billed monthly, in advance
| Scope | Entra ID configuration: users, groups, roles, applications, conditional-access policies |
|---|---|
| Retention | Unlimited, well past Microsoft's approximately 30-day window for deleted objects |
| Monitoring | Real-time change detection against last-known-good values |
| Search | By specific data attribute, without trawling raw audit logs |
| Export | Open-standard export of retained data |
| Recovery | Rollback of unwanted changes, seconds to minutes |
| Encryption | AES-256 at rest and in transit |
| Custody | Held outside the directory it protects |
| Billing unit | Per tenant, per month |
Everything authenticates against this
Entra ID determines who your people are and what they are permitted to open. Email, files, finance systems, the VPN, and the whole software estate all defer to the directory. Microsoft's own retention of deleted directory objects expires at approximately one month, which covers an accident noticed on Tuesday and nothing noticed later than that.
The failures here are quiet ones. A conditional-access policy edited into uselessness. A sync change that strips group memberships across a department. A role assignment that appears one evening and is never questioned. Directory damage does not announce itself the way a failed server does. You discover it when something that should have been blocked was not.
How it runs
Continuous capture of the directory's configuration, covering users, groups, roles, applications, and conditional-access policies, with unlimited retention and open-standard export, so history is not held hostage by the subscription that created it. Alongside it, real-time change monitoring reports each modification as it lands, paired with the value it replaced. Querying one attribute directly replaces reading raw audit logs in search of a needle you could not describe in the first place.
Change visibility is detection
Every other system trusts this one, and until now it was the only system with no independent record of itself. That record is encrypted and kept outside the directory it describes, so somebody operating inside Entra ID cannot quietly edit the account of what they did there.
The monitoring is the second half of the control. Weakening a control leaves a diff: an exclusion added to a multi-factor rule, a legacy authentication path switched back on, a service principal granted permissions nobody requested. Each reads as a change against last-known-good rather than as noise in an audit log, and each tends to arrive before the loud part of an intrusion rather than after it.
Getting it back
Reverse a change, whether a group somebody removed, an access rule edited into nonsense, or an entire hostile session's worth of edits, in seconds to minutes. The alternative is rebuilding the directory from memory and screenshots across a weekend: slow, approximate, and completed by nobody who then felt confident about it.
Where this line stops
Entra ID covers the directory's configuration, not the content of the services it authenticates. Mail, files, Teams, and SharePoint require Microsoft 365 alongside it. One line covers one tenant whatever its user count, which makes it the least expensive insurance in the catalog relative to what its absence costs.