Identity resilience glossary
Recovery point objective (RPO)
A recovery point objective, or RPO, is the maximum acceptable data loss measured in time. It defines how far back the organization can tolerate returning when recovering after a disruption. For identity configuration, the potential loss includes changes made after the last usable recovery point. NIST RPO definition, AWS recovery objectives
Why it matters
RPO helps teams decide how current recovery data needs to be. An organization that cannot reconstruct a day's identity changes has a different requirement from one that can tolerate that gap. The target should reflect the business consequences of missing data, not simply the interval a backup product offers.
Illustrative identity example
A team sets a 15-minute RPO for selected Entra ID configuration. An incident occurs at 10:00. To meet that target, the usable recovery point must represent a state no earlier than 09:45. If the latest successful recovery point is 09:30, the target is missed. Changes after that point may require investigation and reconstruction. These times are hypothetical, not Backupta service commitments.
Common confusion
RPO is not the time needed to restore service; that is the purpose of RTO. Nor does a 15-minute backup schedule prove a 15-minute RPO: failed or incomplete captures can leave older usable data. The objective is a target, not a guarantee. A recent recovery point must also be checked for unwanted changes. Freshness and trustworthiness answer different questions.