MC1183299 – M365 Change Digest

One-line summary

Microsoft Entra adds soft deletion for cloud security groups, allowing restoration within 30 days to recover settings, ownership, and membership, reducing rebuild needs after accidental or malicious deletion.

Similar updates

Details

Summary

Microsoft Entra introduces soft deletion and restoration for cloud security groups, allowing recovery within 30 days while preserving settings, ownership, and membership. Rollout begins in late October 2025 (preview) and February 2026 (general availability). Deleted groups remove access until restored; audit logs track actions.

Body (from Message Center)

To help organizations recover from accidental or malicious deletions, Microsoft Entra is introducing soft deletion and restoration for cloud security groups. This feature allows deleted groups to be restored within 30 days, preserving their settings, ownership, and membership—reducing the need to rebuild access models from scratch.

[When this will happen:]

Public preview: Rollout began in late in October 2025 and is expected to complete by early November 2025.
General availability (Worldwide): Rollout begins in late February 2026 and is expected to complete by early March 2026.

[How this affects your organization:]

Who is affected:

Admins managing Microsoft Entra cloud security groups.
Users whose access is governed by security groups.

What will happen:

Deleted cloud security groups will enter a soft deleted state and appear in the Deleted groups blade.
During soft deletion:
- Access granted via the group is removed.
- The group is restorable for up to 30 days.
After 30 days, the group is permanently deleted.
Restoration recovers:
- Group properties (name, description, type)
- Settings (roles, policies)
- Ownership and membership (assigned and dynamic)
Admin tools supported:
- Microsoft Entra admin center
- Microsoft Graph
- PowerShell
Audit logs will capture deletion, restoration, and hard delete actions.
Users lose access via the group during soft deletion; restoring the group reapplies access based on the group’s previous configuration.
If a resource (for example, a SharePoint site, app, or policy scope) is protected by a soft deleted group, affected users immediately lose access via that group. If users had direct or alternate access paths, those remain unchanged.

[What you can do to prepare:]

Identify critical groups:
- Inventory and tag critical security groups that gate access to sensitive resources.
Update admin runbooks:
- Add steps to restore a deleted group before attempting to rebuild it.
Test in a pilot (after preview reaches your tenant):
- Create a test security group, grant it access to a nonproduction resource, soft delete, validate access removal, then restore and confirm access returns as expected
- If you automate group management, validate your automation handles soft deleted objects and does not immediately hard delete them.
Communicate to helpdesk and resource owners:
- Create guidelines on how to check deleted groups, how to restore, and when to escalate before recreating a group.

Learn more:

MS Graph documentation:

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-02-25T00:00:00Z",
    "ai_actions": [
      "Inventory and tag critical security groups",
      "Update admin runbooks for group restoration",
      "Test soft deletion and restoration in pilot",
      "Validate automation handles soft deleted groups",
      "Communicate restoration guidelines to helpdesk"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Microsoft Entra adds soft deletion for cloud security groups, allowing restoration within 30 days to recover settings, ownership, and membership, reducing rebuild needs after accidental or malicious deletion.",
    "ai_topics": [
      "Entra"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Entra introduces soft deletion and restoration for cloud security groups, allowing recovery within 30 days while preserving settings, ownership, and membership. Rollout begins in late October 2025 (preview) and February 2026 (general availability). Deleted groups remove access until restored; audit logs track actions."
    },
    "id": "MC1183299",
    "importance": 3,
    "is_major_change": false,
    "last_modified": "2025-11-06T00:20:24Z",
    "ms_products": [
      "Entra"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra"
    ],
    "severity": "normal",
    "tags": [
      "New feature",
      "User impact",
      "Admin impact"
    ],
    "title": "Microsoft Entra: Soft deletion and restoration for cloud security groups"
  }
}