IT Auxilium / GP IT Services / Health IT Services

Backup for Microsoft Entra ID

Datto Backup for Microsoft Entra ID provides automated, secure backup and rapid recovery of Entra ID users, groups and roles, protecting identity data from accidental deletion, misconfiguration, cyber incidents and service disruption.

Features

• Automated, scheduled backups of Microsoft Entra ID directory objects
• Point-in-time recovery for users, groups and role assignments
• Rapid restore to original tenant or alternate Entra ID tenant
• Protection against accidental deletion, misconfiguration and malicious changes
• Centralised multi-tenant management through a single cloud console
• Secure storage with encryption, role-based access and audit logging
• Infinite retention supporting compliance, governance and long-term recovery needs
• Frequent backups providing granular recovery with minimal identity data loss

Benefits

• Rapid identity recovery minimises downtime after errors incidents or outages
• Protects critical access data beyond Microsoft native retention limitations periods
• Reduces operational risk from misconfiguration accidental deletion and insider mistakes
• Simplifies compliance with auditable backups long term retention and restores
• Enables fast secure restores without rebuilding users groups or permissions
• Centralised management improves visibility control and efficiency across multiple tenants
• Automated backups reduce reliance on manual processes and human intervention
• Strengthens business continuity for cloud identity services supporting Microsoft ecosystems

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@healthitservices.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

386708346195918

Contact

Sales - Health IT Services
01223 827 410
sales@healthitservices.co.uk

About your service

• Service categories:

  Applications

  Collaborative

  • Email
  • Enterprise community
  • Team collaboration
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Yes. The service is an add-on cloud backup solution that extends Microsoft Entra ID by providing independent backup and recovery capabilities. It can be purchased as a standalone service or bundled alongside other Datto or Kaseya cloud protection services but it operates separately from Microsoft’s native Entra ID functionality.
• Cloud deployment model: Private cloud
• Service constraints: Buyers should note that the service protects only Microsoft Entra ID directory objects and does not cover wider Microsoft 365 data such as email or files. Backups run on a scheduled basis, up to six times daily, so changes between backups may not be captured. The service depends on correct permissions and continuous connectivity to the Entra ID tenant, meaning misconfiguration can interrupt protection. Restores are limited to data contained within available backups and cannot recover information created before the first successful backup.
• System requirements:
  • Active Microsoft Entra ID tenant with global administrator permissions granted
  • Supported Microsoft 365 or Azure subscription associated with Entra ID
  • Internet connectivity allowing secure API access between Datto and Microsoft
  • Enabled Microsoft Graph APIs required for identity backup operations processing
  • Modern web browser for accessing Datto management and reporting console
  • Multi-factor authentication enabled for administrative access to Datto platform services
  • Appropriate role-based access control configured within Microsoft Entra ID environment
  • Supported geographic region for Datto cloud backup data residency compliance
  • Valid Datto Backup for Microsoft Entra ID subscription licence active
  • Agreement to Datto terms security policies and service conditions documentation

