[Hybrid Module] Failed to restore object. Invalid password. Cannot decrypt data. (4374930)

[Hybrid Module] Failed to restore object. Invalid password. Cannot decrypt data.

When restoring an object from On Demand Recovery fails with the following error:

 
Then if you click the error you will see information about an invalid password and cannot decrypt data.

 

Upon validation you notice that the object on Azure AD is restored successfully, but the on-premise AD object was not restored.

Incorrect password entered in the Integration with On Demand Recovery section from the RMAD console for the account used to access the designated primary DC that will be used for hybrid recovery operations.

 

Confirm that credentials entered in the Integration with On Demand Recovery section from the RMAD console for the account used to access the designated primary DC that will be used for hybrid recovery operations are correct and that this account is not locked as well.

If hybrid settings are configured correctly, then when restoring an object from On Demand Recovery both on-premise and Azure AD objects should be restored successfully.