---
title: "Discussion on \"How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline\" | Hashnode"
description: "Discussion on \"How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline\". EntraExporter + GIT repository + Pipeline + Azure Audit Log = Azure configuration backup solution where even who made the change is back-upped"
url: "https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline](https://doitpshway.com/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline?utm_source=hashnode&utm_medium=feed)

EntraExporter + GIT repository + Pipeline + Azure Audit Log = Azure configuration backup solution where even who made the change is back-upped

Sep 29, 2023 · 10 min read · doitpshway.com  
Updated Dec 16, 2025  
Read the article

-   [#azure](https://hashnode.com/tag/azure)
-   [#backup](https://hashnode.com/tag/backup)
-   [#devops](https://hashnode.com/tag/devops)
-   [#git](https://hashnode.com/tag/git)
-   [#pipeline](https://hashnode.com/tag/pipeline)

## Written by

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

@AndrewZtrhgf · Czech Republic

  
[View profile](https://hashnode.com/@AndrewZtrhgf)

System Administrator that loves PowerShell

I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).

## Responses 7

Markdown supported · ⌘↵ to post

[cmusselman](https://hashnode.com/@cmusselman)

[Jun 4, 2025](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/684088933e51257fc0bc6b64)

Thank you for so quickly fixing the authentication problem. I was troubleshooting and thought I'd check your github to see if you had seen the problem and it was already fixed!

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[Jun 4, 2025](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/684088933e51257fc0bc6b64#reply-684091940d5752f0f6c050e0)

Thats the benefit when the author uses his own creations 😁

[Patrick Tippner](https://hashnode.com/@grunz)

[Oct 23, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/67189d6464c2888b753e372f)

Hi, unfortunately, I'm running into a new issue after I've migrated both the Intune- and Entra-Backup from Service Principals to Workload Federating Identities. The Intune-backup works fine, but Entra backup always stops at a certain point:

Removing existing backup directory

04:01 (UTC) Creating Azure config backup Organization/Organization.json Organization/Branding/Localizations.json Organization/CertificateBasedAuthConfiguration.json Directory/OnPremisesSynchronization.json Export-Entra: /home/it/myagent/\_work/\_temp/eeb6d2b1-b111-46fb-a950-1dca2d9b13d4.ps1:36 Line | 36 | Export-Entra "$root\\prod-backup" -CloudUsersAndGroupsOnly | ~~~~~~~~~~~~~ | GET | [graph.microsoft.com/v1.0/directory/onPremisesSync…](https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization/)**_redacted_** HTTP/2.0 403 Forbidden Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd client-request-id: ff9e6948-885b-4121-8fbe-82290ca98e3c x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"FR2PEPF00000553"}} x-ms-resource-unit: 1 Date: Wed, 23 Oct 2024 02:01:26 GMT Content-Type: application/json Content-Encoding: gzip {"error":{"code":"Authorization\_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2024-10-23T02:01:26","request-id":"4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd","client-request-id":"ff9e6948-885b-4121-8fbe-82290ca98e3c"}}}

##\[error\]PowerShell exited with code '1'.

##\[error\]PowerShell wrote one or more lines to the standard error stream.

##\[error\]Export-Entra: /home/it/myagent/\_work/\_temp/eeb6d2b1-b111-46fb-a950-1dca2d9b13d4.ps1:36 Line | 36 | Export-Entra "$root\\prod-backup" -CloudUsersAndGroupsOnly | ~~~~~~~~~~~~~ | GET | [graph.microsoft.com/v1.0/directory/onPremisesSync…](https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization/)**_redacted_** HTTP/2.0 403 Forbidden Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd client-request-id: ff9e6948-885b-4121-8fbe-82290ca98e3c x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"FR2PEPF00000553"}} x-ms-resource-unit: 1 Date: Wed, 23 Oct 2024 02:01:26 GMT Content-Type: application/json Content-Encoding: gzip {"error":{"code":"Authorization\_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2024-10-23T02:01:26","request-id":"4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd","client-request-id":"ff9e6948-885b-4121-8fbe-82290ca98e3c"}}}

The API permissions are exactly the same as the ones previously used for the service principal, which were working fine :-( Looking at a previously successful pipeline-run, I can see that it probably fails trying to collect the Domain-infos at that point, although the app has the Domain.read.all API-permissions.

EDIT: using Graph-explorer, I found that the request for [graph.microsoft.com/v1.0/directory/onPremisesSync…](https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization) also requires the permission "OnPremDirectorySynchronization.Read.All".