User support

• Email or online ticketing support: Yes
• Support response times: 08:00 to 18:00 Monday to Friday, excluding Bank and Public Holidays. 24x7 cover if the client has OOH support add-on.; ; 30 min to 4 hour response dependent on priority call:; P1 - 30 mins,; P2 - 2 hours,; P3 - 4 hours; P4 - 4 hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Web chat is available once logged into our Support Portal. Users can ask questions and the bot will either signpost to the necessary support article or suggestion a resolution based on it's learning from tickets logged/resolution notes/ongoing learning the bot undertakes. The bot will not provide data or information from other customers, but may use learning from others to help support an answer.
• Web chat accessibility testing: Users can use speech to text in order to detail their issues and respond.
• Onsite support: Yes, at extra cost
• Support levels: We provide three support levels to meet different operational needs. Standard Support is included as part of the service and offers business-hours access to the service desk, incident logging, diagnostic assistance and help with backup or restore activities. Buyers also receive access to online documentation at no extra cost. Enhanced Support is available for buyers who require extended assistance. It provides longer support hours, priority incident handling, proactive monitoring of backup activity and optional service reviews. This level is charged as a fixed monthly fee per tenant, with pricing dependent on the size and complexity of the environment. Premium Support is designed for organisations with higher resilience requirements. It offers extended-hours or full 24/7 incident response, priority restoration for critical issues, regular performance reporting and fast escalation to senior engineers. Pricing is bespoke and agreed based on user numbers and required response targets. A dedicated Technical Account Manager or Cloud Support Engineer can be provided on request. This optional service includes ongoing configuration guidance, scheduled reviews and support with complex restorations. It is charged either as a monthly retainer or on a day-rate basis depending on the level of engagement required.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We provide a structured onboarding process to help users begin using the service quickly and confidently. Setup is completed via a secure, web-based console, where administrators are guided through authorising access to their Microsoft Entra ID tenant and configuring backup schedules and retention settings. Comprehensive online documentation, knowledge base articles and step-by-step setup guides are available to support self-service onboarding. In-product prompts and status dashboards help users verify successful configuration and ongoing protection. While onsite training is not typically required due to the SaaS-based nature of the service, remote support and technical assistance are available to address questions, troubleshooting and best-practice configuration, ensuring users can begin using the service quickly and confidently.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: When the contract ends, users can extract their data by initiating restores from the Datto management console prior to service termination. Using authorised access, administrators can restore Microsoft Entra ID objects such as users, groups and roles back into the original tenant or an alternate tenant under their control. Datto does not impose proprietary lock-in on the identity data itself, which remains within the customer’s Microsoft Entra ID environment after restoration. Once the contract has ended and access is removed, Datto securely deletes retained backups in line with its data handling and retention policies.
• End-of-contract process: At the end of the contract, access to the service is withdrawn and scheduled backups cease. Prior to termination, customers are expected to complete any required restores of Microsoft Entra ID data using the Datto management console. Once the contract has ended, retained backups are securely deleted in accordance with Datto data retention and security policies. No customer data is retained beyond this point unless required for legal or regulatory reasons.; ; The contract price typically includes automated scheduled backups of Microsoft Entra ID, secure cloud storage, access to the web-based management console, monitoring and alerting, role-based access controls and standard technical support. Additional costs may apply for premium support tiers, bundled service packages, or licensing arrangements that include the service as part of a wider Datto or Kaseya subscription. There are no on-premises infrastructure costs, as the service is delivered entirely as a cloud-based SaaS solution.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Our onboarding and offboarding documentation is delivered through a secure, browser-based knowledge portal accessible on any modern device. Content is structured with clear headings, readable layouts and screen-reader compatibility. Users can navigate using keyboard controls and adjust display settings for visibility needs. Documents are available in standard web formats to support assistive technologies, and key guides can be downloaded for offline use. This ensures administrators with a range of accessibility requirements can follow setup and offboarding steps without barriers.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service interface is a secure, web-based management console provided by Datto. It offers a clear, intuitive dashboard for configuring backups, monitoring status and performing restores across one or multiple Microsoft Entra ID tenants. Administrators can view backup history, initiate point-in-time recoveries and manage alerts from a single pane of glass. The interface supports role-based access controls, audit logging and multi-tenant visibility, making it suitable for both internal IT teams and managed service providers supporting multiple customer environments within Microsoft ecosystems.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is accessible via a secure, web-based portal hosted by Datto. Administrators access the platform using standard web browsers with role-based authentication and multi-factor security controls. The service connects remotely to the customer’s Microsoft Entra ID tenant using authorised APIs, requiring no on-premises software installation. Access can be granted to internal IT teams or managed service providers, enabling centralised management, monitoring and recovery from any location with an internet connection.
• Accessibility testing: The service interface follows standard web accessibility best practices implemented by Datto, including support for keyboard navigation, screen readers and scalable text. Datto undertakes internal usability and accessibility testing as part of its broader product development lifecycle, aligning with recognised accessibility standards for web-based SaaS platforms. While the service is not a specialist assistive-technology application, accessibility considerations are incorporated into interface design, ensuring the console remains usable for administrators relying on common assistive technologies.
• API: No
• Customisation available: Yes
• Description of customisation: Users can customise the service through the web-based management console provided by Datto. Administrators can define backup schedules, retention policies and alerting preferences to meet operational and compliance requirements. Access can be tailored using role-based permissions, enabling appropriate separation of duties. Restore options can be selected to target specific users, groups or roles within Microsoft Entra ID, allowing flexible recovery aligned to business needs.

