Restoring Group Licenses
On Demand Recovery restores group licenses, which means reassignment of a license to a group after its recreation or restore from the Recycle Bin. Granular restore of the assignedLicenses attribute is supported as well.
Supported scenarios
The following scenarios are supported by On Demand Recovery:
- If a group is moved to the Recycle Bin, group licenses are restored simultaneously with the group object.
- Direct and inherited licenses for users are now distinguished.
- Inherited licenses are reassigned automatically by restoring membership.
- If the licenseAssignmentStates attribute is not present in old backups, user object assignments in Microsoft Entra ID are used to distinguish inherited and direct licenses.
- The same logic is applied to the Differences report to show only one change if a group which is giving licenses was changed or deleted. In this case, the report will contain only the "Group change" or "Group deletion" action.
|
NOTE: If you are restoring a permanently deleted user from an old backup, the user license may be assigned twice; by group and directly. |
Restoring Devices
On Demand Recovery can restore Microsoft Entra device objects that were removed from the Azure Portal. For registered or joined devices, single sign-on (SSO) data (if any) is also restored.
|
Note: Because of Microsoft requirements, hard deleted objects will receive a new Object ID upon restore of these objects. Please consider the implications of having a new Object ID after restoring these objects. |
Limitations
The following limitation exist when restoring devices in On Demand Recovery:
- Automatically restoring SSO data for a device that was permanently deleted together with the device owner. In this case, the device owner should join the device once again.
- If a device was unjoined by the device owner, it will be restored in the Azure Portal but SSO will not work.
Not supported
The following scenarios are not supported in On Demand Recovery:
- Windows Hello for joined devices
- Microsoft Intune is not supported
- Restricted access for devices
- Restoring of devices in hybrid configuration
Restored device attributes
For a list of device attributes restored by On Demand Recovery, visit the On Demand Recovery Supported Attributes guide.
Restoring Conditional Access Policies
Restoring Conditional Access Policies
On Demand Recovery supports backing up and restoring Conditional Access policies and Named Location policies in cloud-only environments.
|
Note: When policies are created using a predefined template in Azure and then restored after being hard deleted, the "templateId" attribute is not restored as it is read-only. |
Prerequisites
Backing up Conditional Access Policies and Named Location Policies is not enabled by default. You must select this option when configuring backup options.
To backup Conditional Access policies and Named Location policies
- Click Manage backups on the Dashboard screen.
- Select the tenant from the list and click Edit.
The Configure backup dialog opens.
![](/it-it/technical-documents/image/b6d3cf16-8fbf-4565-b37d-ca041fcf2027)
- Select the Backup Conditional Access Policies and Service Principal Default Policies option and specify service account credentials for the tenant. The specified account must have the following permissions:
- The specified account must have at least one of the following roles in the Azure portal for backup operations; Global Reader or Global Administrator.
- Click Save.
To restore Conditional Access policies
To restore Conditional Access policies, go to the Restoring Objects section for more information. For the directory role required, go to the Service Account Permissions section.
Supported Scenarios
If a backup contains Conditional Access policies or Named Location policies, the Objects view will show the type of policy.
The following policy types are supported by On Demand Recovery:
- Conditional Access Policy
- Country Named Location
- IP Named Location
On Demand Recovery restores the whole policy object and what has changed is displayed in the Differences report. On Demand Recovery checks whether objects (users, groups, named locations) assigned to the policy exist in Microsoft Entra ID. If any objects are missing, the policy is restored but a warning is shown.
A user can select attributes to be restored for Conditional Access policies and Named Location policies. For the full list of policy attributes that are restored and not restored by On Demand Recovery, see How does On Demand Recovery Handle Object Attributes?
![](/it-it/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Because of Microsoft requirements, hard deleted objects will receive a new Object ID upon restore of these objects. Please consider the implications of having a new Object ID after restoring these objects. |
Limitations
Other policy types such as claims mapping policy, token issuance policy, token lifetime policy and many others are currently not supported by On Demand Recovery. See the Known issues list in the On Demand Recovery release notes.
- If the "AuthenticationStrength" attribute in "grantControl" is not present in the tenant while restoring, the restore of the Conditional Access policy will fail. "AuthenticationStrength" is a relational attribute and On Demand Recovery does not backup this attribute, so if it is deleted from the tenant, we will not restore the Conditional Access policy and error will be shown.
- The "TermsOfUse" attribute in "grantControl" will not be restored. A warning will be shown: "Terms of Use for the policy are not set."
- The restore of a relational attribute does not have any special attributes that can be selected from the user interface. In each instance that a user, group, application and/or named location is restored, the restore of the relational attribute is also run even if the minimum attributes to restore were selected.
