Microsoft Entra ID Hard Deletion Protection: Configure the 7-Day Safety Hold & Prevent Irreversible Erasure

In Microsoft Entra ID, deleting an identity or application normally moves the object into a soft-deleted state (the directory recycle bin) for 30 days. During this window, an administrator can quickly restore the object with zero loss of group memberships, licenses, or app role assignments.

However, advanced threat actors and disgruntled administrators know that this 30-day safety net can be immediately bypassed: by executing a permanent hard deletion (Remove-MgDirectoryDeletedItem), an attacker can permanently purge critical service principals, corporate applications, or security groups in seconds—rendering them completely unrecoverable.

To eliminate this catastrophic attack vector, Microsoft introduced Hard Deletion Protection (Public Preview) in Microsoft Entra ID. In this guide, we dive into how the 7-day holding window functions, the critical caveat regarding permanent protection, and how to manage protected assets using the Entra admin center and Microsoft Graph.

How Hard Deletion Protection Works: The 7-Day Buffer

Hard Deletion Protection does not stop normal soft deletions. Instead, it places a cryptographic safety lock on the permanent deletion pipeline:

The Core Mechanics:

1. Soft Deletion Still Works: An administrator or lifecycle script can still soft-delete the object. When soft-deleted, sign-ins stop, and token issuance halts immediately.
2. Hard Deletion is Blocked for 7 Days: If anyone (including a Global Administrator) calls DELETE /directory/deletedItems/{id} during the first 7 days, Entra ID rejects the request with an authorization error.
3. If Restored: If the object is restored within the 7-day window, Hard Deletion Protection remains enabled. If the object is deleted again in the future, a fresh 7-day lock begins.
4. After 7 Days: On day 8, the lock lifts. The object remains in the recycle bin until day 30, but administrators can now permanently purge it if desired.

Critical Rules & Limitations

Before enabling this feature across your tenant, understand these essential constraints:

• Protection is Permanent and Irreversible: Once you enable Hard Deletion Protection on a user, group, application, or service principal, you cannot disable, remove, or opt out of protection. If you protect an object by mistake and need to delete it, your only choice is to soft-delete it and wait 7 days for the lock to expire.
• Supported Object Types (Cloud-Only):

- Cloud-only users (hybrid/on-prem synchronized users via Entra Connect are not supported). - Cloud-only security groups and Microsoft 365 Groups. - Applications (App Registrations). - Enterprise Applications (Service Principals).

• Required Administrative Role: You must be assigned the Microsoft Entra Backup Administrator role. Even Global Administrators cannot configure protection without this specific role active.
• Batch Limits: In the preview interface, you can select and protect up to 20 objects per operation.

Step-by-Step: Enabling Hard Deletion Protection

Method 1: Via the Microsoft Entra Admin Center

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) with an account assigned the Backup Administrator role.
2. In the left navigation pane, navigate to Protection > Backup and recovery > Hard deletion protection (or search for Protection against permanent deletion).
3. Select the object category you want to safeguard:

- Users - Groups - Applications - Service principals

1. Click + Add objects, select up to 20 critical production objects (e.g., your primary SSO Enterprise Applications, PIM-enabled security groups, or break-glass cloud accounts), and click Select.
2. A confirmation dialog will appear warning that this action is irreversible. Click Enable protection.

Method 2: Audit & Monitor Protected Objects via Microsoft Graph PowerShell

To monitor which objects have been soft-deleted and track their remaining holding window:

# Connect to Microsoft Graph with Directory permissions
Connect-MgGraph -Scopes "Directory.Read.All", "AuditLog.Read.All"

# Query soft-deleted items currently in the recycle bin
$deletedItems = Get-MgDirectoryDeletedItem -All

$report = foreach ($item in $deletedItems) {
    $deletedDate = [datetime]$item.DeletedDateTime
    $holdingExpiration = $deletedDate.AddDays(7)
    $now = Get-Date

    $lockStatus = if ($now -lt $holdingExpiration) {
        $daysLeft = [math]::Round(($holdingExpiration  $now).TotalDays, 1)
        "Locked ($daysLeft days remaining)"
    } else {
        "Lock Expired (Hard Deletion Allowed)"
    }

    [PSCustomObject]@{
        DisplayName        = $item.AdditionalProperties["displayName"]
        ObjectType         = $item.AdditionalProperties["@odata.type"]
        Id                 = $item.Id
        DeletedDateUTC     = $deletedDate
        HardDeleteAllowed  = $holdingExpiration
        ProtectionStatus   = $lockStatus
    }
}

$report | Format-Table -AutoSize

Auditing Protection Events in Entra Audit Logs

• Service: Core Directory
• Category: DirectoryManagement
• Activity: Set hard deletion protection
• Initiated By: The UPN of the Backup Administrator.

Best Practices for Enterprise Tenants

1. Protect Tier-0 Identity Assets First: Enable Hard Deletion Protection on core line-of-business App Registrations, emergency break-glass administrator accounts, and high-privilege PIM role groups.
2. Combine with Privileged Identity Management (PIM): Ensure the Backup Administrator role requires an approved PIM activation request with multi-factor authentication (MFA) and ticket justification.
3. Configure Alerting on Soft-Deletions: Set up an alert rule in Microsoft Sentinel or Defender XDR triggering whenever a protected service principal is soft-deleted, allowing your SecOps team to investigate before day 7.

Related Guides

• Auditing & Remediating Entra Dynamic Groups MemberOf Deprecation
• Configure Entra ID Passkey (FIDO2) Registration Campaigns
• Find Users at Risk: SSPR Registered Methods Enforcement