Identity backups are dedicated recovery copies of directory and authentication systems such as Active Directory, Entra ID, or Okta. They preserve the data and configuration needed to rebuild accounts, groups, policies, trust relationships, and access controls after disruption. Unlike ordinary file backups, they are designed to restore the identity layer itself, not just the servers that host it.
They matter because identity is often the control plane for an entire network. In ransomware attacks, criminals may delete, encrypt, or tamper with directory services to block logins, reset privileges, or force defenders into unsafe recovery steps. Proper identity backups let teams recover cleanly, verify privileged access, and avoid rebuilding critical permissions from scratch. In defense, these backups should be isolated, regularly tested, and protected from the same attack paths that threaten production identity systems.