Entra ID Log Restore

Entra ID log restore allows restoring Microsoft Entra ID audit and sign-in logs. After the restore session is finished, Veeam Data Cloud will create a shared access signature (SAS) URL that you can use in Microsoft Azure Storage Explorer to download the restored log files. For more information on Microsoft Azure Storage Explorer, see Microsoft documentation.

To restore audit and sign-in log files, do the following:

1. To open the list of Entra ID tenants, click Entra ID on the left.
2. Click Manage next to the tenant you want to work with.
3. Select Entra ID Logs.
4. Select the Audit Logs or Sign-in Logs tab depending on the type of logs you want to restore.
5. In the Select month field, specify the month when the logs you want to restore were created.
6. In the list of backed-up log files, select those you want to restore.
7. Click Restore.
8. In the Restore Logs window, click Export to start the restore session. Veeam Data Cloud will create a SAS link once the log files are restored and ready to download.

9. To copy the SAS link:

1. Select Activity.
2. Select the Restore Sessions tab.
3. In the list of sessions, click See details here in the Details column of the logs restore session.
4. In the Session Details window, click Copy the Link.

The SAS link is valid for 2 hours. When the link expires, start a new restore session.

10. To download the restored log files, use the copied SAS link in Microsoft Azure Storage Explorer:

1. Download and install Microsoft Azure Storage Explorer. To get the download link, see the Azure Storage Explorer product page.
2. In the Microsoft Azure Storage Explorer application, click Open Connect Dialog on the left to launch the Connect to Azure Storage wizard:

1. At the Select Resource step of the wizard, select Blob container or directory.
2. At the Select Connection Method step, select Shared access signature URL (SAS).
3. At the Enter Connection Info step, specify a display name of the connection and paste the SAS link to the Blob container or directory SAS URL field.
4. At the Summary step, click Connect to create the connection and close the wizard.

3. In the Explorer window, make sure that your new Blob container connection is selected.
4. On the connection tab, select the logs folder and click Download to download the restored logs.