# Restore Conditional Access policies safely | TenuVault Restore Conditional Access policies safely with TenuVault: check references, put recreated policies in report-only mode, and review sign-in impact. Canonical: https://www.tenuvault.com/guides/restore-conditional-access-policies Practical guide # Restore Conditional Access policies To restore Conditional Access policies safely, recover the saved configuration and review its sign-in impact before enabling enforcement. TenuVault creates restored policies in report-only mode, or off if they were off. A replacement never raises enforcement above the live policy state, but an enabled live policy still needs careful review. [Start free Pro trial](https://www.tenuvault.com/trial?src=feature)[Plans and features](https://www.tenuvault.com/pricing) ## What should I check in Entra before restoring? Microsoft supports report-only evaluation for most Conditional Access policies. It records evaluation results during sign-in without enforcing the policy. That makes it useful for testing recovery, but it does not prove every user, application and device path is safe. Review representative sign-ins before making an enforcement decision. The Entra admin center is where you inspect the resulting policy and its impact. A backup supplies a previous configuration, while report-only supplies evidence about how that configuration would apply now. Users, group membership and applications may have changed since the snapshot. ## How do I restore Conditional Access policies? 1\. Confirm that Entra Conditional Access was included in the selected backup. It is an opt-in service under Settings, Services and permissions. Turning it on now cannot add missing policies to an older snapshot. Read the Backup and Restore permission badges before proceeding. 2\. Choose the snapshot and select the policy plus any named locations or custom authentication strengths that need recovery. TenuVault restores those dependencies before policies and redirects references to dependencies recreated in the same run. 3\. Review the policy state, included and excluded accounts and groups, applications, conditions, grant controls and session controls. Pay particular attention to emergency access exclusions and any change that could affect the administrators doing the recovery. ## What does report-only first mean during recovery? A created copy or recreated deleted policy begins in report-only, unless the saved policy was off. Replacing a live policy restores settings while keeping enforcement no stronger than it is now. Restoring an enabled snapshot over a policy that is currently off therefore writes report-only. This does not turn every replacement into a harmless simulation. If a live policy is already enabled, changes to its settings still deserve a staged recovery decision. Read the review warnings for removed exclusions and changed controls, and use an approved test procedure before changing production access. ## What happens if a saved reference no longer exists? TenuVault checks references before writing. A missing excluded account or group stops the policy because the exclusion would protect nobody. Recovery also stops if the policy depends on a named location or authentication strength that is missing. Where access prevents a reference check, the review gives a warning that requires your own verification in Entra. Microsoft-managed policies are backed up for drift detection only and are not recreated or overwritten. Users, groups and applications referenced by a policy are not themselves recovered by this backup. Assign owners to those dependencies before treating the policy recovery as complete. ## How can I try this on my tenant? Download TenuVault and use an approved non-production policy for a recovery drill. Confirm its dependencies, restore it and inspect its resulting state in Entra. Check report-only sign-in results for representative users and applications, then document the separate approval needed to enable it. Report-only can still prompt for device certificates in some compliance scenarios, as Microsoft documents. Choose the test population with that behavior in mind. Keep the backed-up policy, restored ID, state and sign-in evidence together so another administrator can understand the decision without repeating the incident. - [Intune and Conditional Access recovery](https://www.tenuvault.com/intune-restore) - [Prepare Conditional Access backups](https://www.tenuvault.com/guides/backup-conditional-access-policies) - [Test changes before production](https://www.tenuvault.com/guides/test-intune-changes-before-production) - [Microsoft report-only evaluation](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-report-only) - [Download TenuVault](https://www.tenuvault.com/download) ## Read the technical guides - [Detailed product documentation](https://docs.tenuvault.com/backups/conditional-access/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Will a deleted enabled policy immediately block users when recreated? A: TenuVault recreates it in report-only first. Review its impact in Entra before turning enforcement on. ### Q: Are Microsoft-managed policies restored? A: No. TenuVault saves them for drift detection and does not recreate or overwrite them. ### Q: Does restoring a policy restore its users and groups? A: No. They are references. Verify that the required objects and emergency access exclusions still exist. ## Related guides - [Intune restore](https://www.tenuvault.com/intune-restore) - [How to restore a deleted Intune policy](https://www.tenuvault.com/guides/restore-deleted-intune-policy) - [Restore Intune with Multi Admin Approval](https://www.tenuvault.com/guides/restore-intune-multi-admin-approval) - [Restore an Intune policy with assignments](https://www.tenuvault.com/guides/restore-intune-policy-with-assignments) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)