> This page is for Data Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # Microsoft Entra ID: Restore Conditional Access A Conditional Access policy is built from conditions, exclusions, and the named locations, authentication strengths, authentication contexts, and terms of use it points to, and rebuilding one by hand after a deletion or a bad change is slow and easy to get wrong. Restoring from a snapshot brings each of those objects back to its snapshot configuration, together with the objects a selected policy uses, so the access rules you had are back in one job. This article explains how to restore Microsoft Entra ID Conditional Access objects from a snapshot in the Eon console, and what to look for in the restore report. ## Restore Conditional Access objects Eon restores Conditional Access objects in place, into the tenant the snapshot came from. You can find a tenant's snapshots and start a restore from the SaaS inventory . #### Before you start Before you restore Conditional Access objects, make sure: * The tenant is connected as a Microsoft Entra ID restore tenant with **Include Conditional Access** checked, which grants Eon the permissions to write Conditional Access objects. For instructions, see [Microsoft Entra ID: Connect Restore Tenants]. For a restore tenant connected without it, [update its permissions] with **Include Conditional Access** checked. Without these permissions, each Conditional Access object in the restore fails. * The snapshot you restore from holds Conditional Access. A snapshot taken without the Conditional Access permissions on the source tenant, or while the tenant had no Microsoft Entra ID P1 license, shows a "Not backed up" notice in its **Conditional Access** section instead of the objects. * The tenant has a Microsoft Entra ID P1 license. Without one, Conditional Access policies are read-only, and the restore fails for them. * You know which policies Eon restores in Report-only state whatever you choose, so a restore can't lock everyone out of the tenant. See **Lockout protection** under Conditional Access in [Restore support notes]. #### Select the objects to restore 1. In the SaaS inventory , open the Microsoft Entra ID directory for your tenant, then select the snapshot you want to restore from. 2. Open **Conditional Access**, then open the list for the type you want: **Policies**, **Named locations**, **Authentication strengths**, **Authentication contexts**, or **Terms of use**. 3. Select the objects you want to restore. You can select objects from several lists in the same restore. Built-in authentication strengths can be selected, but a restore always skips them, because Microsoft defines them and they can't be changed. 4. To keep a policy's assignments to users and groups that were deleted, also select those users and groups under **Directory**. A policy restore doesn't bring back the users, groups, roles, and apps it names, and restoring them in the same job lets Eon point the policy at them. 5. Click **Restore**. The **Restore Entra ID entities** dialog opens. #### Choose the restore tenant and the policy state 1. Select the **Entra ID restore account** to restore through. Eon selects it for you when the tenant has only one. 2. Review the list of objects restored with the selected policies. These are the named locations, authentication strengths, authentication contexts, and terms of use your selected policies use. Each one is restored if it's missing or has changed since the snapshot, and left as it is otherwise. 3. To restore every policy that was On in the snapshot without enforcing it, select **Restore enforced policies as Report-only**. A policy that was Off stays Off. Leave it cleared to restore each policy in the state it had in the snapshot. For what report-only mode records, see Microsoft's [Conditional Access report-only mode]. Whichever you choose, a policy that meets the lockout protection conditions is restored as Report-only instead of On. #### Preview the changes This step is optional. To see what the restore would change before anything is written to the tenant, click **Preview changes**. Eon starts a preview job that writes nothing. Its restore report has the status "Preview — nothing was written", and lists, for each object, the fields the restore would change back to the snapshot. **Preview changes** is available only when the selection holds nothing but Conditional Access and Intune objects. To preview a restore that also has users, groups, or apps, remove them from the selection first. The dialog closes and your selection stays in place. Once you've read the preview's report, add back any users, groups, or apps you removed for the preview, so the restore can point the policy at them. Then click **Restore** again and repeat the previous step. #### Start the restore Click **Restore**. Eon starts a restore job and brings back each selected object as follows: * **An object that still exists**: Patched back to the snapshot with every writable setting, lists included, so an exclusion added after the backup is removed. An object that already matches the snapshot isn't written. * **A deleted policy or named location in the Conditional Access recycle bin**: Recovered from the recycle bin under its original ID. * **An object that's gone**: Recreated from the snapshot with a new ID, and Eon rewrites every policy that names it to use the new ID. A deleted terms of use is the exception: it can't be recreated, because Microsoft never returns its document, so the restore report asks you to upload it again. Users, groups, and apps that a policy names, and that were recreated in the same job or by an earlier restore, are rewritten into the policy with their new IDs. A reference to an object that no longer exists is dropped from the policy, and the restore report notes it. To bring back the users, groups, and apps a policy depends on, see [Microsoft Entra ID: Restore Directory Objects]. For the other cases a Conditional Access restore handles differently, such as Microsoft-managed policies, see [Restore support notes]. ## Read the restore report Every Microsoft Entra ID restore produces a restore report with the outcome of each object. For how to open it and how its outcomes and follow-up actions are organized, see [Read the restore report] in *Microsoft Entra ID: Restore Directory Objects*. For Conditional Access, check the report for these notes: * **Restored in Report-only state instead of On**: The policy applies to all users or a directory role, and none of its exclusions is an enabled account that exists, so Eon didn't enforce it. Add an exclusion, then turn the policy on. * **Applies to no one**: None of the users, groups, or roles the policy applied to exist any more, so the policy applies to no one. * **Removed from a policy**: An object the policy named no longer exists and wasn't restored, so Eon removed it from the policy. ## See also * [Microsoft Entra ID Support] * [Microsoft Entra ID: Restore Directory Objects] * [Microsoft Entra ID: Restore Intune] * [Microsoft Entra ID: Connect Restore Tenants] [Microsoft Entra ID Support]: /data-protection/saas-workloads/microsoft-entra-id/microsoft-entra-id [Restore support notes]: /data-protection/saas-workloads/microsoft-entra-id/microsoft-entra-id#restore-support-notes [Microsoft Entra ID: Connect Restore Tenants]: /data-protection/saas-workloads/microsoft-entra-id/connections/connect-restore-tenants [update its permissions]: /data-protection/saas-workloads/microsoft-entra-id/connections/connect-restore-tenants#update-permissions [Microsoft Entra ID: Restore Directory Objects]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-directory-objects [Read the restore report]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-directory-objects#read-the-restore-report [Microsoft Entra ID: Restore Intune]: /data-protection/restoring/restore-saas-applications/restore-microsoft-entra-id/restore-intune [Conditional Access report-only mode]: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-report-only