---
title: "Restore-VBREntraIDTenantItem"
description: "This cmdlet restores Entra ID items from a tenant backup. The items can be users, groups, roles, administrative units or applications."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/restore-vbrentraidtenantitem.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Microsoft EntraID Support > Item Data Recovery > Restore-VBREntraIDTenantItem"
dateModified: "2026-08-20"
---

# Restore-VBREntraIDTenantItem

## Short Description
Restores a Microsoft Entra ID item.

**Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax
```
Restore-VBREntraIDTenantItem -Session <VBREntraIDTenantRestoreSession> [-CredentialsId <Guid>]
 -Items <VBREntraIDTenantItem[]> [-RequestPasswordChangeOnLogon] [-SkipObjectsIfExist] [-SkipRecycleBinRestore]
 [-SkipRelationships] -RestorePoint <VBREntraIDTenantRestorePoint> [-DefaultUserPassword <SecureString>]
 [-UserCredentials <VBREntraIDUserCredentials[]>] [-Reason <String>] [<CommonParameters>]
```

## Detailed Description
This cmdlet restores Entra ID items from a tenant backup. The items can be users, groups, roles, administrative units or applications.

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">CredentialsId</span></p>
        </td>
        <td>
          <p>Used only if you requested login using the <a href="request-vbrentraidlogin.md"><code>Request-VBREntraIDLogin</code></a> cmdlet.</p><p>Specifies the ID of the login session. Set the parameter value to the value returned by the <a href="request-vbrentraidlogin.md"><code>Request-VBREntraIDLogin</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>Guid</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">DefaultUserPassword</span></p>
        </td>
        <td>
          <p>For user restore.</p><p>Specifies the default password for the users being restored.</p><p><strong>Note</strong>: When restoring a user, you must specify this parameter or <code>UserCredentials</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SecureString</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Items</span></p>
        </td>
        <td>
          <p>Specifies an array of Entra ID items that you want to restore.</p><p>Accepts the <code>VBREntraIDTenantItem[]</code> object. To get this object, run the <a href="get-vbrentraidtenantitem.md"><code>Get-VBREntraIDTenantItem</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrentraidtenantitem.md"><code>VBREntraIDTenantItem[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Reason</span></p>
        </td>
        <td>
          <p>Specifies the reason of the restore operation.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RequestPasswordChangeOnLogon</span></p>
        </td>
        <td>
          <p>For user restore.</p><p>Defines if the restored users must change their passwords on the first logon.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RestorePoint</span></p>
        </td>
        <td>
          <p>Specifies a restore point from which you want to restore Entra ID items.</p><p>Accepts the <code>VBREntraIDTenantRestorePoint</code> object. To get this object, run the <a href="get-vbrentraidtenantrestorepoint.md"><code>Get-VBREntraIDTenantRestorePoint</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrentraidtenantrestorepoint.md"><code>VBREntraIDTenantRestorePoint</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Session</span></p>
        </td>
        <td>
          <p>Specifies the restore session started to recover items backed-up by a tenant backup job.</p><p>Accepts the <code>VBREntraIDTenantRestoreSession</code> object. To create this object, run the <a href="start-vbrentraidtenantrestore.md"><code>Start-VBREntraIDTenantRestore</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrentraidtenantrestoresession.md"><code>VBREntraIDTenantRestoreSession</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">SkipObjectsIfExist</span></p>
        </td>
        <td>
          <p>Defines if the items existing in the production site must be skipped from restore.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">SkipRecycleBinRestore</span></p>
        </td>
        <td>
          <p>Defines if all the items must be restored from backup.</p><p>If this parameter is set to <code>True</code>, the cmdlet will restore all items from the backup. Otherwise, if an item exists in the recycle bin, it will be restored from the bin.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">SkipRelationships</span></p>
        </td>
        <td>
          <p>Defines if to skip item relationships from restore.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">UserCredentials</span></p>
        </td>
        <td>
          <p>For user restore.</p><p>Specifies an array of passwords for users being restored.</p><p><strong>Note</strong>: When restoring a user, you must specify this parameter or <code>DefaultUserPassword</code>.</p><p>Accepts the <code>VBREntraIDUserCredentials[]</code> object. To create this object, run the <a href="new-vbrentraidusercredentials.md"><code>New-VBREntraIDUserCredentials</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrentraidusercredentials.md"><code>VBREntraIDUserCredentials[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
Guid.

