On Demand Recovery supports backing up and restoring service principal objects with the following properties:

• oAuth2PermissionGrants - the OAuth 2.0 scopes (delegated permissions) that have been granted to an application (represented by a service principal) as part of the user or admin consent process.
• appRoleAssignments - link between a service principal and a directory object.
• roles - administrator roles in Microsoft Entra ID. Refer to this article for details.
• appRoles - the collection of application roles that an application may declare.
• Service principal owners - the owners are a set of users who are allowed to modify service principal objects.

For the full list of service principal attributes that are restored and not restored by On Demand Recovery, see How does On Demand Recovery Handle Object Attributes?

Note: Due to the design specifications set by Microsoft, the default App Role can only be assigned to a principal if the corresponding resource application has not declared any App Roles. This limitation prevents On Demand Recovery from restoring default application role assignments for such principals. See Microsoft documentation for more information.

 

Note: Because of Microsoft requirements, hard deleted objects will receive a new Object ID upon restore of these objects. Please consider the implications of having a new Object ID after restoring these objects.

What is the difference between a service principal object and an application object?

When you register a Microsoft Entra application in the Azure portal, two objects are created in your Microsoft Entra tenant; an application object and a service principal object.

• Application object
  A Microsoft Entra application is defined by its one and only application object, which resides in the Microsoft Entra tenant where the application was registered, known as the application's "home" tenant. The Microsoft Graph Application entity defines the schema for an application object's properties.

• Service principal object
  In order to access resources that are secured by a Microsoft Entra tenant, the entity that requires access must be represented by a security principal. This is true for both users (user principal) and applications (service principal). The security principal defines the access policy and permissions for the user/application in that tenant. This enables core features such as authentication of the user/application during sign-in, and authorization during resource access.
  When an application is given permission to access resources in a tenant (upon registration or consent), a service principal object is created. The Microsoft Entra Graph ServicePrincipal entity defines the schema for a service principal object's properties.

For more details, see https://www.microsoftpressstore.com/articles/article.aspx?p=2473127.

Service principals provisioned from Azure Gallery

On Demand Recovery supports restoring service principals provisioned from Azure Gallery for users that have the service account for the tenant. This account must have at least the User Administrator role in the Azure portal.

Limitations: On Demand Recovery does not backup certificate settings for applications.

To make SAML SSO work after the restore of a service principal provisioned from Azure Gallery, you must install the new certificate for the corresponding application. For details on how to provide the certificate for a particular application, refer to the application configuration guide.

To access the application configuration guide

1. In Azure Management Portal, navigate to the Microsoft Entra ID section in the left pane and click Enterprise applications.
   
   
2. Choose the application for which you want to configure single sign-on.
   
   
3. Under the Manage section, select Single sign-on.
   
   
4. Click the configuration guide link.
   

Which actions are shown in the Differences report for a service principal?

• Deletion of a service principal object
• Changes to the accountEnabled attribute
• Add/remove roles assigned to service principals (custom roles are not monitored)
• Add/remove owners from service principals
• Add/remove owners from application

Names of administrator roles in the Azure portal are slightly different from the names of the corresponding roles that are shown in the Differences report. For information, see the following comparison table:

Table 3: Names of administrator roles in the Azure portal and the corresponding role in the Differences report

Azure portal	Differences report
Global Administrator	Company Administrator
Billing Administrator	Billing Administrator
Compliance Administrator	Compliance Administrator
Conditional Access Administrator	Conditional Access Administrator
Dynamics 365 Administrator	CRM Service Administrator
Exchange Administrator	Exchange Service Administrator
Guest Inviter	Guest Inviter
Password Administrator	Helpdesk Administrator
Azure Information Protection administrator	Information Protection Administrator
Intune Administrator	Intune Service Administrator
Skype for Business Administrator	Lync Service Administrator
Power BI Administrator	Power BI Service Administrator
Privileged role Administrator	Privileged Role Administrator
Reports Reader	Reports Reader
Security Administrator	Security Administrator
Security Reader	Security Reader
Service Administrator	Service Support Administrator
User Administrator	User Account Administrator