Microsoft Entra ID: Connect Restore Tenants
Who can use this feature
Anyone with these permissions: Manage restore connections (Cloud workloads, SaaS applications)
This article explains how to connect a Microsoft Entra ID restore tenant so you can restore directory objects into it.
A source connection alone gets you snapshots you can browse. Restoring from one means writing objects back into the directory, so until you’ve done this once, a deleted user is visible in your snapshots but not recoverable from them.
Connect a restore tenant
In this procedure, you’ll:
- Connect an Azure subscription for Microsoft Entra ID restore operations to run in.
- Grant Eon the Microsoft Graph write permissions it needs to restore directory objects.
Microsoft Entra ID restore is in-place, so the source and restore connections must be for the same Microsoft Entra ID tenant.
You can connect a restore tenant from the SaaS applications page, by clicking New Connection and selecting Connect Entra ID restore. The Configure Entra ID restore panel opens.
Before you start
Before you connect a Microsoft Entra ID restore tenant, make sure:
-
The intended restore tenant is already connected to Eon as a source tenant. For instructions, see Microsoft Entra ID: Connect Source Tenants.
-
You can sign in to the tenant as a Global Administrator.
-
You have an Azure subscription for Microsoft Entra ID restore operations to run in, and you can sign in to it as an Owner. If the tenant has already been connected for restoring with Microsoft 365, the restore subscription can be shared.
Deploy Eon's restore subscription
-
Set the Azure restore subscription. This is the subscription where the restore server, which reads the snapshot and writes objects back to your directory, is deployed during restores.
-
To allow Microsoft Entra ID and Microsoft 365 to share a restore subscription, select Use the subscription already connected for Microsoft 365 restore. This option is shown only when the tenant has a Microsoft 365 restore subscription connected.
-
To keep separate restore subscriptions, select Dedicate a different subscription, then enter its Subscription ID.
-
-
Keep the Internal Resource Group Name Eon suggests, or enter your own. A shared subscription uses the resource group it already has, so its name comes from the Microsoft 365 restore connection.
-
Choose Terraform or Bash with the deployment toggle. Your choice applies to both this script and the consent script in the next step. A shared subscription is set up with Bash, because the Terraform module would overwrite the Microsoft 365 restore connection’s tags on a resource group it didn’t create.
-
Sign in to the subscription as an Owner and run the generated script:
Bash
Terraform
Run the generated
entra_restore_subscription.shscript.
On a dedicated restore subscription, this provisions the resource group where the restore server runs, along with the Microsoft Entra ID restore roles Eon uses in the subscription. On a shared subscription, it adds the restore roles to the existing internal resource group.
Grant admin consent
-
Sign in to the tenant as a Global Administrator and run the generated script:
Bash
Terraform
Run the generated
entra_restore_consent.shscript.These are write permissions, because restoring an object means writing it back into your directory.
-
Select I have granted admin consent in Microsoft.
Eon connects the Azure subscription and the Microsoft Entra ID restore tenant. You can restore users and groups into this tenant.