When restoring an object from On Demand Recovery fails with the following error:
Then if you click the error you will see information about an invalid password and cannot decrypt data.
Upon validation you notice that the object on Azure AD is restored successfully, but the on-premise AD object was not restored.