Change Audit: Roll Changes Back

Roll Distribution Lists and Memberships back

When deleted, Exchange Online Distribution Lists are not moved to the Azure AD Recycle Bin and thus can't be recovered with the native tools. Cayosoft Guardian helps you recover a deleted Distribution List by recreating the group object, converting it to the Distribution List using Exchange Online, and then restoring the group's membership.  

How to roll a Microsoft Exchange Distribution List (DL) back

1. In Guardian navigate to History > Change History
2. Enter Distribution List name in the Quick Search bar
3. Find Delete object event for this group and select it 
4. Click Restore 
   
   
   
   
5. Wait for the Job completed successfully notification to appear in the Notifications area:
   
   
6. When the restore is completed, you will see new change records added to the list: Undelete object and Add Azure AD group member(s).
   
   
   
   
7. Open Office 365 Admin Center and observe the DL was restored with its membership:
   
   

Bulk rollback of changes to Azure AD/Office 365 users

When synchronizing user properties from an HR system or other source, there might be a situation when data become corrupted in the source system. In this case, incorrect changes need to be rolled back to their previous state. In native tools to revert these changes, you should find these users, identify the proper previous value, and then perform the change on each user individually. 

How to roll multiple changes simultaneously back

1. In Guardian navigate to History > Change History
2. Search by modified property mobilePhone
3. Select these changes for multiple cloud-only user accounts by clicking the small circle to the left of each entry
4. Click Restore 
   
   
   
   
5. For each modified object wait for the Job completed successfully notification to appear in the Notifications area:
   
   
   
   
6. When the restore is completed, you will see new change records added to the list:
   
   
   
   
7. Open Office 365 Admin Center and check that user phone numbers were restored to initial values.

Roll AD privileged group membership back

IT Administrators want to be notified in their Microsoft Team when privileged group membership is changed.

How to configure

Configure notifications about privileged group membership changes in Microsoft Teams. For details, please see Configuring notification channels article.

How to Roll back:

1. When privileged group membership is changed,  you will get a notification in Teams
2. Click the Click for details link
   
   
   
   
3. Sign-in to Guardian - you will be redirected to the privileged group membership change.
4. Click Restore 
   
   
   
   
5. As a result of restore, the user, which was recently added to the privileged group, will be removed. 
6. Open ADUC and check that the user was removed from the group.

In any case, even if you don't have Teams connector configured, after adding a user to a privileged group you will get the alert in Guardian that new member was added to Domain Admins group. Also, such a change record will be marked with a red marker in Change History list.

Roll membership in the hybrid group back

When you need to restore a hybrid group or group membership using native tools the administrator will need to follow several steps. First, user accounts should be added to the Active Directory group. Second, wait for Azure AD Sync runs or run it manually. Third, verify that the correct user accounts in the Azure AD/Office 365 were added to the synchronized group.

Cayosoft Guardian allows a single-click recovery across systems for complex hybrid scenarios like recovery of a hybrid group membership. During the restoring of group membership, Guardian determines if it is a hybrid restore and performs restore in Active Directory at first and runs sync for Azure AD. Thus, you can perform restore from change record for any system: Active Directory and Office 365. 

How to roll a hybrid group membership back

1. In Guardian navigate to History > Change History
2. In the Quick Search bar enter the user name that was removed from the group
3. There will be two Remove from group events for this user account for Active Directory and Office 365.
4. Select any of them and click Restore
   
   
   
   
5. Wait for the Job completed successfully alert to appear in the Notifications area
6. When the restore is completed, you will see new Add to group change records for both systems: Active Directory and Office 365.
   
   
   
   
7. When restoring group membership, Guardian analyzes what kind of group it is. If it is a hybrid group, Guardian at first restores Active Directory group membership and then run Azure AD Sync to synchronize group membership in Office 365.  
8. Group membership is restored in a hybrid group. 

Roll teams guest settings changes back

Cayosoft Guardian helps you to know about the modified team's guest settings and restore them.

How to configure

Guardian allows alerts configuration about Teams guest settings changes.

1. In Guardian navigate to Alerting > Alerting Rules
2. Select Teams guest settings changes rule 
3. Click Properties  
4. Uncheck Disabled 
5. Click Save
   
   

How to restore Teams settings

1.  When team guest permissions settings are changed you will see the alert in Guardian:
   
   
2. In Guardian navigate to History > Change History
3. In the Quick Search bar enter the team name whose settings have been changed.
4. To exclude Office 365 group changes from the grid, apply filter Teams changes: 
   
   
5. Find Update properties event for this team. It will be marked with red.
6. Click Restore  
   
   
7. Wait for the Job completed successfully notification to appear in the Notifications area:
   
   
8. When the restore is completed, you will see new change record added to the list: 
   
   
9. In Microsoft Teams open team settings and check that the guest settings were restored.