However, after granting that API-permission it still spits out exactly the same error :-/

[Out Growth](https://hashnode.com/@Saravan99)

[Jul 23, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/669fb6211539062cc253df9e)

Can you please help on this error message. If you want I will share the full log details.

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1721743760355/00771c11-18d3-46cd-aefb-f970c9cfbdb6.png)

[github.com/ztrhgf/DevOps\_Pipelines/blob/main/azur…](https://github.com/ztrhgf/DevOps_Pipelines/blob/main/azure-backup-pipeline.yml)

I have replaced the following value mentioned in the above YML file based on our requirement.

SERVICE\_CONNECTION\_NAME USER\_EMAIL USER\_NAME

---

2024-07-22T11:27:30.8857016Z PrivilegedAccess/AzureResources/Resources

2024-07-22T11:27:33.0971646Z ##\[error\]Export-Entra : GET [graph.microsoft.com/beta/privilegedAccess/azureRe…](https://graph.microsoft.com/beta/privilegedAccess/azureResources/resources?$skiptoken=ahw5Jz2nBEKHjChR2YHCiw) HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 1b1bda25-0619-4098-9dd4-77d26bbe46f2 client-request-id: c6876129-2b01-4bb4-9e1a-dd26165addbf x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"DB1PEPF0005EB8C"}} Date: Mon, 22 Jul 2024 11:27:32 GMT Content-Encoding: gzip Content-Type: application/json {"error":{"code":"InvalidFilter","message":"The filter is invalid.","innerError":{"date":"2024-07-22T11:27:32","reques t-id":"1b1bda25-0619-4098-9dd4-77d26bbe46f2","client-request-id":"c6876129-2b01-4bb4-9e1a-dd26165addbf"}}} At D:\\a\_temp\\f54b1a51-ab43-4728-afd9-654a06a97a24.ps1:37 char:1

-   Export-Entra "$root\\prod-backup" -All -CloudUsersAndGroupsOnly
-   \~~~~~~~~~~~~~~
    -   CategoryInfo : NotSpecified: (:) \[Write-Error\], WriteErrorException
    -   FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Export-Entra 2024-07-22T11:27:33.1407404Z ##\[error\]PowerShell exited with code '1'. 2024-07-22T11:27:33.1977581Z ##\[section\]Finishing: Export backup & commit

[Mauli](https://hashnode.com/@Maulipatel12)

[May 28, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/66556a6e484f63cdd2a8e5b9)

I am trying to export users using pipeline. Pipeline is running fine but I cant see any files to output folder. And if I export users locally it is running fine.

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[May 28, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/66556a6e484f63cdd2a8e5b9#reply-6655824332c4e46a434c0adf)

[Mauli](https://hashnode.com/@Maulipatel12) then once again, hard to say without seeing your pipeline invocation output :)

[Mauli](https://hashnode.com/@Maulipatel12)

[May 28, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/66556a6e484f63cdd2a8e5b9#reply-6655be1285559ad5976a9b75)

Output is saying Users as I am exporting only users but nothing to my exported path

I am not able to attached screenshot so pasting text

Create the backup

NOTE: You can use the -No₩elcome parameter to suppress this message.

Creating backup

Users

[Mauli](https://hashnode.com/@Maulipatel12)

[May 28, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/66556a6e484f63cdd2a8e5b9#reply-66566ce4115cbbfb55b8bcfe)

Export command is not throwing any error. But have no idea where exported files are going om as it is not visible to anywhere

[Peter Wall](https://hashnode.com/@PeterW)

[Apr 5, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/660fbdb88743c678a5820b93)

Running this I get the an error. Could you please advise on how to best solve this? It works if I run the Export-command locally on a server towards the same Entra ID, but not through Azure Devops using your code. Thanks.

PrivilegedAccess/AzureResources/Resources

##\[error\]Export-Entra : GET XXXXgraph.microsoft.com/beta/privilegedAccess/azureResources/resources?$skiptoken=XXXXX HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: XXXX client-request-id: XXXX x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"E","Ring":"4","ScaleUnit":"008","RoleInstance":"XXXX"}} Date: Fri, 05 Apr 2024 07:55:28 GMT Content-Encoding: gzip Content-Type: application/json {"error":{"code":"InvalidFilter","message":"The filter is invalid.","innerError":{"date":"2024-04-05T07:55:29","reques t-id":"XXX","client-request-id":"XXX"}}} At D:\\a\_temp\\32f8a8a7-ae2d-4a87-859d-eafcc7051148.ps1:37 char:1

-   Export-Entra "$root\\prod-backup" -All -CloudUsersAndGroupsOnly
-   \~~~~~~~~~~~~~~
    -   CategoryInfo : NotSpecified: (:) \[Write-Error\], WriteErrorException
    -   FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Export-Entra ##\[error\]PowerShell exited with code '1'.

