Working with On Demand Recovery
This section provides step-by-step instructions on how to use On Demand Recovery.
|
Note:
- For Microsoft 365 tenants: On Demand Recovery can backup and restore Microsoft 365 users, Microsoft 365 groups and security groups. Group membership and ownership is restored for both types of groups. The product does not restore any resources associated with Microsoft 365 groups and Microsoft Teams, such as conversations, Planner tasks and plans.
- Email notifications about failed backups can be enabled by request. For assistance, contact Quest Support.
|
- Go to Quest On Demand and sign up for Quest On Demand. For more details, refer to Sign up for Quest On Demand.
- Add your Microsoft Entra tenant as described in the Tenant Management section in the On Demand Global Settings User Guide.
- After the tenant is added, make sure that the permissions required to work with Microsoft Entra tenant are granted. To grant the required permissions, click Go on the tenant tile and check that the Recovery module has the Granted status. For details, please see the Admin Consent Status section in the On Demand Global Settings User Guide. For a list of permissions that need to be granted consent for On Demand Recovery, refer to Consent permissions.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Microsoft admin consent status is "expired" after 90 days and the Recovery module status is changed to "Not Granted". Once expired, you must grant admin consent again to continue using the module. |
- To perform Exchange tasks, you will need to grant consent to Exchange Online PowerShell, and assign the Exchange Admin Role. For details, please see the About admin consent status and the Granting and regranting admin consent sections in the On Demand Global Settings User Guide.
- To launch On Demand Recovery, click Recovery on the left pane. The Dashboard screen opens.
- To configure a hybrid connection with on-premises Active Directory, see Integration with Recovery Manager for Active Directory.
- To configure the backup settings, perform the following steps:
- Click Manage backups on the Dashboard screen.
- Select the tenant from the list and click Edit. The Configure backup dialog opens.
![](/technical-documents/image/ff912f4f-67f2-4f95-a828-75c4b5d9595c)
- To enable the backup creation, select Enabled next to the Schedule option. On Demand Recovery will attempt up to 4 backups per day. Depending on the completion time required for each, the number of backups may be less.
- Choose to immediately run the backup by selecting the Run backup immediately option. Deselecting this option will allow backups to only run when scheduled.
- Specify the backup retention period using the Retention policy option in days. The backup retention policy is also applied to backups that are started manually. If no policy is set, the default retention policy is five years (1825 days). If the retention period is changed, the new policy will only affect new backups.
- To backup multifactor authentication settings, select the Backup MFA settings option.
- You will need to specify service account credentials for the tenant if selecting this option. For details about required permissions, see Required permissions.
- To backup data related to inactive mailboxes, select the Backup data related to inactive mailboxes option.
- You will need to specify service account credentials for the tenant if selecting this option. For details about required permissions, see Required permissions.
- To backup Application Proxy settings, select the Backup Application proxy settings and connector groups option.
- To backup service principal default policies and Conditional Access policies, select the Backup Conditional Access Policies and Service Principal Default Policies option.
- By selecting this option, service principal default policies such as ClaimIssuancePolicy and TokenIssuancePolicy and their relation to service principals will be backed up.
- You will need to specify service account credentials for the tenant if selecting this option. For details about required permissions, see Required permissions.
- Check the status of the module admin consent.
- If you need to run the backup creation manually, go to the Tasks screen, select the Backup task and click Start.
![](/technical-documents/image/e0845c8d-84c8-4281-8ad8-7378eb1e6c15)
- To configure restore settings, go to the Manage restore section on the Restoring Objects page.
- To start the backup creation manually, you can use the Create Backup option on the Dashboard screen.
- To unpack a backup:
- Go to the Backups screen. Here, you will find each packed backup, and the properties associated with that backup.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note:The Users column reflects the total number of users including guest accounts. The Guest column reflects only guest accounts. |
![](/technical-documents/image/f6d759e5-b88f-4417-9725-4078bf0aad47)
- From the Tenant drop-down list, select the tenant, then select the backup you want.
- You can specify predefined or custom date ranges to narrow the search results by selecting Custom range.
