Restoring Application Proxy settings
Restoring Application Proxy settings
On Demand Recovery supports the recovery of Application Proxy settings, Connector groups, and Connector group membership.
Supported scenarios
The following scenarios are supported in On Demand Recovery:
- Restoring changes to Application Proxy configuration.
- Restoring connector group membership if an Application Proxy is moved into another connector group.
- If an Application Proxy is moved into another connector group and the previous connector group was deleted, On Demand Recovery puts the Application Proxy back to the connector group with the same name.
- If an Application Proxy is put into another connector group and the previous connector group is deleted and there is no connector group with the same name, the new connector group with this name will be automatically recreated and the Application Proxy will be put into it.
Limitations
All of the Application Proxy settings can only be restored at once, granular restore of Application Proxy settings is not supported.
Configuration data restored for an Application Proxy item
On Demand Recovery restores the following configuration data for an Application Proxy item:
Connector Groups
For deleted connector groups, On Demand Recovery restores the following attributes:
Other connector group data is currently backed up but cannot be restored.
OnPremisesPublishing Settings
An onPremisesPublishing object represents the set of properties for configuring Application Proxy for an on-premises application.
- externalUrl
- internalUrl
- externalAuthenticationType
- isTranslateHostHeaderEnabled
- isTranslateLinksInBodyEnabled
- isOnPremPublishingEnabled
- isHttpOnlyCookieEnabled
- isSecureCookieEnabled
- isPersistentCookieEnabled
- applicationServerTimeout
- useAlternateUrlForTranslationAndRedirect
For details, see https://docs.microsoft.com/en-us/graph/api/resources/onpremisespublishing?view=graph-rest-beta.
Connectors
Connector data is currently backed up but cannot be restored.
- id
- machineName
- externalIp
- status
- connectorGroupId
Prerequisites
Backing up Application Proxy settings is not enabled by default. You must select this option when configuring backup options.
To backup Application Proxy settings and connector groups
- Click Manage Backups on the Dashboard screen.
- Select the tenant from the list and click Edit.
The Configure backup dialog opens.
- Select the Back up Application Proxy settings and connector groups option and specify the service account credentials for the tenant. The specified account must be a member of the Application Administrator Azure AD, Global Reader or Global Administrator role.
- Click Save.
For details, see How does On Demand Recovery handle object attributes?
Backup and Restore of MFA Settings
Backup and Restore of MFA Settings
On Demand Recovery supports backing up and restoring the following multifactor authentication (MFA) settings:
- Authentication Requirement State
- Authentication Methods. Possible values:
- One Way SMS
- Two Way Voice Mobile
- Two Way Voice Office
- Phone App Notification
- Phone App One Time Password
- Default Authentication Method
- Authentication Phone
- Authentication Email
- Alternate Authentication Phone
- Alternate Authentication Email
For more details, see the How does On Demand Recovery handle object attributes? section.
|
|
Note:
- If a user that uses Microsoft Authenticator as an additional authentication method is permanently deleted, then all authentication methods for this user cannot be restored. On Demand Recovery does not restore binding of the application to the user.
- On Demand Recovery does not restore user passwords.
|
Prerequisites
Backing up multifactor authentication settings is not enabled by default. You must select this option when configuring backup options.
To backup multifactor authentication settings
- Click Manage Backups on the Dashboard screen.
- Select the tenant from the list and click Edit.
The Configure backup dialog opens.
- Select the Back up MFA settings, conditional access policies and data related to inactive mailboxes option and specify service account credentials for the tenant. For backup operations, the specified account must have the Global Reader role assigned. For restore operations of multifactor authentication settings, the specified account must have at least one of the following roles in the Azure portal: User Administrator or Global Administrator.
- Click Save.
|
|
Note:
- It is possible to determine the scope of customer IP Prefixes that can access the customer Azure AD tenant using Azure Active Directory (Azure AD) Conditional Access. This option significantly reduces security risks and can be recommended for customers who want to backup multifactor authentication settings. For further information, contact Quest Support.
- Multifactor authentication must be disabled for the On Demand Recovery service account or you should add On Demand Recovery IP prefixes to the list of 'Trusted IPs'.
|
To configure Trusted IP settings, use this table to allow the following subnets for relevant region:
| US |
52.233.76.96/29
|
| EU |
13.69.216.192/29 |
| Canada |
20.104.81.8/29 |
| UK |
51.145.35.32/29 |
| Australia |
20.191.252.152/29 |
For more details, see Configure Azure Multi-Factor Authentication settings.
Backup and restore group licenses
Backup and restore group licenses
On Demand Recovery restores group licenses, which means reassignment of a license to a group after its recreation or restore from the Recycle Bin. Granular restore of the assignedLicenses attribute is supported as well.
Supported scenarios
The following scenarios are supported by On Demand Recovery:
- If a group is moved to the Recycle Bin, group licenses are restored simultaneously with the group object.
- Direct and inherited licenses for users are now distinguished.
- Inherited licenses are reassigned automatically by restoring membership.
- If the licenseAssignmentStates attribute is not present in old backups, user object assignments in Azure AD are used to distinguish inherited and direct licenses.
- The same logic is applied to the Differences report to show only one change if a group which is giving licenses was changed or deleted. In this case, the report will contain only the "Group change" or "Group deletion" action.
| |
NOTE: If you are restoring a permanently deleted user from an old backup, the user license may be assigned twice; by group and directly. |
Backup and Restore of Devices
Backup and Restore of Devices
On Demand Recovery can restore Azure AD device objects that were removed from the Azure Portal. For registered or joined devices, single sign-on (SSO) data (if any) is also restored.
Limitations
The following limitation exist when restoring devices in On Demand Recovery:
- Automatically restoring SSO data for a device that was permanently deleted together with the device owner. In this case, the device owner should join the device once again.
- If a device was unjoined by the device owner, it will be restored in the Azure Portal but SSO will not work.
Not supported
The following scenarios are not supported in On Demand Recovery:
- Windows Hello for joined devices
- Microsoft Intune is not supported
- Restricted access for devices
- Restoring of devices in hybrid configuration
Restored devices attributes
For a list of group attributes restored by On Demand Recovery, see Table 17 in the Attributes restored by On Demand Recovery section.
