At some point in every Microsoft 365 environment, something important gets deleted in Microsoft Entra ID. Sometimes it’s intentional cleanup. Sometimes it’s an honest mistake. And occasionally, it’s the result of automation or even malicious activity.
What matters most isn’t just that deletions happen, it’s whether you can detect them early and recover safely. Microsoft Entra ID does provide a recycle bin model for many objects, but the behavior varies by object type, and the recovery window is limited. Let’s walk through this in a real-world way, so you know exactly what to expect and how to protect your environment.
Why Tracking Deletions Matters More Than It Seems
Identity is the control plane of Microsoft 365. When one disappears, the impact often shows somewhere else like a failed sign-in, missing license, or broken automation. Common real-world symptoms after accidental deletion include:
- Users suddenly losing app access
- Group-based licensing stopping
- Conditional Access targeting breaking
- Background jobs failing
- External collaboration issues
Because of these ripple effects, deletion shouldn’t be a one-step action, you should continuously monitor, validate, and review what gets removed.
What Comes Under Microsoft Entra Objects
Before talking about deletion, it helps to understand what we are really deleting. In Microsoft 365, most identity and access components live inside Microsoft Entra ID as directory objects. The most common Microsoft 365 objects include the following.
Users – User objects represent identities that sign in to Microsoft 365, including member users (employees), guest users (B2B collaborators), and service accounts. They are tightly linked to licensing, mailbox provisioning, Teams access, and application sign-ins.
Groups – Groups form the backbone of permission and license management. In Entra ID, you commonly encounter Microsoft 365 groups, security groups, mail-enabled security groups, and distribution lists. These objects often control SharePoint and Teams access, group-based licensing, application permissions, and Conditional Access targeting.
Enterprise Applications (Service Principals) – These objects represent applications integrated with your tenant for single sign-on (SSO), automation, API access, and third-party integrations. Many business workflows depend on service principals.
App Registrations – Closely related to enterprise applications, app registrations define the identity configuration for custom or third-party apps. Although often managed by developers, these objects live in the same identity layer and should be handled with care.
Administrative Units – Less commonly deleted but still important, these objects help scope administration and assign privileges. Mistaken removal can disrupt delegated administration models.
Soft Delete Vs Hard Delete in Microsoft Entra
Microsoft Entra ID supports two deletion behaviors:
Soft Delete – When an item is soft-deleted, it is moved to a “Recycle Bin” for 30 days. During this period, the object retains all its properties, assignments, and permissions and can be fully restored.
Hard Delete – This permanently erases the object from the tenant. It occurs automatically after the 30-day soft-delete window or if an administrator manually purges the item from the Recycle Bin. Hard-deleted objects cannot be recovered by you or Microsoft Support.
The good news is that many high-value objects support soft delete.
Manage Object Deletions in Microsoft Entra
To manage object deletions in Microsoft 365, you have two primary paths: Microsoft 365 admin center or Microsoft Entra admin center for individual tasks and PowerShell for efficient bulk operations.
1. Restoring Users in Microsoft 365
Users remain in a soft-deleted state for 30 days before being permanently purged.
To restore a single user:
- Sign in to the Microsoft admin center.
- Go to Users > Deleted users.
- Check the box next to the user’s name and select Restore user.
To bulk restore users:
There are two ways to do this either via Microsoft Entra admin center or using PowerShell.
To bulk restore deleted users in Entra ID, upload a valid CSV via Bulk restore on the Deleted users page, validate it, and submit to complete the restore.
To bulk restore deleted users via PowerShell, connect to the Microsoft Graph PowerShell module and run the below.
Connect-MgGraph -Scopes "User.ReadWrite.All"
$DeletedUsers = Get-MgDirectoryDeletedItemAsUser -All
foreach ($user in $DeletedUsers) {
Restore-MgDirectoryDeletedItem -DirectoryObjectId $user.Id
} 2. Restoring Groups in Microsoft 365
Microsoft 365 groups and Security groups can get restored. Other group types cannot be restored.
To restore a single group:
- Go to the Microsoft 365 admin center.
- Navigate to Teams & groups > Deleted groups.
- Select the group and click Restore group. Content like SharePoint files and Team conversations will take up to 24-48 hours to fully reappear.
To bulk restore groups:
$DeletedGroups = Get-MgDirectoryDeletedItemAsGroup -All
foreach ($group in $DeletedGroups) {
Restore-MgDirectoryDeletedItem -DirectoryObjectId $group.Id
}3. Restoring App Registrations in Microsoft 365
Apps and their corresponding service principals are recoverable for 30 days in Microsoft 365 environment.
To restore a single application:
- In the Microsoft Entra admin center, go to Applications > App registrations.
- Click on the Deleted applications tab, select your app, and click Restore app registration.
Restoring an app registration usually restores its associated Service Principal automatically, but you should verify both are active.
To bulk restore app registrations:
Prior to initiating the restoration of bulk applications via MS Graph, compile a CSV file listing their user IDs.
$DeletedApps = Get-MgDirectoryDeletedItem
Import-Csv -Path | ForEach-Object {
Restore-MgDirectoryDeletedItem -DirectoryObjectId $_.ApplicationID
} 4. Restoring Deleted Service Principals in Microsoft 365
Service principals may not always appear in a dedicated recycle-bin UI, so PowerShell is typically required.
To restore a single service principal:
Connect-MgGraph -Scopes "Application.ReadWrite.All"
Restore-MgDirectoryDeletedItem -DirectoryObjectId To restore multiple service principals:
Import-Csv -Path | ForEach-Object {
Restore-MgDirectoryDeletedItem -DirectoryObjectId $_.ServicePrincipalID
} 5. Restore Deleted Administrative Units in Microsoft 365
Administrative Units (AU) can also be recovered within the soft-delete window.
To restore a single administrative unit:
Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All"
Restore-MgDirectoryDeletedItem -DirectoryObjectId To restore multiple administrative units:
Import-Csv -Path | ForEach-Object {
Restore-MgDirectoryDeletedItem -DirectoryObjectId $_.AdministrativeUnitID
} Best Practices to Prevent Deletion Surprises
Well-managed environments don’t just recover from deletions, they reduce the likelihood of unexpected ones.
Recommended safeguards include:
- Enable audit log monitoring for delete operations
- Configure alerts for high-risk object removals
- Apply least-privilege administrative roles
- Protect critical service principals and applications
- Review automation scripts that perform cleanup
- Regularly inspect deleted objects in the recycle bin
Object deletion in Microsoft Entra ID is inevitable, but outages and data loss don’t have to be. The platform provides a solid safety net through soft delete, but its safety net is time-bound and object-dependent.