- If On Demand Recovery has "All", "None" or "AllTrusted" selected in live policies, no relational attribute will be restored and the policy in Microsoft Entra ID will remain as is.
- If "All", "None" or "AllTrusted" is selected in a backup for On Demand Recovery, and a link is subsequently added to a user in live polices, restoring that user will result in the link being removed. In this case, the policy will be updated with default value ("None" or null or []).
- Links removed or added are not visible in the Differences report.
Integration with Recovery Manager for Active Directory
Integration with Recovery Manager for Active Directory
On Demand Recovery can be integrated with Recovery Manager for Active Directory 9.0 or higher to restore and undelete on-premises objects that are synchronized with cloud by Microsoft Entra Connect. The following figure illustrates the hybrid restore process.
Figure 1: Hybrid Restore Operation Flow Diagram
|
Note:
- All attributes that can be modified by Microsoft Graph API are considered as cloud attributes and restored on the first step. For example: assignedLicense, usageLocation, membership in cloud groups.
- On Demand Recovery also restores users from the Recycle Bin or recreates them before the on-premises restore with the Undelete option. Microsoft Entra Connect matches these objects after the cloud restore by the Security Identifier as well as the immutableID attribute which is restored from the On Demand Recovery backup.
- On-premises restore is always performed for member, memberOf, accountEnabled, manager and directReports attributes.
- Groups are restored after the on-premises restore, because in case of permanent deletion, On Demand Recovery needs to wait until a group is recreated by Microsoft Entra Connect.
|
Prerequisites
- Microsoft Entra tenant that is synchronized with on-premises Active Directory by Microsoft Entra Connect.
- For Recovery Manager for Active Directory (RMAD) version 10.2.2 or later, the Hybrid Connector service must be enabled and configured in the RMAD console. To get the latest version of Recovery Manager for Active Directory, click here.
- For Recovery Manager for Active Directory 10.2.1 or earlier, the Recovery Manager Portal is required. If you have Microsoft Entra Connect version 1.4.32.0 or higher, the Recovery Manager Portal 10.1 is required.
- The portal can be run in any machine in your environment. It is not required to install all Recovery Manager for Active Directory components.
To configure Hybrid Connector service with Recovery Manager for Active Directory - v.10.2.2 or later
For Recovery Manager for Active Directory 10.2.2 and later versions, you will need to disable the Recovery Manager Portal (if previously enabled), and enable and configure the Hybrid Connector service in the Recovery Manager for Active Directory (RMAD) console.
- In the RMAD console, select the Hybrid Recovery node from the tree and select Enable Integration with On Demand Recovery.
- In On Demand Recovery, click CONFIGURE CONNECTION under the Hybrid Connection panel.
- Download the credentials.
- In the RMAD console, open the hybrid credential file saved from step 3. This will automatically populate all the required fields.
- Provide Microsoft Entra Connect host settings.
- Enter the domain username, password and primary computer for each domain discovered in the backup.
For more information on this, go to Hybrid Recovery with On Demand Recovery.
To configure Recovery Manager Portal to enable integration with Recovery Manager for Active Directory - v.10.2.1 or earlier
- Connect to the Recovery Manager Portal with your Web browser.
- In the Recovery Manager Portal, open the Configuration tab.
- Expand Portal Settings
- Recommended: Select the Automatically unpack backups for restore operations option to automatically unpack the required backup. If the option is not selected, the restore operation may fail because the backup was not unpacked or was removed due to retention policies for the unpack operation. For more details, see the Recovery Manager for Active Directory User Guide.
- Click On Demand integration. In the On Demand integration dialog, select the Enable integration check box and specify the Relay URL and credentials. To get these parameters, go to On Demand Recovery and perform the following steps:
- On the Dashboard screen, click Configure hybrid connection.
![](/it-it/technical-documents/image/8be82d7e-b3a9-4ab7-abb2-6fb779315204)
- In the Configure hybrid connection dialog, click Download hybrid credentials to download a configuration file with Relay credentials.
- When a customer does not want to configure a hybrid connection with Quest Recovery Manager for Active Directory, the corresponding connection error events can be deactivated by changing their severity from Error to Info. To do this, clear the Show hybrid restore errors if hybrid connection is not configured check box.
- Save the file to the folder of your choice.
- Go back to the On Demand integration dialog, click Choose file and select the configuration file. For security reasons, you should remove this file from your computer after the credentials will be specified in the Recovery Manager Portal.
![](/it-it/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Microsoft Entra Connect synchronization occurs automatically after the restore operation. But On Demand Recovery forces synchronization cycles and requires credentials for the machine where Microsoft Entra Connect is installed. |
- Specify Microsoft Entra Connect host name and credentials. If Microsoft Entra Connect and Recovery Manager Portal are installed on the same machine, leave the fields blank.
|
Note: You may get an error related to the proxy settings while configuring integration with On Demand Recovery. To resolve this issue, perform the following actions:
- Open the Recovery Manager Portal configuration file %Program Files%\Quest\Recovery Manager Portal\EnterprisePortalSettings.xml.
