Skip to navigation
RestoringRestore SaaS ApplicationsMicrosoft Entra ID

Microsoft Entra ID: Restore Directory Objects

Who can use this feature

Anyone with these permissions: Restore resources

When a user, group, or app is deleted or changed by mistake, the object is the easy part to rebuild, and its access isn’t. Restoring from a snapshot brings the object back with the group memberships, ownership, roles, licenses, and consents it held at the point in time you choose, so the people and services that depend on it get their access back without anyone reconstructing it by hand.

This article explains how to restore Microsoft Entra ID users, groups, app registrations, and enterprise applications from a snapshot, and how to read the restore report the job produces. To restore Conditional Access or Intune objects, see Microsoft Entra ID: Restore Conditional Access and Microsoft Entra ID: Restore Intune.

Eon restores directory objects into the tenant the snapshot came from. You can’t redirect them to a different tenant.

Restore directory objects

You can browse a snapshot of your directory and start a restore from the SaaS inventory.

Before you start

Before you restore directory objects, make sure:

1

Select the snapshot to restore from

  1. In your SaaS inventory, open the Microsoft Entra ID tenant you want to restore.

  2. Select the snapshot you want to restore from.

The directory is shown as it stood when that snapshot was taken. Its Directory section lists Users, Groups, Roles, Licenses, App registrations, and Enterprise applications.

2

Select the objects to restore

Open Users, Groups, App registrations, or Enterprise applications, then select the objects you want back. Search within a list to find an object by name.

Roles, role assignments, and licenses can’t be selected on their own. They come back as relationships of the users, groups, and apps you select.

Restore users together with the groups they belonged to. A relationship comes back only when the object at its other end exists, and the restore dialog lists the relationships that won’t be restored so you can add the missing objects before you start.

3

Choose the restore tenant

  1. Click Restore. The Restore Entra ID entities dialog opens and lists what you selected.

  2. Select the Entra ID restore account to restore through. Only restore accounts for the tenant the snapshot came from are listed, and Eon selects the account for you when there’s only one.

4

Add the objects that keep relationships intact

When the dialog shows relationships that won’t be restored, the objects at their other end aren’t in the latest backup, so restoring your selection alone doesn’t bring those relationships back.

To keep a relationship, click Add next to its object, or click Add all to add every object the dialog lists.

An object tagged recycle bin only can come back only while Microsoft Entra ID still holds it in its recycle bin. The list is advisory and never stops you from restoring, and Eon doesn’t check a selection of more than 500 objects.

5

Choose which consents the restored apps get back

This step applies only when you selected app registrations or enterprise applications. An app registration and its enterprise application are restored together.

Under Consents of the restored apps, choose which consents the apps get back:

  • Same consents as in the snapshot: Every consent the apps held in the snapshot is granted again.

  • No consents, I’ll grant them myself: No consent is granted. The restore report lists each consent with the command to grant it.

  • Choose per consent: You select the consents to grant. A consent tagged Can change data lets the app write through the API, not only read from it.

With No consents, I’ll grant them myself or Choose per consent, a consent that’s still held and that you don’t select is revoked, which removes that app’s access to the API. This includes consents other apps hold on an API a restored app exposes, tagged Not restored · uses a restored API, so leaving one out cuts off an app that isn’t part of the restore.

6

Start the job and monitor it

Click Restore, then track the job from View job, or from the Restore jobs tab on the Jobs page.

Eon starts a restore job and handles each object according to its state in the directory:

  • Still exists: Changed back to the snapshot, keeping its object ID. An object that already matches the snapshot is skipped.

  • In the recycle bin: Recovered from the recycle bin with its original object ID, then changed back to the snapshot.

  • Purged: Recreated from the snapshot with a new object ID, and its relationships re-linked.

A recreated user signs in with a random password it must change at first sign-in, and its multi-factor authentication methods have to be registered again. A rebuilt app registration gets a new application (client) ID, so every client that signs in with it has to be pointed at the new ID. For everything a restore changes back, leaves unchanged, or can’t bring back, see Restore support notes.

The restore report names every object that needs follow-up, so read it before you tell anyone their access is back.

Read the restore report

Every Microsoft Entra ID restore job produces a restore report, with the outcome of each object and the follow-up actions left to you. The same report covers Conditional Access and Intune objects, and preview runs, which list what a restore would change without writing anything. For those, see Microsoft Entra ID: Restore Conditional Access and Microsoft Entra ID: Restore Intune.

To open the report, open the restore job and, under Artifacts, click View report, or download the report as JSON.

The report’s status shows whether anything is left to do:

  • Completed: The restore finished with nothing left to do.

  • Completed — actions required: The restore finished, and some objects need follow-up actions.

  • Preview — nothing was written: The job was a preview, and the report lists what a restore would change.

Its summary counts the objects requested, restored, skipped, and failed, and the follow-up actions required.

Each object carries one outcome:

  • Changed back to the snapshot: The object still existed and differed from the snapshot, so Eon set it back.

  • Skipped — already exists: The object still exists and already matched the snapshot, so Eon wrote nothing.

  • Recovered from recycle bin: Eon recovered the object from the recycle bin with its original object ID.

  • Recreated: Eon recreated the object from the snapshot with a new object ID.

  • Failed: Eon couldn’t restore the object, and the report gives the reason. When every object fails, the job fails too. For what to check, see Restore troubleshooting.

Each object’s notes say what the restore did to it: what it changed back, re-added, or removed, what it left unchanged, and what it didn’t restore, with the reason. The report also lists the relationships in place after the restore. A relationship Eon couldn’t re-link doesn’t fail the job, so read the report even when the job completes.

Follow-up actions come in two groups, with actions on the restored object first:

  • On this … in Entra: Changes you make on the restored object itself, such as On this user in Entra or On this app registration in Entra. Examples are creating a client secret, uploading a certificate again, setting an application ID URI, regenerating a SAML signing certificate, and reissuing a user’s credentials and multi-factor authentication methods.

  • Where it is used: Changes outside Microsoft Entra ID, wherever the object is used. Examples are pointing clients at a new application (client) ID, and updating federated workloads, Azure role assignments, Conditional Access and Key Vault references, and managed identities.

For a rebuilt app, the report shows the application (client) ID changing from the old value to the new one. Each consent you left out is listed as a note with the command to grant it, not as a required action.

See also

Was this page helpful?