Recovering from an insider attack with On Demand Recovery

Welcome to this brief demonstration of Quest On-Demand Recovery for Azure Active Directory. In this video, we will identify the changes a disgruntled administrator made before leaving the organization, and restore them back to their original values. Many organizations assume Azure Active Directory functions the same as on-premise AD, but there are differences. One noticeable difference is recovering modified or deleted objects. Knowing exactly what's been changed can be quite challenging in the dynamic cloud environment. Accidental, malicious, and time-sensitive changes can also put your organization at serious risk. Let's start with a group change. We'll go into our SGIT security group. And we'll remove Rex Puling. Next, let's delete a user. We'll delete Anna Lange. And finally, we will make a change to an attribute. So we'll use Adele Vance. And we'll change her street address from 205 to 300. To recover these, we'll go to our Quest On-Demand Recovery for Azure Active Directory portal. We'll select our backups. These are configured to run once an hour, with a retention time up to three years. And we'll unpack our backup. Once that's completed, we'll go to our Differences tab. And we can see the changes that have been made. Adele Vance, her addressed is changed from 205 to 300. Anna Lange has been deleted altogether. And we removed Red polling from the SGIT security group. So let's go ahead and select all of these, and we will restore. Once that's completed, let's back to our Administration Center, and we'll verify that the changes have taken place. So we'll go down to our SGIT group, look at our group membership. We can see Rex Puling has been restored. Also confirm that Anna Lang has also been restored, as well as Adele's address. It's 205. And you can see we've easily performed a bulk recovery, restoring a deleted user, group membership, and an attribute value, without the need of native tools or PowerShell.