I'm looking for a reliable way to take configuration snapshots of our Microsoft 365 tenant, including Entra ID, Intune, Defender, and related services. The main goal is to protect against accidental policy changes as well as the more serious possibility of having to rebuild the entire tenant and recover years of configuration work.
I've tried Microsoft 365 DSC, but the setup and documentation have been difficult to work through. I'm also trialling NinjaOne SaaS Backup for data protection, although it doesn't currently provide tenant-configuration snapshots. What tools or approaches would you recommend for configuration backup and disaster recovery?
4 Answers
Entra Backup and Recovery may cover part of the requirement, especially for Entra-related configuration. You’d still need to verify whether it handles the Intune, Defender, and wider tenant settings you want to protect.
Veeam is worth investigating, but be aware that Entra and the rest of Microsoft 365 are handled as separate products. It can provide broader coverage, although the licensing cost may be significant.
Before choosing a product, define whether you need point-in-time comparison, recovery from accidental changes, or the ability to recreate an entire tenant. A configuration backup does not necessarily mean you can create a new tenant and restore everything automatically, especially for identity relationships, service-specific settings, and dependencies. Test any proposed solution by exporting the configuration and rebuilding a representative environment.
For a complete configuration-as-code approach, Microsoft 365 DSC is still probably the closest fit. The initial setup is frustrating and the documentation assumes more DSC knowledge than many administrators have, but it can be integrated with Azure DevOps for version control, approvals, and repeatable deployments.
ScubaGear is another useful option if your main goal is detecting configuration drift and comparing snapshots. It’s lighter to deploy, but it should be viewed as an assessment and comparison tool rather than a full restore solution.
That matches my experience. The setup guide feels like it assumes too much prior knowledge, but it may still be worth investing the time because it covers the widest range of requirements without adding another major licensing cost. I’m mainly preparing for a full-tenant rebuild, while also wanting protection from accidental changes to the Intune and Defender configurations.