- Click Unpack in the actions menu.
- If the option Unpack service principals and devices is not selected, the unpack operation will work faster and the Differences report will contain only changes related to users and groups. For more details about this option, see Backup Unpacking.
- In the Backup Unpacking dialog, click Unpack.
- When the Unpack backup task is completed, go to the Unpacked Objects screen and select the users and groups that you want to restore and click Restore.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: If you do not unpack a backup, the Unpacked Objects screen will contain no objects or show a list of objects that were extracted from the previously unpacked backup. |
- In the Restore Objects dialog, select the options for restore. See the To restore objects section in the Restoring Objects page for information on each option.
- Also, you can view differences between the selected backup and live Microsoft Entra ID or Microsoft 365 and revert the selected changes using the Differences report tool. For more details, see the Reporting section. You can export the selected report data to the CSV file.
- You can view the status of your Restore objects task on the Tasks screen.
![](/technical-documents/image/545ae5d0-7e1c-48b0-a66c-9f713d70e774)
- Open the Events screen to view errors or warnings, if they occur during the restore operation.
- Use the Export option to export the selected log data to the CSV format.
- Use the Acknowledge option to hide events that are not actual anymore. The status of acknowledged events is changed from 'Current' to 'Obsolete'. To view the list of obsolete events, click Obsolete on the left side of the screen.
In the Backup Unpacking dialog, you have the option to Unpack service principals, devices, and conditional access policies. If this option is not selected, the unpack operation will work faster and the Differences report will contain only changes related to users and groups. Otherwise, you will see changes related to users, groups, service principals, devices, and Conditional Access policies. The table below provides the full list of objects and changes that will be shown on the corresponding screens.
If the Unpack service principals, devices, and conditional access policies option is NOT selected, the following items will be shown:
Unpacked Objects view
Differences view
- User
- Group
- DirectoryLinkChange
- DirectoryRoleLinkChange
If the Unpack service principals, devices, and conditional access policies option is selected, the following items will be shown:
Unpacked Objects view
- User
- Group
- Service Principal
- Device
Differences view
- User
- Group
- Service Principal
- Device
- OAuth2PermissionGrant
- AppRoleAssignment
- OwnerLinkChange
- GroupOwnerLinkChange
- DirectoryRoleLinkChange
- RegisteredOwnerDeviceLinkChange
- RegisteredUserDeviceLinkChange
Perform differences during the unpack is selected by default. The differences operation will automatically begin. If this is not selected, then only the unpack operation will be performed.
After you complete an Unpack backup task, go to the Unpacked Objects tab to select the objects that you want to restore.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: If you do not unpack a backup, the Unpacked Objects tab does not display any objects or shows a list of objects that were extracted from the previously unpacked backup. |
You can choose one of the following views to see the unpacked objects:
- List View - This view lists the unpacked objects from your backup. You can select objects to export to a CSV file or select objects to restore.
- Objects - This view displays the number of unpacked objects by category in graph form. You can use the filters to display specific types of objects.
Manage restore
To manage restores, you will need to input your service account credentials to verify that the account has sufficient permissions to restore multifactor authentication. To do this:
- On the Dashboard tab, click Manage Restore.
![](/technical-documents/image/983b06a3-1bfb-420c-a45d-6b18ae56d62d)
Policy Backup will be enabled if you have configured the Backup Conditional Access Policies and Service Principal Default Policies and option in the Configure backup dialog.
- A list of tenants will appear. Select the name of the tenant that you would like to specify account credentials.
- On the Configure Restore screen, enter the username and password credentials for the service account.
![](/technical-documents/image/2b6f9ab5-b82b-4b4e-a274-32ee8542c74c)
- Click Save.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Restore service credentials are no longer required for restoring service principal default policies but are required for restoring multifactor authentication settings, data related to inactive mailboxes and Conditional Access policies. For the required directory roles needed to restore these features, go to the Service Account Permissions section. |
To restore objects
- On the Unpacked Objects tab, in List View, click the check boxes next to the objects that you want to restore.
