Restore from a recovery point

Restore one or more resource types from a recovery point into the External ID tenant it was taken from. Every restore runs a read-only preview first, and nothing in the tenant changes until you confirm.

Before you begin#

• Role. An Operator can preview any restore and apply a Missing only restore of most resource types. Some resource types, and every Full restore, need the Admin role. See Who can apply a restore.
• The tenant must be onboarded. A restore signs in with the tenant's own restore app, so it restores into the tenant the recovery point came from. Recovery points of an offboarded tenant can be browsed, but restoring from them requires onboarding the tenant again.
• Choose the recovery point. Usually you want the most recent recovery point taken before the problem. To find when an object changed or disappeared, compare recovery points with the live tenant on the Drift page; see Verify backups and detect drift.

You restore whole resource types, not individual objects. Restore the smallest set of types that covers the problem, and include any types the restored objects depend on (see Restore order).

Restore modes#

The Mode step offers two modes.

Missing only does not leave existing objects completely untouched. Existing objects keep their properties, but missing links to them are added back:

• group members and owners
• application owners, federated credentials and extension properties
• application permissions granted to apps, and other app role assignments
• user flow application links
• directory role assignments, including Global Administrator

Tenant-wide settings, such as the default company branding and directory settings, are created in Missing only mode only when the tenant has none. They are never overwritten in that mode.

Conditional Access policies that a restore has to create are always created disabled, so a restored policy cannot block sign-in before you review it. In Full mode, Conditional Access policies that still exist are overwritten with their backed-up state, including enabled.

Use Missing only for deleted objects. Use Full to roll back unwanted changes to objects that still exist.

Who can apply a restore#

The service enforces these rules; the dashboard only reflects them.

The Admin-only resource types can grant access even in Missing only mode, for example by adding back application permissions, directory role assignments, group memberships, partner trust settings or user flow application links. When your selection includes one of them, the wizard shows Applying … needs the Admin role and an Operator can still run the preview.

A Missing only restore of Users recreates deleted accounts with the enabled state they had when they were backed up. A recreated account can sign in once its password is reset, or immediately with a social or federated identity that needs no password. It receives no group membership, role or app permission from the restore of users alone.

Restore order#

Whatever order you select them in, resource types are restored in dependency order: objects that others refer to are created first. For example, custom attributes and identity providers are restored before the user flows that use them, and users and groups before the role assignments that name them.

Recreated objects get new object IDs. EIDGuard updates the references between objects restored in the same job, such as group members, policy assignments, user flow application links and role assignments, so select a type together with the types it refers to.

Run a restore#

1. Open Recovery points, find the recovery point, and select Restore. You can also select Restore on the recovery point's own page.
2. Scope. Select the resource types to restore (Select all and Clear are available), then select Continue.
3. Mode. Choose Missing only or Full (disaster recovery), then select Preview changes.
4. Review. Wait for the preview job to finish and review its result. See Review the preview. If the result is not what you expect, go back and narrow the scope or choose another recovery point. When you are ready, select Continue.
5. Confirm. Check Target tenant, Recovery point, Mode and Resource types. Type RESTORE in the confirmation box and select Start restore job.
6. Restore. The job's log is shown as it runs. When it finishes, review the results.

Review the preview#

The preview is the same restore job run in WhatIf mode against the live tenant. It reads the tenant and writes nothing.

The Review step shows:

• Rows listed, Existing, kept and Mode.
• WhatIf result: a table of the existing objects the restore would keep and anything it would skip, each with the status Skipped.
• Property-level differences between the recovery point and the live tenant, when a recent comparison of this recovery point covers the selected types. Otherwise the step says that no live comparison covers these resources; run one from the Drift page for this detail.

Continue is available only when the preview job completes successfully.

After the restore#

When the job finishes, the Restore step shows:

• Restore results: each object with the action taken and its status.
• Manual actions required: follow-up work the restore cannot do for you, such as re-entering identity provider secrets.

The results and the list of manual actions are also saved as reports with the recovery point, and the job stays on the Jobs page with its full log. A restore job fails if any row fails.

You can run the same Missing only restore again, for example after fixing the cause of a failed row. Objects that now exist are kept, and links that already exist are not added twice.

What a restore cannot bring back#

Microsoft Graph does not export some data, so no backup contains it. A restore recreates the objects without it and tells you what to do.

For the full list of resource types and what each restore covers, see Supported resource types.

Verify the restore#

1. Review Restore results for failed rows, and complete every item under Manual actions required.
2. Review each restored Conditional Access policy, then turn it on.
3. Test the user journeys that depend on the restored objects. For a user flow, run a real sign-up and sign-in with each identity provider it offers.
4. Run a comparison against the live tenant on the Drift page to confirm the restored objects match the recovery point.

Troubleshoot a restore#

Related pages#

• Verify backups and detect drift
• Back up tenants
• Supported resource types
• Manage access