Microsoft Entra admin center
Conditional Access, authentication methods, named locations, cross-tenant access, roles, app consent, identity governance.
484 setting types across 9 Microsoft admin centers.
Every paid plan backs up and compares every type; 386 of them are restored automatically. What grows from release to release is how many of them the app also restores automatically.
244Restored in full
Changed items are updated and missing items are recreated.
142Settings put back
Tenant-wide settings and built-in objects: the saved values go back on the object that still exists.
98Restored by hand, guided
Backed up and compared like the others. A walk-through or a restore script takes you through putting the saved values back.
Each type is restored automatically or by hand, with the saved values shown; the product says which, and more types become automatic with each release. Figures from catalog version 8.
By admin center
What each admin center contributes.
A type that appears in two admin centers, such as a Defender policy that Exchange also shows, is counted in both.
Microsoft Intune admin center
Compliance policies, configuration profiles, settings catalog, endpoint security, app protection, enrollment, update rings.
Exchange admin center
Mail flow rules, connectors, accepted and remote domains, DKIM, organization and transport settings.
Microsoft Defender portal
Anti-phishing, anti-spam and anti-malware, Safe Links, Safe Attachments, the tenant allow and block list.
Microsoft Purview portal
Retention and data loss prevention policies, sensitivity labels and label policies, audit settings.
SharePoint admin center
Tenant-wide sharing and access settings.
Teams admin center
Meeting, messaging, calling and app policies, external and guest access.
Microsoft 365 admin center
Organization settings, security and privacy settings, and services exposed to administrators.
Power Platform admin center
Environments, data policies and tenant settings.
Restored automaticallyRestored by hand, guided
| Admin center | Setting types |
|---|---|
| All admin centers | 484 |
Limits
What it does not cover.
Knowing the edges of a backup matters as much as knowing what is in it.
User data
Mail, files, chats, sites and their content are never read. 365 Rewind is a configuration backup; pair it with a backup of user data.
Settings with no interface
Some switches in the admin centers can be changed by a person but not read by any program. No product can back those up; the portal's coverage list names each one, with what to write down by hand.
Users, groups and their members
A restore does not recreate users or groups. A policy that names a deleted group is restored with that reference reported as missing, so you can fix it.
Signed-in customers see the full list, area by area, on the portal's coverage page, including the areas that are planned and those no product can back up today.
Check it against your own tenant.
The free Preview backs up a sample of 10 setting types of your tenant, up to 3 times. See how a backup reads, item by item, then choose a plan to back up everything.