How to configure On Demand Recovery to backup Multi-Factor Authentication settings (4236210)

Multi-Factor Authentication settings, Inactive Mailboxes, Conditional Access Policies and Application Proxy settings are not backed up by default as it is required to configure the Tenant Admin Credentials to backup these settings.

In addition, if On Demand Recovery is not configured to backup these additional settings it will not be possible to restore those settings.

Once configured, On Demand Recovery will backup the following additional items:

• Conditional access policies
• MFA Settings
• Identifiers of Inactive Mailboxes
• Gallery applications and SSO settings data
• Application Proxy settings and connector groups

To configure On Demand Recovery to backup the MFA settings:

1. Login to On Demand Recovery
2. From the Dashboard click Manage Backups
3. Click Edit or your tenant name
4. Check 'Backup MFA settings, Conditional Access policies and data related to inactive mailboxes'
5. Enter the credentials of an account that has either the Global Administrator or User Administrator role
6. Click Test Connection to confirm the configuration is correct
7. Click Save
8. Click Finish

NOTE: The account you specify either has to have MFA disabled or you have to add the On Demand Recovery IP Address to the list of Trusted IPs for your Azure tenant. On Demand Recovery uses IP Address prefixes for the IP address range used in each region. For the list of regional prefixes that you would need to add to the Trusted IPs for your tenant, please see the bottom of the "Backup and Restore of MFA Settings" section of the User Guide:

https://support.quest.com/technical-documents/on-demand-recovery/current/user-guide/6#TOPIC-1662300

The following Microsoft article discusses how to configure the bypass for MFA using Trusted IPs:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips