On Demand Recovery Current - User Guide

This section lists the minimum user account permissions required to perform specific On Demand Recovery tasks.

• To add a tenant and grant admin consent for the On Demand Recovery module, the Azure Global administrator directory role is required. For more details, see Add an Azure AD tenant.
  On Demand Recovery requires Basic consent in the Recovery section. If you plan to use SharePoint functionality, the Resource Processing for SharePoint Online consent is also required. For more details on restoring SharePoint Online, see Restoring SharePoint Online resource access.
• After the tenant is added, you can change the permissions to the User administrator role. Basic backup and restore operations will work.
  To use the whole product functionality, you must specify a service account in backup settings.

The service account that is used to backup and restore Multi-Factor Authentication (MFA) settings, inactive mailboxes, conditional access polices, and Application Proxy settings must have the following permissions:

• For backup operations, this account must be a member of Exchange administrator or User administrator Azure AD role.
• To back up Application Proxy, the account must be a member of Application administrator role.

The service account is used to backup and restore the following data:

• Conditional access policies
• Multi-Factor Authentication (MFA) settings
• Identifiers of inactive mailboxes
• Gallery applications and SSO settings data
• Application Proxy settings and connector groups

Table 1: Required permissions for the service account by feature

NOTE: The Application administrator role is required to restore the Application Proxy settings. The Global reader role is sufficient for the backup operation.

For instructions on how to add or remove an Azure AD tenant, see the Tenant Management section in the On Demand Global Settings User Guide.