Beam Vault
Identity Resilience for Okta & Entra:
How it Works
Continuous, point-in-time backup and restore for Okta and Microsoft Entra — built into the same platform that already understands both directories, so recovering from a bad change, breach, or bulk mistake is never a scramble.
What Vault Is
Three engines working together so one mistake never becomes a business-wide crisis
Beam Vault continuously captures the configuration state of your Okta org or Microsoft Entra tenant, including users, groups, applications, policies, and the relationships between them, into an independent, encrypted version store. Then it can restore any object, set of objects, or tenant-wide configuration to a chosen point in time. Here’s how it works:
Capture
Vault notices every change the moment it happens, by listening to each platform’s own change feed rather than running nightly exports. Every protected user, group, policy, and app assignment in Okta or Entra is captured on a rolling basis — no backup window to schedule, no fixed lookback to outgrow.
Version Store
Every state is kept in an independent, encrypted, append-only store outside your tenant, so a backup never shares its subject’s blast radius. Each capture is compared to the last, building one timeline of who changed what, when — including any changes Beam Migrate itself makes.
Restore
Most importantly, Vault puts things back in the right order, with the wiring intact — planned and previewed before a single write happens. Choose exactly what needs to come back: one user, one policy, or an entire scope, restored to a precise moment in time with mandatory dry-run, honest recovery-time guidance, and verification.
How Vault Works
What Happens Under the Hood of Vault’s Identity Resilience
Here’s exactly what happens from the day you implement Vault to the day you have to get your environment back up to speed after a mistake, bulk edit, or breach.
How continuous capture works
Vault’s capture engine is event-driven and platform-native. It listens continuously rather than exporting on a schedule.
VERSION-ZERO SEEDING
When Vault is enabled, it takes a full baseline of every covered object — you’re protected from hour one, not from the first change.
CONTENT-HASH DEDUP
Every captured payload is hashed; if nothing actually changed, no new version is written. Your timeline shows real changes, not noise.
PROVENANCE TAGGING
Every version records who made the change — an admin, Beam’s own migration engine, a restore, or a reconciliation sweep. Only a migration-native platform can tell you this honestly.
THREE SNAPSHOT TRIGGERS
Beyond continuous capture, restore points are created on a schedule, on demand, and automatically before high-risk operations like a migration wave or policy push.
Where your backups live
Every version lives outside your tenant, in an append-only store encrypted per tenant — deliberately boring, in the best way.
Azure Blob Storage
Encrypted, compressed payloads organized in per-tenant containers with lifecycle management.
Per-tenant envelope encryption
Each tenant gets its own data encryption key, wrapped by a key held in Azure Key Vault. No shared keys across customers; rotation happens without re-encrypting history.
A SQL catalog as the index
Version chains, deletion tombstones, and the reference edges between objects — what lets Vault answer “show me this group’s history” instantly.
An honest expiry policy
If your subscription lapses, capture stops — but existing backups remain browsable and exportable through their retention window. Your data is never held hostage.
What happens when you click restore
A planned, previewed, verified operation — not a blind write-back. The restore engine walks five steps.
01 | SCOPE
Pick a point in time and what to restore: one object, a selected set, or the whole tenant. Scoped-and-surgical is the default — most incidents are a policy or a group, not the world.
02 | PLAN
Vault builds a dependency graph — users before groups, groups before memberships — and maps old IDs to restored counterparts so every reference re-links correctly.
03 | PREVIEW
Every restore produces a dry-run diff before touching anything. Choose to overwrite the live object in place, or restore as new for side-by-side validation.
04 | APPROVE
Role-based access gates who can browse, diff, and restore. On Premium, destructive restores can require four-eyes approval from a second administrator.
05 | EXECUTE & VERIFY
Restores run as durable, ordered waves that adapt to your org’s real API limits. You get a verification report: what restored, what re-linked, what needs follow-up.
What you see in the platform
Vault provides six purpose-built surfaces inside of the Beam platform.
Protection dashboard
Coverage tiles, capture health, latest restore points, and failures that need attention — the 30-second answer to “are we protected right now?”
backup browser
Search any object, open its version timeline, and diff any two versions side by side, attribute by attribute.
restore wizard
The five-step flow: scope, conflict policy, dry-run diff, approval, and execution with live progress and a verification report.
settings
Snapshot schedules, retention, dedicated capture credentials, and a beta-endpoints toggle for Entra’s beta Conditional Access restore path.
Activity view
Every Vault operation in one auditable stream, with drill-in detail drawers.
Failure Alerts
Email notifications when a capture or restore job needs a human, so protection failures never rely on someone checking a dashboard.
Who Vault’s For
Built for every team responsible for identity
Identity & Security Teams
IT Leaders
Compliance & Risk Teams
Beam Migrate Clients
Okta & Entra Admin Teams
Teams That Need Answers Fast
Identity Resilience
Certified protection built into
the platform that already knows your identity
Beam Vault was developed by the same award-winning security team at Cyclotron that built Beam Migrate, so it isn’t a bolted-on backup tool. It’s built on the proven architecture that already understands both Okta and Entra identity infrastructure.
Moving an identity estate between platforms is the highest-stakes change an identity team ever makes. Beam’s migration engine already had to master continuous tenant capture, dependency graphs, staged execution, and rollback at enterprise scale.
For organizations that are also migrating with Beam, Vault provides always-on protection with automatic snapshots before every migration wave, rollback insurance during the project, and change attribution that can tell a migration write from an admin edit. Then it keeps protecting the tenant long after the migration is done.
Cyclotron Beam is ISO 27001 + 27701 Certified
As a trusted identity migration and resilience platform, Beam Vault is designed to protect your Okta and Entra identity data as if it were our own, backed by independently audited, internationally recognized standards for security and privacy.