For whatever reason your users may end up in the recycle bin. Normally you can restore them easily by just clicking on Restore user on the Office portal. But sometimes you may get something like this:
User restore failed The user can’t be restored at this time. Correlation ID: …
I’ve gone through 3 levels of escalation till someone finally came up with an idea that actually worked. Now I’m gonna share my experiences with you so that you don’t have to go through all this.
The thing is, at this point the Office portal is no longer useful, you can forget about it. Open Azure PowerShell instead, then connect to your tenant:
Then get the Exchange cmdlets as well:
$UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session
First verify that both the Office 365 account and its mailbox are indeed deleted:
Get-MsolUser -UserPrincipalName [email protected] Get-Mailbox [email protected]
These should not return anything. Now check if they’re in the recycle bin:
Get-MsolUser -UserPrincipalName [email protected] -ReturnDeletedUsers Get-Mailbox [email protected] -SoftDeletedMailbox
If they are, now you may try to restore the user.
Actually, if it didn’t work from the Office portal, chances are, it will fail via PowerShell, too. Obviously the Office portal also calls cmdlets in the background. Anyway, there are several modifiers you can try:
Restore-MsolUser -UserPrincipalName [email protected] -Verbose Restore-MsolUser -UserPrincipalName [email protected] -Verbose -AutoReconcileProxyConflicts Restore-MsolUser -UserPrincipalName [email protected] -Verbose -AutoReconcileProxyConflicts -NewUserPrincipalName [email protected]
For me all these failed badly:
Restore-MsolUser : Unable to complete this action. Try again later. At line:1 char:1 + Restore-MsolUser -UserPrincipalName [email protected] -Verbos ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [Restore-MsolUser], MicrosoftOnlineException + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.IdentityInternalServiceException,Microsoft.Online.Administration.Automation.RestoreUser
If this is what you have, too, things will get a bit more complicated.
The procedure goes like this:
$oldUPN = [email protected] $newUPN = [email protected] New-Mailbox -Name Jo -FirstName Jo -LastName Sm -DisplayName "Jo Sm" -MicrosoftOnlineServicesID $newUPN -Password (ConvertTo-SecureString -String '[email protected]' -AsPlainText -Force) -ResetPasswordOnNextLogon $False $oldUser = Get-MsolUser -UserPrincipalName $oldUPN -ReturnDeletedUsers $newUser = Get-MsolUser -UserPrincipalName $newUPN
New-MailboxRestoreRequest -SourceMailbox $oldUser.ObjectId -TargetMailbox $newUser.ObjectId -AllowLegacyDNMismatch
First it’ll get queued and depending on the server load, it should be done within a few hours. Check its status occasionally and don’t proceed until it’s done:
Get-MailboxRestoreRequest | Get-MailboxRestoreRequestStatistics
If the mailbox had an online archive, copy that, too:
New-MailboxRestoreRequest -SourceMailbox $oldUser.ObjectId -SourceIsArchive -TargetMailbox $newUser.ObjectId -TargetIsArchive -AllowLegacyDNMismatch
Again, don’t proceed until it’s done.
Asssign a license to the new account which causes it to link to the new mailbox.
Again, verify that the account is working fine, your mailbox is accessible, you can open the Office portal, etc.
Delete the old account altogether:
Remove-MsolUser -ObjectId $oldUser.ObjectId -RemoveFromRecycleBin
Get-MsolUser -UserPrincipalName $oldUPN Get-MsolUser -UserPrincipalName $oldUPN -ReturnDeletedUsers Get-Mailbox $oldUPN Get-Mailbox $oldUPN -SoftDeletedMailbox
All of these should return nothing.
Set-MsolUserPrincipalName -NewUserPrincipalName $oldUPN -ObjectId $newUser.ObjectId
Then also change the remaining attributes via the Office portal like display name, firt name, etc.
Once you’re done with PowerShell, close your session:
Yay, it was that simple! A million thanks to Victor from Microsoft for his invaluable help on this case.Tags: active directory, azure ad connect, Directory Synchronization, dirsync, fail, office 365, restore
Startup WordPress Theme By VWThemes