- Set the UseDefaultSystemProxy parameter to False and check that ProxyAddress has the correct value.
- If UseDefaultSystemProxy is set to False and ProxyAddress is specified, the value of ProxyAddress will be used as a proxy server address.
- If UseDefaultSystemProxy is set to False and ProxyAddress is not specified, the direct connection will be used.
- If UseDefaultSystemProxy is set to True and ProxyAddress is specified or has no value, the proxy server specified for your browser will be used.
- Make sure that URI contains the protocol prefix and the port number, e.g. http:/localhost:8080/.
- Restart the Recovery Manager Portal service.
|
For more information about integration with Recovery Manager for Active Directory, see Integration with On Demand Recovery.
What can be restored in hybrid configuration
- On-premises groups
- User licenses (e.g. Microsoft 365 licenses and assignedLicenses property for cloud users) and cloud group membership
- Deleted on-premises users and groups
- Service principals' appRoleAssignments to on-premises users
- appRoleAssignments to non-Microsoft groups (used for SSO and App Roles)
- Directory roles: Global Administrator, Exchange Administrator, Compliance Administrator
- Other cloud-only properties: such as Block sign in, Authentication contact information, Minors and Consent
- Multifactor authentication (MFA) settings if a customer uses cloud multifactor authentication
- Conditional Access policies
- Inactive mailboxes of permanently deleted users
|
Note: Because of Microsoft requirements, hard deleted objects will receive a new Object ID upon restore of these objects. Please consider the implications of having a new Object ID after restoring these objects. |
Important Considerations
- To restore on-premises objects, On Demand Recovery uses attribute values from the RMAD backup that is closest in time but older than the cloud backup unpacked in the On Demand Recovery user interface. If the closest on-premises backup is 24 hours older than the cloud backup, you will receive the warning message.
By default, the search of the closest in time on-premises backup is performed among the backups that were unpacked in Recovery Manager Portal. You can use the Automatically unpack backups for restore operations option on Portal Settings of the Configuration tab in the Recovery Manager Portal – in this case, the on-premises backup will be unpacked automatically during the restore operation. (RMAD v10.2.1 or earlier)
- On Demand Recovery displays only cloud-synchronized on-premises attributes and cloud-only attributes for the selected object when you click Browse in the Restore Objects dialog. This does not include on-premises only attributes. To restore on-premises only attributes, you must select the Restore all attributes option in the Restore Objects dialog.
- After the hybrid restore operation, On Demand Recovery forces Microsoft Entra Connect synchronization to push on-premises changes to the cloud and wait until it completes the synchronization. Restore events can be used to track steps of Microsoft Entra Connect synchronization, such as export and import.
- To restore 'member' or 'memberOf' attributes for an object, restore the group from the Unpacked Objects view. Restoring of group memberships from the Differences report is not supported in hybrid environments.
- On Demand Recovery supports one hybrid connection per On Demand organization. If you need to manage multiple hybrid tenants, create a separate On Demand organization for each Hybrid Microsoft Entra tenant.
- One instance of Recovery Manager Portal can be used with one Microsoft Entra tenant and one Microsoft Entra Connect server. Install multiple RMAD web portals if you need to work with multiple Microsoft Entra tenants and Microsoft Entra connect servers.
- On Demand Recovery restores Back Link attributes: 'memberOf' (the back link for the 'member' attribute) and 'directReports' (the back link for the 'manager' attribute). These attributes can be selected along with all other attributes when you click Browse in the Restore Objects dialog.
- Separate Microsoft Azure Relay service is used for each hybrid connection (one per On Demand organization). On Demand Recovery creates WCF Relay per On Demand organization. No changes to On-Premises Firewall settings are required.
To perform a restore operation in On Demand Recovery
- Unpack a backup.
- Go to the Objects screen and select on-premises objects to restore.
- Click Restore.
- In the Restore Objects dialog, if you select the Restore all attributes option, On Demand Recovery will restore all on-premises attributes and cloud-only attributes from the backup.
- You can perform the restore of on-premises objects from the Differences report as well.
|
NOTE: You can restore a hybrid user using only On Demand Recovery without configuring a hybrid connection. In this case, do not forget to clear the Show hybrid restore errors if hybrid connection is not configured check box in the Configure hybrid connection dialog. If the hybrid connection is not configured, On Demand Recovery restores a cloud user and their cloud attributes without an on-premises user. For more information, see How does On Demand Recovery Handle Object Attributes? This scenario does not work for Federated Domains. For details, see Working with Inactive Mailboxes. |