- You can use the Search field to search for specific objects to restore.
- You can use the filters to display specific objects that you want to restore. The following filters are available:
- Tenant - allows you to filter objects by a specified tenant.
- Backup - allows you to filter objects by a specified backup.
- Type - allows you to filter objects by type.
- User Type - allows you to filter objects by type of user.
- Microsoft Entra Connect - allows you to filter by objects synced from a hybrid environment.
- MFA - allows you to filter objects by multifactor authentication setting.
- Mail Enabled - allows you to filter by objects that have a mailbox (enabled) or do not have a mailbox (disabled).
![](/technical-documents/image/ad81958b-9542-4711-8b32-b7d55168f425)
|
Caution:The Restore button will be disabled when objects from multiple tenants are selected. To display the Restore button, please select a single tenant. |
- Click Restore.
- In the Restore Objects dialog, you can select the following options:
- Restore deleted objects from Recycle Bin - This restores accidentally deleted objects from the Recycle Bin. On Demand Recovery preserves original object identifiers (GUID).
- If a user or group is not found in Recycle Bin, create a new one - This recreates permanently deleted users, groups, and subgroups. This option recreates users and groups with attributes that are required for object identification. If you need to restore all attributes for the object including membership information (links), use this option together with the Restore all attributes option.
- If a hybrid user already exists in Microsoft Entra ID, delete it before the restore operation - This action lets you preserve the original cloud mailbox of a hybrid user after restore in the following scenario:
- There is a hybrid user. This user is deactivated by the administrator for some reason.
- Then the user returns, and the account is enabled again by the administrator. After the activation, the user is recreated in the cloud with the new mailbox.
- We want to use the original cloud mailbox for the user. The only one way to do this is to restore the user from a backup. But before the restore, the newly created cloud user must be removed from Microsoft Entra ID using this option.
- Restore all attributes - This restores all object attributes including membership information (links). If this option is not selected, you can specify specific attributes that you want to restore by clicking Browse. .
- Restore specific attributes - see below
- Specify password for the encrypted backup - This allows you to type a password that is used to decrypt the encrypted backup. This is strongly recommended only for hybrid users.
- You may also need to grant/regrant Restore Admin Consent for the On Demand Recovery module. Ensure this has been completed before progressing.
![](/technical-documents/image/82082b85-cda3-4984-867c-21c497b787a0)
- Click OK.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Because of Microsoft requirements, hard deleted objects will receive a new Object ID upon restore of these objects. Please consider the implications of having a new Object ID after restoring these objects. |
To restore selected attributes
On Demand Recovery allows you to restore specific attributes for each object, with each object type displaying its own list of attributes to restore. To do this:
- Uncheck the Restore all attributes option, and click Select Attributes.
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Only the attributes for the selected object type will be displayed. |
![](/technical-documents/image/2a4889a7-810f-4068-ae61-ab7a2c65a99f)
|
Note: Any application extension attributes found for an object will also be displayed and can be selected for restore. |
- Select the required attributes to restore for the object by checking the box(es). and click Save. Your selected attributes will appear in the Restore specific attributes box.
- Click OK when all required options have been selected.
![](/technical-documents/image/0327141a-fc1c-40f9-8eda-b49ba5f8d113)
![](/technical-documents/image/fbcb9722-93ff-4625-8992-62fb7640a199)
On Demand Recovery can restore the following objects from the Recycle Bin:
- Users (all types of users including B2B, B2C, guests, hybrid)
- Microsoft 365 Groups
- Applications
- Service principals
|
Note: Links, permissions, and roles cannot be restored from the Recycle Bin. But if an object from the above list is soft deleted and then recovered from the Recycle Bin, all attributes and links including group membership and app role assignments are preserved by Microsoft. |
|
Note: Soft-deleted service principals can only be restored from the Objects view tab, under Unpacked Objects. |
Objects that cannot be restored from the Recycle Bin:
- Distribution groups
- Security groups
- Mail-enabled security groups
- All groups synchronized by Microsoft Entra Connect from on-premises Exchange server (hybrid configuration)
- Devices