Restoring the directory: users and groups from Entra ID
How the change plan is built, why an object still in the recycle bin keeps more than a newly created one, and what always remains a preview.
The directory extract backs up users and groups from Microsoft Entra ID. This page covers the way back.
Not to be confused with the directory agent, which reports people from an on-premises Active Directory or LDAP to Conbool. The agent supplies the platform with people; this page is about writing back a backed-up Entra state. See Directory.
The change plan
Before anything is written, a plan is built. It compares the backed-up state with today's and shows line by line what would be created and what would change.
Anything that has been added is never removed. The plan creates and modifies; it does not clean up. An account created after the backup point in time is left untouched.
Today's state is read live from Microsoft for this. With several thousand accounts that takes a few minutes.
Recycle bin or new creation: the decisive difference
An object still in Microsoft's recycle bin is restored and keeps its identifier, its mailbox, its licences and its memberships.
An object no longer there is created anew. It receives a new identifier and thereby loses everything attached to the old one: the mailbox, licence assignments, group memberships, permissions on files and sites.
Microsoft keeps deleted objects in the recycle bin for thirty days. Act within that window and you get the person back; after it you get an entry with the same name.
What always remains a preview
Three object types are never written, even with consent granted:
- Sign-in policies
- Role assignments
- App registrations
They appear in the plan with their target state so that an administrator can apply them by hand. They are not written automatically: a wrongly restored role assignment or sign-in policy can lock an entire tenant out.
Without consent, preview only
Creating accounts requires rights with which any user of the Microsoft tenant could be modified. Without the corresponding consent, only a plan is produced, which an administrator applies themselves.
Where consent has been granted, it is used only following a change plan and an explicit approval. Every operation is recorded in the audit log.