Rolling back changes in Cayosoft Guardian

This article describes scenarios where a user can undo changes in managed systems with rollback action in Cayosoft Guardian.

How rollback works

In Cayosoft Guardian, you roll back changes through a rollback job. A rollback job is a saved, named job that contains the Change History records you want to undo, restore settings, and, if needed, temporary credentials for just-in-time (JIT) elevation. You can review a job before you run it and run it again later.

The general workflow is:

1. In Change Monitoring > Change History, select one or more records, and then select Rollback > Create rollback job.
2. Enter a Job name, and then select Confirm and open the job.
3. Review the records and restore settings. If Guardian has read-only access to a target system, add credentials on the Rollback Job Credentials tab.
4. Select Run, then Run rollback. Review results on the Execution and History records tabs.

To add records to an existing job, select them in Change History, select Rollback > Add to rollback job, and then choose the job in Select the rollback job.

All rollback jobs are listed in Change Monitoring > Rollback Jobs.

If a job needs more configuration, a banner appears on its page:

• Configure rollback plan: change restore option if needed. Review the restore settings.
• Configure rollback plan: specify credentials for just-in-time elevation, change restore option if needed. Add elevation credentials before running the job.

Add elevation credentials for just-in-time elevation

If Guardian connects to a tenant or domain with read-only permissions, it needs administrative rights to perform the rollback. Add credentials to the job so Guardian can elevate access only while the rollback runs. Credentials belong to that rollback job, not to the managed system, and other jobs cannot use them.

To add credentials, open the job's Rollback Job Credentials tab, select Add, and complete the wizard. For Microsoft Entra ID, sign in with a Global Administrator account in the target tenant. For Active Directory, enter the account name and password.

The tab lists the account, credential type, managed systems, accessible systems, and scheduled removal time. Credentials are scheduled for deletion 24 hours after you add them by default. You can set a later removal time, up to 7 days after creation. After they are deleted, add credentials again before you run the job.

Configure restore settings

Review the restore settings in the job properties before running the job:

• AD settings
  • Restore child objects when undeleting the following types: also restore child objects for selected types. Guardian preselects types annotated for child restore.
  • Restore child objects deleted within the period of time (hours): restore only child objects deleted within this period (1 hour by default; range 0–72 hours).
  • Delete child objects when deleting the following types: also delete child objects for selected types. Guardian preselects types annotated for child deletion.
  • Waiting time for elevation propagation in Active Directory (minutes): wait for elevated permissions to take effect (5 minutes by default; range 0–1440 minutes).
• Cloud settings
  • Force Entra Connect sync if required: run synchronization when rollback requires it, such as for hybrid groups (off by default).
  • Restore hard deleted objects: re-create objects that cannot be restored from the Entra recycle bin (on by default).
  • Waiting time for elevation propagation in cloud services (minutes): wait for elevated Microsoft Entra permissions to take effect (30 minutes by default; range 0–1440 minutes).
• Advanced settings
  • Backup restored objects with priority: back up restored objects first (on by default).
  • Restore deleted linked objects: also restore deleted objects linked to the selected object (off by default).
  • Depth of traversal of deleted linked objects: set how many levels of linked objects to restore (0 by default; range 0–5).
  • Records to roll back: choose not yet rolled back, not processed and failed, or all records (not processed and failed by default).

Run a rollback job

1. On the rollback job page, select Run.
2. In Rollback history records, leave Validate elevation credentials before starting rollback operations selected so Guardian checks credentials before making changes.
3. Select Run rollback.

For systems where Guardian has read-only access, the job elevates its connection account, waits for the elevation to take effect, performs the rollback, and removes the elevated rights. Rights are removed when the job completes, fails, or is canceled. If elevation fails for a system in a batch, Guardian immediately removes any elevation already granted in that batch. Systems where Guardian already has write access are not elevated. Each elevation and de-elevation is recorded in the job messages and log.

On the History records tab, the Rollback status column shows Not executed, Running, Success, Warning, Failure, or Cancelled. To run the job for selected records only, select them and choose Rollback selected records.

Records that cannot be rolled back

Guardian blocks rollback for internal audit records, Cayosoft Administrator audit records, records marked as not supporting rollback, and transitive (nested) group membership records.

Roll back the changes in Distribution Lists and Memberships

When deleted, Exchange Online Distribution Lists are not moved to the Entra ID Recycle Bin and thus can't be recovered with the native tools. Cayosoft Guardian helps you recover a deleted Distribution List by re-creating the group object, converting it to the Distribution List using Exchange Online, and then restoring the group's membership.

To perform the rollback of the Microsoft Exchange Distribution List (DL):

1. In the Cayosoft Guardian web portal, navigate to Change Monitoring> Change History.

2. Enter the Distribution List name in the Quick Search bar.

3. Find the Delete object event for this group and select it.

4. Select Rollback > Create rollback job, enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

5. When the job completes, confirm that the rollback status is Success on the History records tab.

6. When the restore job is completed, you can find the newly added change records in the Change History: Undelete object and Add Entra ID group member(s).

7. Open Microsoft 365 Admin Center and observe whether the DL has been restored with its membership.

Bulk rollback of changes to Entra ID/Office 365 users

When synchronizing user properties from an HR system or other source, data may become corrupted in the source system. In this case, incorrect changes should be rolled back to their previous state. In native tools, to revert these changes, you should find these users, identify the proper previous value, and then perform the change on each user individually.

