Azure Active Directory Recycle Bin Won’t Save You in a Cyber Disaster

cyber security

Greg Jones, Senior Product Manager, Semperis, explains the issues with relying on Azure AD recycle bin to help you in the event of a cyber attack

The ability to reverse mistakes has probably saved every Active Directory admin worldwide at least one stress-induced headache during their career. For on-premises AD deployment, the Active Directory Recycle Bin feature allows admins to restore accidentally deleted objects without using a backup.

Anything placed in the Recycle Bin is accessible for 180 days. If you make a mistake, the Recycle Bin can be a godsend, and IT teams considering Azure Active Directory will be happy to know that the cloud service has a Recycle Bin feature of its own. 

However, what might surprise them is that there are differences between the on-premises AD Recycle Bin and what is available in the cloud. As useful as the Recycle Bin is, it is not a panacea for your Azure AD resources backup and recovery needs. To understand why let’s talk about the feature’s functionality.  

Before moving to Azure AD, organizations should first assess the impact of the change on their security, data backup, and compliance. Though the Recycle Bin function might seem like a relatively minor matter, the reality is that without it, bringing back deleted objects would become a manual, time-consuming process. Both on-premises and in the cloud, enabling the Recycle Bin makes life easier. Still, as part of assessing your move to the cloud and the functionality of Azure AD, it is essential to understand what the Recycle Bin does and does not do. 

We all make mistakes. Just like in your on-premises AD environment, the Recycle Bin in Azure AD allows administrators to restore user objects in the event of accidental deletion. However, all objects are not protected. The Recycle Bin feature for Azure AD enables the recovery of only user objects, application objects, and Office 365 groups.

Delete a setting, and the Azure AD Recycle Bin will not help. If you are using Azure AD sync and accidentally delete an on-premises AD user object, the corresponding user object in Azure AD will also be deleted during the next sync cycle.  

User objects do not stay in the soft-deleted state for 180 days. This timeframe is a significant difference between Azure and on-premises AD. In Azure, deleted objects are kept only for 30 days. This time limit cannot be extended. After 30 days, the objects are hard-deleted. 

Modified object attributes cannot be recovered. While a user object can be brought back from accidental deletion via the Recycle Bin feature, specific attributes cannot be. The only way to restore modified attributes is through backups, which brings us to our next point. 

The Recycle Bin cannot serve as a replacement for backups. It is only a starting point. While its functionality might be enough to reverse deleted object mistakes, its limitations preclude it from being a solution to your backup and recovery needs. Enabling the Recycle Bin feature in Azure AD offers protection for a particular scenario. However, if your organization needs to restore information such as modified attributes or recover certain types of objects, the Recycle Bin will not suffice. 

In the event of a ransomware attack, for example, the Recycle Bin is of no use if, for example, user accounts are compromised. In that case, the Recycle Bin won’t help with recovering those accounts. Additionally, the fact that it can be used only to recover a specific type of object that has been deleted for 30 days or less also makes it a non-viable solution for your longer-term backup and recovery needs.  

From the standpoint of an attack, if one of the threat actor’s activities involves deleting users, they will likely go to the Recycle Bin to finish the job. This final deletion will make it impossible to recover the user object without using a backup. But more likely, an attacker will change settings such as changing role assignments, turning off multifactor authentication, and altering conditional access policies. 

Without a single spot where administrators can go to evaluate every setting that has been changed, they will be left to remember and manually fix all of the modified configurations. In this reality, failing to monitor activity across on-premises and cloud AD environments and failing to implement an effective backup and recovery strategy can lead to disaster. 

Read More:

For organizations to operate in the cloud with confidence, they need the ability to restore their environment anytime unwanted changes are made. The Recycle Bin offers a partial solution to this need but is only one piece of a larger Azure AD security puzzle.  

Click here to discover more of our podcasts

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter

Greg Jones

Greg Jones, Senior Product Manager for Azure Solutions at Semperis, has been focused on directories and messaging throughout his 20+ year career in the tech industry. Greg has had served in various roles which span product management, technical sales, architecture, and administration. He has held positions in both commercial and in the public sector. Greg most recently has focused on SaaS, building both tenant-to-tenant migration solutions and AAD/M365 Management solutions. He has held positions at Quest Software, Dell, and Quadrotech as well as being a veteran of the USAF.

Why microgrids are big news

Craig Tropea • 31st October 2024

As the world continues its march towards a greener future, businesses, communities, and individuals alike are all increasingly turning towards renewable energy sources to power their operations. What is most interesting, though, is how many of them are taking the pro-active position of researching, selecting, and implementing their preferred solutions without the assistance of traditional...

Is automation the silver bullet for customer retention?

Carter Busse • 22nd October 2024

CX innovation has accelerated rapidly since 2020, as business and consumer expectations evolved dramatically during the Covid-19 pandemic. Now, finding the best way to engage and respond to customers has become a top business priority and a key business challenge. Not only do customers expect the highest standard, but companies are prioritising superb CX to...

Automated Testing Tools and Their Impact on Software Quality

Natalia Yanchii • 09th October 2024

Test automation refers to using specialized software tools and frameworks to automate the execution of test cases, thereby reducing the time and effort required for manual testing. This approach ensures that automation tests run quickly and consistently, allowing development teams to identify and resolve defects more effectively. Test automation provides greater accuracy by eliminating human...

Custom Software Development

Natalia Yanchii • 04th October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 04th October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing. At Testlum, we met many software development teams who were pressured to deliver new features and updates at a faster pace. The manual...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 03rd October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing.

Custom Software Development

Natalia Yanchii • 03rd October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...