Microsoft Built a Delete Lock Even Admins Can't Remove. I Think It's Right (Mostly)

Most software settings follow one quiet rule: whoever turns something on can turn it off again. Microsoft just broke that rule on purpose, and I keep thinking about it.

The feature is called Hard Deletion Protection, and it's in preview in Microsoft Entra, the identity system a lot of companies use for staff logins, groups and apps. Help Net Security and Techzine covered it on November 12. The details are in Microsoft's own docs.

What it actually does

Entra already has two kinds of deletion. A soft delete puts an object in something like a recycle bin, where it normally stays for 30 days. A hard delete empties the bin, and then it's gone for good. Microsoft's backup and recovery tool can't bring hard-deleted objects back. You rebuild them by hand, often with new IDs and all the access links rewired.

The catch is that an admin can hard-delete early. So the 30-day safety net only works as long as nobody with enough rights decides to cut it.

Hard Deletion Protection closes that gap:

• You choose which objects to protect: cloud-only users, cloud-only groups, applications and service principals (up to 20 of one type per operation).
• If a protected object is soft-deleted, nobody can hard-delete it for 7 days.
• If you restore it, it stays protected. Delete it again and a new 7-day window starts.
• And the headline part, straight from the docs: "Protection is permanent. After you enable Hard Deletion Protection for an object, you can't remove or undo the protection."

If you protect something by mistake, the only way out is to soft-delete it and wait a week.

One important thing the headlines skip: it doesn't stop the first delete. The account still gets switched off and whatever depends on it still breaks. What it prevents is the step that can't be reversed.

Why I like it

I've been a developer and team lead for 13+ years, and I've built startups where I was also the person holding every key. Honestly, the risk I worried about most was never a clever outside attacker. It was much more ordinary:

• someone tired running the cleanup script on the wrong environment,
• an over-eager "let's tidy up old accounts" afternoon,
• or the rare person who leaves angry and still has admin rights.

In every one of those cases, time is what saves you. If the damage can be undone for a week, it's an incident. If it can't, it's a post-mortem and maybe a company-ending event.

This is also why the "can't turn it off" part makes sense. A lock the attacker can simply unlock isn't a lock. If someone has stolen an admin account, the first thing they'd do is switch protection off and then wipe everything. Making it permanent takes that move away.

Where I'm less comfortable

There's a fair argument on the other side. It's my company, my tenant, my data. A button that even I can't undo feels like the software deciding it knows better than me.

There are practical costs too. GDPR-style "delete this person now" requests, cleaning up test accounts, or fixing a mistake can all end up waiting a week. For most teams that's an annoyance, not a blocker. Still, it's worth knowing before you click.

My moderate view: use it for the small set of things that would hurt the most (founder and break-glass admin accounts, the main production app, the groups that control access to money and customer data). Don't sprinkle it everywhere.

The check you can do without Microsoft

You may never open the Entra admin center. The idea still applies to any business. Ask three questions this week:

1. Who can permanently delete our most important stuff? That means the code repo, the production database, the domain, the cloud account, the main email inbox. Write the names down. It's usually more people than you think.
2. Is there a delay? Does a delete go to a recycle bin or a soft-delete state first, and can one person empty it immediately?
3. Is there a copy that the same person can't touch? A backup that lives under the same admin account isn't protected against that admin.

If the answer to #2 is "one person, instantly," you have the problem Microsoft just built a feature for. Fixing it is usually cheap: a second approver, a delay, or a separate backup account.

So, would you take it?

I'd turn it on for my most critical accounts and accept the week of waiting as the price of sleeping better. But I understand people who hate the idea of any switch they can't flip back.

What about you: would you accept a setting you can never turn off if it might save your company once? Why?