Azure Active Directory Recycle Bin Won’t Save Your Critical Data

The ability to reverse mistakes has probably saved every Active Directory (AD) admin around the world at least one stress-induced headache during their career.  
 
For on-premises AD deployment, the Active Directory Recycle Bin feature allows admins to restore accidentally deleted objects without using a backup. Anything placed in the Recycle Bin is accessible for 180 days. If you make a mistake, the Recycle Bin can be a godsend, and IT teams considering Azure Active Directory will be happy to know that the cloud service has a Recycle Bin feature of its own. 

 
What might surprise them, however, is that there are differences between the on-premises AD Recycle Bin and what is available in the cloud. As useful as the Recycle Bin is, it is not a panacea for your Azure AD resources backup and recovery needs. To understand why, let's talk about the feature’s functionality.  
 
Fixing Accidents  

Before moving to Azure AD, organizations should first assess the impact of the change on their security, data backup, and compliance. Though the Recycle Bin function might seem like a relatively small matter, the reality is that without it, bringing back deleted objects would become a manual, time-consuming process. Both on-premises and in the cloud, enabling the Recycle Bin makes life easier. 
 
Still, as part of assessing your move to the cloud and the functionality of Azure AD, it is important to understand what the Recycle Bin does and does not do.   

  • Rolling back accidental deletions. We all make mistakes. Just like in your on-premises AD environment, the Recycle Bin in Azure AD allows administrators to restore user objects in the event of accidental deletion. 
  • However, all objects are not protected. The Recycle Bin feature for Azure AD enables the recovery of only user objects, application objects, and Office 365 groups. Delete a setting, and the Azure AD Recycle Bin will not be able to help. If you are using Azure AD sync and accidentally delete an on-premises AD user object, the corresponding user object in Azure AD will also be deleted during the next sync cycle.  
  • User objects do not stay in the soft-deleted state for 180 days. This timeframe is a significant difference between Azure and on-premises AD. In Azure, deleted objects are kept only for 30 days. This time limit cannot be extended. After 30 days, the objects are hard-deleted. 
  • Modified object attributes cannot be recovered. While a user object can be brought back from accidental deletion via the Recycle Bin feature, specific attributes cannot be. The only way to restore modified attributes is through backups, which brings us to our next point. 

Partial Solution 

The Recycle Bin cannot serve as a replacement for backups. It is only a starting point. While its functionality might be enough to reverse deleted object mistakes, its limitations preclude it from being a solution to your backup and recovery needs. Enabling the Recycle Bin feature in Azure AD offers protection for a particular scenario. However, if your organization needs to restore information such as modified attributes or recover certain types of objects, the Recycle Bin will not suffice. 

In the event of a ransomware attack, for example, the Recycle Bin is of no use if, for example, user accounts are compromised. In that case, the Recycle Bin won’t help with recovering those accounts. Additionally, the fact that it can be used only to recover a specific type of object that has been deleted for 30 days or less also makes it a non-viable solution for your longer-term backup and recovery needs.  

From the standpoint of an attack, if one of the threat actor’s activities involves deleting users, they will likely go to the Recycle Bin to finish the job. This final deletion will make it impossible to recover the user object without using a backup. But more likely, an attacker is going to change settings such as changing role assignments, turning off multifactor authentication, and altering conditional access policies. 

Without a single spot where administrators can go to evaluate every setting that has been changed, they will be left to remember and manually fix all of the modified configurations.  

In this reality, failing to monitor activity across on-premises and cloud AD environments and failing to implement an effective backup and recovery strategy can lead to disaster. 

For organizations to operate in the cloud with confidence, they need the ability to restore their environment anytime unwanted changes are made. The Recycle Bin offers a partial solution to this need, but is only one piece of a larger Azure AD security puzzle.  

Greg Jones is Senior Product Manager for Azure Solutions at Semperis

You Might Also Read: 

Detecting & Mitigating Cyber Attacks:

 

« African Nations Join UN Cyber Crime Initiative
SIM Swapping Attacks Caused T-Mobile Breach »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Information Risk Management (IRM)

Information Risk Management (IRM)

IRM is an international consultancy dedicated to helping organisations solve key business issues. We provide strategic cyber security advice across a wide range of sectors.

Irish Reporting & Information Security Service (IRISS)

Irish Reporting & Information Security Service (IRISS)

IRISS-CERT is Ireland's first CSIRT (Computer Security Incident Response Team) to provide services to all users within Ireland.

APMG International (APM Group)

APMG International (APM Group)

APM Group is a global accreditation, certification and examination body specializing in certification schemes for individuals, organizations and software.

TechInsurance

TechInsurance

TechInsurance is America's top technology insurance company offering a range of technology related products including Cyber Liability insurance.

AllegisCyber Capital

AllegisCyber Capital

AllegisCyber is an investment company with a focus on seed and early stage investing in cybersecurity and its applications in emerging technology markets.

Digital Law

Digital Law

Digital Law is the only UK law firm to specialise solely in online, data and cyber law.

Hack The Box

Hack The Box

Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field.

Socure

Socure

Socure’s identity verification increases auto approval rates, reduces false positives and captures more fraud. In real time.

Gijima

Gijima

Gijima is one of SA’s leading ICT companies in Cloud & Outsourcing, Systems integration, Human Capital Management & Training, Cybersecurity, and Unified Communications.

Cognyte

Cognyte

Cognyte is a global leader in investigative analytics software that empowers a variety of government and other organizations with Actionable Intelligence for a Safer World.

StrikeReady

StrikeReady

StrikeReady have developed CARA, an advanced technology solution that offers personalized and proactive assessment and remediation of future and current risk in real-time.

Flexxon

Flexxon

Flexxon is the industry leader to develop NAND flash storage devices. Our key focus is to innovate memory devices ensuring data security and reliability.

Valtix

Valtix

Valtix is the first and only multi-cloud network security platform delivered as a service that enables cloud teams to meet the most stringent security requirements in a cloud-first & simple way.

ThreatNix

ThreatNix

ThreatNix is a tight knit group of experienced security professionals who are committed to providing competent cybersecurity solutions that adhere to international standards.

Cyber Grant

Cyber Grant

Cyber Grant excel in designing cybersecurity solutions for data protection. Our approach and vision, centered on ease-of-use, establish us as a benchmark in the industry for safeguarding information.

TeamSystem

TeamSystem

TeamSystem is a leading tech company in the market for digital business management solutions for companies and professionals.