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[Apr 5, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/660fbdb88743c678a5820b93#reply-660fbf19b6d7237c80ba855c)

Are you sure you are using the same EntraExporter version as used in the pipeline? And account with exactly the same permissions? Anyway this seems to be related to the EntraExporter module more of the pipeline code. The problem seems to be in the called uri (filter part). But it's truncated in what you have sent. So hard to say

[Peter Wall](https://hashnode.com/@PeterW)

[Apr 5, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/660fbdb88743c678a5820b93#reply-660fc35850f03337b71278fb)

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf) The code I use in Azure Devops is copied this morning directly from your github, only alteration I have done to it is change the name of the service connection. Rest is identical. I thought first it might be the module, but I got it (the Export-module) working locally on my server towards the same Entra ID so not sure. Do you know how I can un-truncate the error message? The error is equally copied directly, only alteration I made was a few Xs.

[Patrick Tippner](https://hashnode.com/@grunz)

[Mar 15, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65f47ebea5104295dc02f020)

Thank you for the great article and also for providing the solution to the community - very much appreciated! :-) Unfortunately, I ran into a problem where the process always keeps timing out on the same commit message: "Creating commit '2024.03.08\_12.19 ...." (content redacted ;D) The first few pipeline-runs completed without any problems, but it suddenly stopped working one day and will not continue with a certain commit and just seems to time out at a certain point. The commit message subject is always the same, so it's probably something. related to the processed data, but I'm currently out of ideas what the underlying issue might be, and I'd be very glad to get some tips on how I might debug that!

[Patrick Tippner](https://hashnode.com/@grunz)

[Mar 15, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65f47ebea5104295dc02f020#reply-65f4b6d8890a661d8e39d676)

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf) Thank you for pointing this out! I'm definitely using an older version, indeed. Will give it a try immediately! Thx a bunch! :-)

[Patrick Tippner](https://hashnode.com/@grunz)

[Mar 17, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65f47ebea5104295dc02f020#reply-65f6dbbe8c3aef73f0ac6103)

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf) works like a charm - thank you very much! <3

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[Mar 17, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65f47ebea5104295dc02f020#reply-65f6dc718c3aef73f0ac610b)

[Patrick Tippner](https://hashnode.com/@grunz) thank you for the feedback. I am really glad this solution is useful too 👍

[Abdullah Ollivierre](https://hashnode.com/@aollivierre)

[Feb 2, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65bd105508c938c2a89a2bb8)

Thank your for the great article. Just a small advise, to keep with current terms, please refrain from using the word "Azure" when you you actually mean Entra (which includes Entra ID). Azure = IaaS/PaaS cloud computing platform and even has its own RBAC outside of Entra ID so using the word Azure instead of Entra is quite confusing.

[Krzysiek](https://hashnode.com/@krzysiek900)

[Feb 2, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65bc9f4114ad2bebd6db985a)

Hello. Whole pipeline and jobs goes well without errors but I don't see files in Azure Repos like you. In my repos are only YAML file and readme. What I'm doing wrong?

[Krzysiek](https://hashnode.com/@krzysiek900)

[Feb 5, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/65bc9f4114ad2bebd6db985a#reply-65c0da7c69754d25b52313d7)

Few days later just started to saving files to repos without any changes in configuration. Thank for great article.

[Bart Vermeersch](https://hashnode.com/@BartV)

[Dec 18, 2023](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/6580a9c60322c40183927922)

Ok, found the culprit in MS Graph PS SDK 2.11.0: Invoke-MgGraphRequest Broken

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[Dec 19, 2023](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/6580a9c60322c40183927922#reply-6581475d0322c4018397e847)

Unfortunately this SDK is quite often buggy. I myself came across of several issues in the last too

[Bart Vermeersch](https://hashnode.com/@BartV)

[Dec 18, 2023](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/6580a1030322c40183921276)

Thank you for the write up! Do you have a clue why the pipeline keeps skipping users (and groups) while it has all necessary permissions and the correct parameter. Running it manually using an admin account does retrieve groups and accounts.

[Ondrej Sebela](https://hashnode.com/@AndrewZtrhgf)

[Feb 7, 2024](https://hashnode.com/posts/how-to-easily-backup-your-azure-environment-using-entraexporter-and-azure-devops-pipeline/6516b6ad632586d66404b2f6/comment/6580a1030322c40183921276#reply-65c39f7fc37166f0a02a5a08)

And if you run it using the application credentials? Seems weird though. If permissions are correct same as Export-Entra parameters...