I'm looking for a way to capture configuration snapshots and support disaster recovery for our Microsoft 365 tenant, including Entra ID, Intune, Defender, and other services. I've tried Microsoft 365 Desired State Configuration (DSC), but the setup and documentation have been frustrating. I'm also evaluating NinjaOne SaaS Backup for data protection, although it doesn't currently provide tenant configuration snapshots. Ideally, I'd like protection against accidental policy changes as well as the possibility of rebuilding a tenant while preserving years of Intune and Defender configuration.
4 Answers
Veeam has options covering Microsoft 365 and Entra-related protection, but they can be expensive, and tenant configuration management is still evolving. Also, make sure you distinguish data backup from configuration backup: having backed-up mail, files, or identities does not necessarily mean you can create a new tenant with all Intune, Defender, and policy settings restored automatically.
ScubaGear is worth considering if your main goal is configuration assessment and drift detection. It’s lighter to deploy and can help identify changes against a baseline, but it isn’t a full backup or restore solution. It won’t recreate an entire tenant for you.
The right choice depends on whether you’re mainly defending against accidental changes or planning for a complete tenant rebuild. For the former, configuration exports, scheduled comparisons, and approval workflows may be enough. For the latter, test the exports by attempting to recreate the configuration in a separate environment—some settings have dependencies, licensing requirements, or service-specific limitations, so no product should be assumed to provide a perfect one-click tenant restore.
Microsoft 365 DSC is still probably the most complete option for this use case. The initial setup is painful, but once it’s working you can store the configuration in source control and run it through Azure DevOps with approvals and change tracking. It’s useful for both drift detection and recreating configuration, although it does require ongoing maintenance and familiarity with PowerShell DSC.
That distinction is important. The main concern is preserving the years of Intune and Defender configuration in case we ever have to rebuild the tenant, not just recovering user data.