## Examples

::: example
### Example 1. Restoring User

This example shows how to restore a user and assign new credentials to them. The user will need to change the password on the first logon.

```
$tenantRestoreSession = Get-VBREntraIDTenantRestoreSession -Id "901e32ac-4c9e-4f7a-9b36-a4fd0f7248fe"
$backup = Get-VBREntraIDTenantBackup -Name "Tenant backup"
$restorePoint = Get-VBREntraIDTenantRestorePoint -Backup $backup -Id "a66808bc-780e-46f2-8538-63ace3c8f9be"
$item = Get-VBREntraIDTenantItem -Backup $backup -Type User -Name "Test Admin"
$password = (Generate-VBREntraIDTenantUserPassword -Session $tenantRestoreSession -PasswordCount 1) | ConvertTo-SecureString -AsPlainText -Force
$userPassword = New-VBREntraIDUserCredentials -UserId $item.Id -Password $password
$itemRestoreSessionId = Restore-VBREntraIDTenantItem -Session $tenantRestoreSession -Items $item -RestorePoint $restorePoint -RequestPasswordChangeOnLogon -UserCredentials $userPassword
```

Perform the following steps:

1. Run the [`Get-VBREntraIDTenantRestoreSession`](get-vbrentraidtenantrestoresession.md) cmdlet. Specify the `Id` parameter value. Save the result to the `$tenantRestoreSession` variable.
2. Run the [`Get-VBREntraIDTenantBackup`](get-vbrentraidtenantbackup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$backup` variable.
3. Run the [`Get-VBREntraIDTenantRestorePoint`](get-vbrentraidtenantrestorepoint.md) cmdlet. Set the `$backup` variable as the `Backup` parameter value. Specify the `Id` parameter value. Save the result to the `$restorePoint` variable.
4. Run the [`Get-VBREntraIDTenantItem`](get-vbrentraidtenantitem.md) cmdlet. Set the `$backup` variable as the `Backup` parameter value. Specify the `Type` and `Name` parameter values. Save the result to the `$item` variable.
5. Run the [`Generate-VBREntraIDTenantUserPassword`](generate-vbrentraidtenantuserpassword.md) cmdlet. Specify the following settings:

   - Set the `$session` variable as the `Session` parameter value.
   - Specify the `PasswordCount` parameter value.
   - Convert the result to a secure string.
   - Save the result to the `$password` variable.

6. Run the [`New-VBREntraIDUserCredentials`](new-vbrentraidusercredentials.md) cmdlet. Set the `$item.Id` variable as the `UserId` parameter value. Set the `$password` variable as the `Password` parameter value. Save the result to the `$userPassword` variable.
7. Run the `Restore-VBREntraIDTenantItem` cmdlet. Specify the following settings:

   - Set the `$tenantRestoreSession` variable as the `Session` parameter value.
   - Set the `$item` variable as the `Items` parameter value.
   - Set the `$restorePoint` variable as the `RestorePoint` parameter value.
   - Provide the `RequestPasswordChangeOnLogon` parameter.
   - Set the `$userPassword` variable as the `UserCredentials` parameter value.
   - Save the result to the `$itemRestoreSessionId` variable.

:::

::: example
### Example 2. Restoring Groups

This example shows how to restore groups whose names start with "grp".

```
$tenantRestoreSession = Get-VBREntraIDTenantRestoreSession -Id "901e32ac-4c9e-4f7a-9b36-a4fd0f7248fe"
$backup = Get-VBREntraIDTenantBackup -Name "Tenant backup"
$restorePoint = Get-VBREntraIDTenantRestorePoint -Backup $backup -Id "a66808bc-780e-46f2-8538-63ace3c8f9be"
$groups = Get-VBREntraIDTenantItem -Backup $backup -Type Group -Name "grp*"
$itemRestoreSessionId = Restore-VBREntraIDTenantItem -Session $tenantRestoreSession -Items $groups -RestorePoint $restorePoint
```

Perform the following steps:

1. Run the [`Get-VBREntraIDTenantRestoreSession`](get-vbrentraidtenantrestoresession.md) cmdlet. Specify the `Id` parameter value. Save the result to the `$tenantRestoreSession` variable.
2. Run the [`Get-VBREntraIDTenantBackup`](get-vbrentraidtenantbackup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$backup` variable.
3. Run the [`Get-VBREntraIDTenantRestorePoint`](get-vbrentraidtenantrestorepoint.md) cmdlet. Set the `$backup` variable as the `Backup` parameter value. Specify the `Id` parameter value. Save the result to the `$restorePoint` variable.
4. Run the [`Get-VBREntraIDTenantItem`](get-vbrentraidtenantitem.md) cmdlet. Set the `$backup` variable as the `Backup` parameter value. Specify the `Type` and `Name` parameter values. Save the result to the `$groups` variable.
5. Run the `Restore-VBREntraIDTenantItem` cmdlet. Specify the following settings:

   - Set the `$tenantRestoreSession` variable as the `Session` parameter value.
   - Set the `$groups` variable as the `Items` parameter value.
   - Set the `$restorePoint` variable as the `RestorePoint` parameter value.
   - Save the result to the `$itemRestoreSessionId` variable.

:::

## Related Commands

- [`Get-VBREntraIDTenantRestoreSession`](get-vbrentraidtenantrestoresession.md)
- [`Get-VBREntraIDTenantBackup`](get-vbrentraidtenantbackup.md)
- [`Get-VBREntraIDTenantRestorePoint`](get-vbrentraidtenantrestorepoint.md)
- [`Get-VBREntraIDTenantItem`](get-vbrentraidtenantitem.md)
- [`Generate-VBREntraIDTenantUserPassword`](generate-vbrentraidtenantuserpassword.md)
- [`New-VBREntraIDUserCredentials`](new-vbrentraidusercredentials.md)