How to Restore a Deleted Microsoft 365 Hybrid User Account

Before starting the restoration process, confirm the user appears in Microsoft 365's deleted users list. This step helps verify the deletion and provides context for the restoration.

Open your browser and navigate to the Microsoft 365 admin center. Sign in with your Global Admin or User Admin credentials.

In the left navigation pane, expand Users and click Deleted users. Look for your deleted user in the list. The user should appear here if deleted within the last 30 days.

If you don't see the user in the deleted users list, they may have been permanently deleted or the 30-day retention period has expired. In this case, you'll need to rely entirely on the on-premises Active Directory restoration.

Connect to your Domain Controller where the Active Directory Recycle Bin is enabled. You'll need Domain Admin privileges to access deleted objects.

Log into your Domain Controller using Remote Desktop or direct console access. Ensure you're signed in with an account that has Domain Admin permissions.

Open the Active Directory Administrative Center by clicking Start and typing dsac.exe, or navigate to Server Manager > Tools > Active Directory Administrative Center.

In the Active Directory Administrative Center, you'll see your domain listed in the left pane. Click on your domain name to expand it.

Navigate to the Deleted Objects container to find and restore your deleted user account. This is the critical step that will restore the user as the authoritative source.

In the Active Directory Administrative Center, click on Deleted Objects under your domain. You'll see a list of all deleted Active Directory objects.

Locate your deleted user account. You can use the search box at the top right to filter by display name or username. Look for the user object with the correct name and deletion timestamp.

Right-click on the deleted user object and select Restore. The user will be restored to their original Organizational Unit (OU).

Alternatively, you can use PowerShell for more precise control. Open PowerShell as Administrator on the Domain Controller and run:

Get-ADObject -Filter {isdeleted -eq $TRUE -and sAMAccountName -eq "username"} -IncludeDeletedObjects | Restore-ADObject

Replace "username" with the actual sAMAccountName. You can also search by display name:

Get-ADObject -Filter {isdeleted -eq $TRUE -and displayName -like "*John Doe*"} -IncludeDeletedObjects | Restore-ADObject

After restoring the user in on-premises Active Directory, you need to force a synchronization cycle to push the changes to Microsoft 365. This ensures the cloud directory reflects the restoration.

Connect to your Microsoft Entra Connect server using Remote Desktop or direct access. Sign in with an account that has local administrator privileges on the sync server.

Open Windows PowerShell as Administrator. You can do this by right-clicking the PowerShell icon and selecting "Run as administrator".

Execute the following command to start a delta synchronization cycle:

Start-ADSyncSyncCycle -PolicyType Delta

The delta sync will process only the changes since the last synchronization, which is faster and more efficient for single user restorations.

If you encounter issues or want to ensure all objects are synchronized, you can run a full synchronization instead:

Start-ADSyncSyncCycle -PolicyType Initial

Monitor the synchronization progress by checking the output. You should see confirmation that the sync cycle has started successfully.

Return to the Microsoft 365 admin center to confirm the user has been successfully restored and is no longer in the deleted users list.

Navigate back to the Microsoft 365 admin center and refresh your browser. Go to Users > Deleted users first.

The restored user should no longer appear in the deleted users list. If they're still there, wait an additional 10-15 minutes as synchronization can take time to propagate across all Microsoft 365 services.

Next, navigate to Users > Active users. Your restored user should now appear in the active users list with their original display name and username.

Click on the user's name to open their profile. Check the following details:

• Display name and contact information are correct
• Department and job title are restored
• Group memberships are intact
• Licenses may need to be reassigned

If the user appears but shows no licenses assigned, you'll need to reassign them. Click on Licenses and apps tab and assign the appropriate licenses based on your organization's requirements.

The final step is to verify that the restored user can actually sign in and access their Microsoft 365 services. This confirms the restoration was completely successful.

Contact the user or test the account yourself (if you have the credentials) by attempting to sign in to Microsoft 365 services.

Try accessing the following services to ensure full functionality:

• Outlook Web App: Navigate to outlook.office.com
• Microsoft 365 Portal: Go to portal.office.com
• Teams: Access via web browser or desktop application
• SharePoint: Test access to any sites the user previously had permissions to

During the first sign-in attempt, you might encounter temporary issues or redirect errors. This is normal immediately after restoration as authentication tokens and cached credentials need to refresh.

If the user cannot sign in after 30 minutes, check the following:

# Check sync errors in PowerShell on Entra Connect server
Get-ADSyncConnectorRunStatus

You can also verify the user's cloud identity status:

# Install and connect to Microsoft Graph PowerShell if not already done
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All"

# Check user status
Get-MgUser -Filter "userPrincipalName eq 'user@yourdomain.com'" | Select-Object DisplayName, AccountEnabled, UserPrincipalName