Scaling

• Independence of resources: The service is delivered as a multi-tenant SaaS platform designed to scale securely and reliably for all customers. Datto uses logically isolated tenants, workload segregation and elastic cloud infrastructure to ensure one customer’s activity does not impact another’s performance or data protection. Backup and restore operations are rate-controlled and managed through Microsoft-supported APIs, preventing resource contention within Microsoft Entra ID. Continuous monitoring, capacity management and automated scaling ensure consistent performance, availability and reliability regardless of overall platform demand.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide operational metrics through a web-based dashboard delivered by Datto. Metrics include backup success and failure status, last successful backup time, backup frequency, protected object counts and restore activity history. Administrators can view alert status, error reporting and audit logs to support monitoring and compliance. These metrics give clear visibility into the protection of Microsoft Entra ID data, enabling users to confirm service health, identify issues quickly and demonstrate backup coverage during audits or reviews.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Datto/Kaseya

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users export their data by restoring Microsoft Entra ID objects from the web-based management console provided by Datto. Administrators can select specific users, groups or roles and restore them into the original or an alternate Microsoft Entra ID tenant under their control. The service does not export identity data as flat files; instead, data is returned directly to Entra ID in its native format, ensuring continuity, integrity and immediate usability within the Microsoft cloud environment.
• Data export formats: Other
• Other data export formats:
  • Users cannot export data in open file formats.
  • The service restores identity data back into Microsoft Entra ID.
• Data import formats: Other
• Other data import formats:
  • Users do not upload data in open file formats.
  • The service operates by connecting directly to Microsoft Entra ID.

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Datto does not provide a cloud uptime SLA.
• Approach to resilience: This is available on request (subject to an NDA)
• Outage reporting: Datto Infrastructure status may be monitored at https://status.datto.com/.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to Datto Entra ID Backup is restricted through secure authentication and role-based permissions. The management console enforces role-based access control, ensuring users can only view or perform actions appropriate to their assigned permissions. Strong authentication is required, including multi-factor authentication, with access logged and auditable. Support channel access is restricted to authorised contacts verified through account credentials and identity checks. Privileged access is limited to trained personnel and granted on a least-privilege basis. Integration with Microsoft Entra ID further supports secure identity management and access governance across customer environments.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • Other
• Other security governance standards: ITAuxilium is Cyber Essentials accredited. We also follow the UK GDPR and the Data Protection Act 2018, NCSC Cloud Security Principles and follow the service management practices of ITIL.
• Information security policies and processes: ITAuxilium is Cyber Essentials accredited. We also follow the UK GDPR and the Data Protection Act 2018, NCSC Cloud Security Principles and follow the service management practices of ITIL.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We operate a structured configuration and change management process that tracks all service components through their full lifecycle using controlled configuration records and documented versioning. Proposed changes are logged, reviewed and risk assessed before approval. Each change undergoes a security impact assessment to evaluate effects on data protection, access controls and service stability. Approved changes follow a scheduled deployment process with testing, rollback planning and post-implementation review. This ensures components remain current, secure and fully traceable while minimising disruption to users.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We operate a continuous vulnerability management process that monitors, assesses and mitigates threats to the service. Potential vulnerabilities are evaluated using recognised risk frameworks, considering severity, exploitability and potential impact on confidentiality, integrity and availability. Security patches and updates are prioritised based on criticality, with high-risk vulnerabilities addressed as quickly as possible, typically within vendor-recommended timeframes. Threat intelligence is sourced from trusted industry feeds, vendor advisories, NCSC alerts and recognised security communities. Regular scanning and ongoing monitoring ensure new risks are identified promptly, and remediation actions are tracked through to completion.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use continuous protective monitoring to detect unusual activity or indicators of compromise across the service. Automated alerts highlight anomalies such as failed backups, unexpected access attempts or abnormal system behaviour. When a potential compromise is identified, it is immediately escalated to the security team for investigation, containment and verification. Confirmed incidents follow a defined response process that includes isolation, remediation and communication with affected users. Response to high-severity incidents begins immediately, with lower-level events handled within standard operational timeframes. This approach ensures timely detection, rapid assessment and effective mitigation of security threats.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a structured incident management process with predefined procedures for common events such as failed backups, access issues and suspected security incidents. Users can report incidents through the service desk by email or via the support portal, where tickets are logged and prioritised. Each incident is handled using a standard workflow covering triage, investigation, resolution and communication. For higher-severity events, we provide formal incident reports that outline the cause, actions taken and any recommended improvements. Reports are shared with authorised administrators once the incident is closed, ensuring transparency and clear auditability.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We can offer a free trial of Datto Backup for Microsoft Entra ID, subject to eligibility. This allows customers to evaluate backup, monitoring and restore capabilities before committing to a paid subscription.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: De0ed732-62b1-4b95-bbe5-a7039e7eb424
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@healthitservices.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.