vambris
Talk to us

Restore a deleted user flow

Applies to Microsoft Entra External ID, EIDGuard

On this page

When a user flow is deleted, sign-up and sign-in stop for every application linked to it. User flows are not among the object types Microsoft keeps in a recycle bin, so a deleted flow cannot be restored from the Microsoft Entra admin center or by Microsoft. This article describes how to restore one from an EIDGuard recovery point and confirm that sign-in works again.

Before you begin

  • A recovery point taken while the flow existed. Without one, the flow must be rebuilt by hand. See If there is no recovery point.
  • The Admin role in EIDGuard to apply the restore. Restoring user flows can re-link applications to a flow and so reopen sign-up, which makes it an Admin action even in Missing only mode. An Operator can run the preview. See Manage access.
  • What the flow depends on. A user flow refers to identity providers, custom user attributes and the applications linked to it. If any of these were deleted too, restore them in the same run.

Find the recovery point to restore from

  1. In EIDGuard, open Drift.
  2. Select the tenant, choose a recovery point as the baseline, compare it to Live tenant, and select Run comparison.
  3. In the report, look for the user flow with the change type Deleted. It is in the recovery point and missing from the live tenant.

If the newest recovery point was taken after the deletion, the flow is not in it. Compare older recovery points until you find the most recent one that still contains the flow. To check a recovery point directly, open it from Recovery points and inspect its captured user flows.

The tenant's Microsoft Entra audit log records who deleted the flow and when.

Restore the user flow

  1. Open the recovery point and select Restore.
  2. On Scope, select UserFlows. If the flow's identity providers or custom attributes were also deleted, select IdentityProviders and UserFlowAttributes as well. EIDGuard restores the selected types in dependency order, so attributes and identity providers are created before the flows that use them.
  3. On Mode, keep Missing only. It recreates objects that no longer exist and does not change the properties of objects that still exist.
  4. Select Preview changes. The preview runs against the live tenant and changes nothing.
  5. On Review, check the results. The table lists the objects that exist and will be kept. Objects that are not listed are created if they are missing, so the deleted flow should not appear in the table. If it appears as kept, a flow with the same name already exists in the tenant; see Troubleshoot the restore.
  6. On Confirm, check the target tenant, recovery point, mode and resource types, type RESTORE, and select Start restore job.
  7. On Restore, wait for the job to finish, then read Restore results and Manual actions required.

For the restore modes and roles in full, see Restore from a recovery point.

Complete the follow-up actions

Manual actions required lists the work the restore could not do. For a user flow restore, expect:

  • Identity provider client secrets. Microsoft Graph does not export them, so a recreated identity provider has a placeholder secret. Enter the real client secret from the provider's console, such as Google or Facebook, in the identity provider's configuration.
  • Application links that could not be restored. The restore links the flow to its applications again, including applications that were recreated with a new application ID. A link it could not add is listed with the action to re-link the application to the user flow.

Verify the restore

  1. In the Microsoft Entra admin center, open the user flow and check its identity providers, the attributes it collects and its linked applications.
  2. Run a sign-up and a sign-in through each application that uses the flow, with each identity provider the flow offers.
  3. Check that the expected attributes are collected and the expected claims are returned to the application.
  4. In EIDGuard, run a comparison of the same recovery point with the live tenant. The flow should no longer appear as deleted.

Troubleshoot the restore

Symptom Cause and action
The restore cannot be applied and says it needs the Admin role Restoring UserFlows is an Admin action. Ask someone with the Admin role to apply it. You can still preview.
The flow appears in the preview as kept A flow with the same display name exists in the tenant, for example one recreated by hand. The restore matches flows by name and leaves an existing one unchanged. Delete or rename the manual copy, or use a Full restore to overwrite it, which needs the Admin role.
Sign-in shows an identity provider error The identity provider has a placeholder secret. Enter the real client secret.
An application no longer uses the flow The application link was not restored. Check Manual actions required and link the application to the flow in the Microsoft Entra admin center.

User flows are backed up and restored through a Microsoft Graph API that is available only in the global Microsoft cloud.

If there is no recovery point

Without a recovery point that contains the flow, there is no recovery path. Rebuild the flow by hand: its identity providers, the attributes it collects, the claims it returns and its application links. Then test every application that used it.

To avoid this, back up each tenant on a schedule and keep daily verification turned on. See Plan disaster recovery for Microsoft Entra External ID.