The Restore-MgDirectoryDeletedItem cmdlet lets administrators restore recently deleted Microsoft Entra ID users and other directory objects, such as groups, applications, and service principals, within the retention period before they are permanently deleted.
This document explores three ways to recover deleted users in Entra ID:
ADManager Plus enables you to recover deleted users individually or in bulk, streamlining the process and eliminating scripts.
Import a CSV file to restore multiple users in bulk
Import-Module Microsoft.Graph.Identity.DirectoryManagement
Connect-MgGraph -Scopes "User.ReadWrite.All", "User.DeleteRestore.All"
Get-MgDirectoryDeletedItemAsUser
Restore the deleted user by running the script below. Replace
Restore-MgDirectoryDeletedItem -DirectoryObjectId ""
Microsoft Entra admin center is another script-free solution to help restore users through manual and bulk operations:
$deleted = Get-MgDirectoryDeletedItemAsUser -All | Where-Object {$_.DisplayName -eq "John"}
Restore-MgDirectoryDeletedItem -DirectoryObjectId $deleted.Id
$deletedGroup = Get-MgDirectoryDeletedItemAsGroup -All | Where-Object {$_.DisplayName -eq "Marketing Team"}
Restore-MgDirectoryDeletedItem -DirectoryObjectId $deletedGroup.Id
$params = @{
autoReconcileProxyConflict = $true
}
Restore-MgDirectoryDeletedItem -DirectoryObjectId "<object-id>" -BodyParameter $params
The following are parameters that can be used with the Restore-MgDirectoryDeletedItem cmdlet:
| Parameter | Description |
|---|---|
| -DirectoryObjectId | The object ID of the deleted directory item to restore |
| -InputObject | The identity parameter that accepts objects piped from Get-MgDirectoryDeletedItem (an alternative to ObjectId) |
| -BodyParameter | The hash table for additional restore options (e.g., autoReconcileProxyConflict) |
| -WhatIf | Shows what will happen if the cmdlet runs, without executing it |
| -Confirm | Prompts for confirmation before execution |
| -Headers | Allows the passing of custom HTTP headers |
| -ResponseHeadersVariable | Stores response headers in the specified variable |
While they're powerful, relying solely on Microsoft Graph PowerShell and Microsoft Entra admin center can present challenges:
ADManager Plus, an identity governance and administration solution with comprehensive Entra ID management and reporting capabilities, simplifies complex admin tasks from a single, user-friendly console:
1. Can you recover a deleted user?
Yes, you can recover a deleted Entra ID user, provided that the user has been soft-deleted and is still within the 30-day retention period. After 30 days, the user is hard-deleted (permanently deleted) and cannot be recovered.
2. How do you restore a deleted AD user?
You can restore AD users through PowerShell using the Restore-ADObject cmdlet or through GUI-based tools like Active Directory Administrative Center and ADManager Plus. While both solutions support restoring multiple users, ADManager Plus simplifies bulk recovery with CSV imports, making the process faster and more efficient.
Note that Active Directory Recycle Bin must be enabled before user deletion. If not, recovery requires a full AD backup restoration or the Ldp utility for partial recovery, which often involves resetting the user's password and attributes.