To roll back multiple changes simultaneously:

1. In the Cayosoft Guardian web portal, navigate to Change Monitoring > Change History.

2. Search by modified property Mobile Number.

3. Select these changes for multiple cloud-only user accounts.

4. Select Rollback > Create rollback job, enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

5. When the job completes, confirm the rollback status for each record on the History records tab.

6. When the restore is completed, you can find the newly added change records in the list.

7. Open Microsoft 365 Admin Center and check that user phone numbers were restored to initial values.

Roll back AD privileged group membership

IT Administrators want to be notified in their Microsoft Teams when privileged group membership is changed by configuring notifications about privileged group membership changes in Microsoft Teams. For details, see the Configuration: Configure communication channels article.

To rollback:

1. Get a notification in Teams when a privileged group membership is changed.

2. Click the Click for details link.

3. Sign in to Guardian. You will be redirected to the privileged group membership change.

4. Select Rollback > Create rollback job, enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

5. As a result of the restore, the user recently added to the privileged group will be removed.

6. Open ADUC and check whether the user has been removed from the group.

In case you don't have Teams connector configured, you will get the alert in Guardian that a new member has been added to the Domain Admins group after adding a user to a privileged group. In addition, such a change record will be red-marked in the Change History list.

Rollback membership in the hybrid group

When you need to restore a hybrid group or group membership using native tools, the administrator should perform the following steps:

1. User accounts should be added to the Active Directory group.

2. Wait for Entra ID Sync to run or run it manually.

3. Verify that the correct user accounts in the Entra ID/Office 365 have been added to the synchronized group.

   Cayosoft Guardian allows a single-click recovery across systems for complex hybrid scenarios like the recovery of a hybrid group membership. During the restoring of group membership, Guardian determines if it is a hybrid restore and performs restore in Active Directory at first and runs sync for Entra ID. Thus, you can perform a restore from a change record for any system: Active Directory and Office 365.

4. To roll back a hybrid group membership:

   1. In the Cayosoft Guardian web portal, navigate to Change Monitoring > Change History.

   2. In Quick Search, enter the name of the user that has been removed from the group.

   3. There are two Remove from group events for this user account for Active Directory and Office 365.

   4. Select either record, then select Rollback > Create rollback job. Enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

   5. When the job completes, confirm the rollback status for each record on the History records tab.

   6. When the restore is completed, you will see new Add to group change records for both systems: Active Directory and Microsoft 365.

   7. When restoring group membership, Guardian analyzes what kind of group it is. If it is a hybrid group, Guardian first restores Active Directory group membership and then runs Entra ID Sync to synchronize group membership in Microsoft 365.

   8. Group membership is restored in a hybrid group.

Roll back team guest settings changes

Cayosoft Guardian allows you to know about the modified team's guest settings and restore them.

To configure alerts about Teams guest settings changes:

1. In the Cayosoft Guardian web portal, navigate to Change Monitoring > Change Alerting Rules.

2. Select the Teams guest settings changes rule.

3. Click Properties>Workflow Steps.

4. Ensure it is Disabled.

5. Click Save.

How to restore Teams settings

NOTE    Default Teams Backup job runs every 10 minutes. For testing purposes when you need to see the team's changes just after team modification, navigate to Configuration > Jobs and run the job manually.

1. When team guest permissions settings are changed, you will see the alert in Cayosoft Guardian.

2. In the Cayosoft Guardian web portal, navigate to Change Monitoring > Change History.

3. In the Quick Search bar, enter the team name whose settings have been changed.

4. To exclude Microsoft 365 group changes from the grid, apply filter Teams changes.

5. Find Update properties event for this team. It will be red-marked.

6. Select Rollback > Create rollback job, enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

7. When the job completes, confirm the rollback status on the History records tab.

8. When the restore is completed, you can find the newly added change record on the list.

9. In Microsoft Teams, open team settings and check whether the guest settings have been restored.

Rolling back a password reset

When reviewing Change History, you may observe that some entries show the action Password reset and offer a Rollback option, as shown below.

One common scenario involves service accounts used by applications. If such an account’s password is changed (intentionally or mistakenly) and the old password is unknown, it may break application connectivity. Since the password cannot be restored via the Rollback function, administrators must take manual steps to remediate the issue.

NOTE    To avoid service disruptions in the future, consider converting critical service accounts to use gMSA (Group Managed Service Accounts) and securely documenting password changes.

IMPORTANT     Clicking Rollback for a Password reset does not restore the original password. Due to security and compliance reasons, Cayosoft Guardian does not retain or store previous passwords. Therefore, rolling back a password reset only marks the action as reverted but does not change the password back.

To roll back a password reset, create a rollback job from the Password reset record as you would for any other change. If Guardian has read-only access to the domain, add domain admin credentials on the Rollback Job Credentials tab before you run the job.

After you select the Password reset record, create a rollback job and follow the steps in Rolling back changes in Cayosoft Guardian.

1. Select Rollback > Create rollback job.

2. Enter a Job name, then select Confirm and open the job.

3. If Guardian has read-only access, add credentials on the Rollback Job Credentials tab.

4. Select Run, leave credential validation enabled, and select Run rollback.

5. Review the rollback status on the job's History records tab.

When the job finishes, review the record status on the job's History records tab.

Restore a deleted Organizational Unit

To restore a deleted Organizational Unit:

1. Open Change History.

2. Clear filters.

3. Select the Delete object in the Action filter.

4. Select AD Organizational Unit in the Object type filter.

5. Use the Search filter to search by name if necessary.

6. Select the deletion record, then select Rollback > Create rollback job. Enter a Job name, select Confirm and open the job, and follow Rolling back changes in Cayosoft Guardian.

   NOTE    When you roll back the deletion of an Organizational Unit, Guardian also restores child objects deleted within the period set in Restore child objects deleted within the period of time (hours) (1 hour by default). To change this period or the object types it applies to, edit the rollback job's AD settings. For large-scale restores involving thousands of objects, use an authoritative restore. For details, see Forest Recovery: Create and run AD DC recovery plan.