disabled, backups stop)
  • Delete subscriptions (login removed, backups stop, data deleted)
  • Enable or disable features on the End-User Portal
  • View credentials and their statuses

Current Limitations

Partners should be aware of the following before deploying:

  • Organisation deletion from within the Entra portal isn't available yet
  • Organisation transfers must be done manually
  • The "immediate" email notification option appears in the UI but is currently not working. Daily and weekly notifications are reliable
  • Role-based access in the UI only applies to Owner, Super Admin, and Admin roles. Support and Finance roles are not yet fully implemented on the backend
  • End customers cannot manage their own Entra backups, all management sits at the partner level

NFR Licence for Testing

An NFR (Not-for-Resale) licence is available on the Partner Portal. Existing Backup or Archive NFRs now include Entra functionality on paid plan types, which is the recommended way to test the product before rolling it out to customers.

To access Entra Backup on an NFR plan:

  1. Log in to the Partner Portal
  2. Navigate to the Organizations page
  3. Click the Access Entra Portal link for the relevant NFR organisation