How to find deleted objects in Azure AD environment using PowerShell scripts
Accidental deletion of users is one of the most common errors that could take place in Azure Active Directory (Azure AD). This results in users being prevented from accessing services, their data being erased, disruption of dependent services, and potential security risks. Therefore, it is crucial for administrators to be able to find deleted users and recover them. However, when dealing with hundreds and thousands of users, groups, devices, and other resources, it becomes increasingly difficult to track which objects are being deleted. Administrators will need a way to query for these deleted resources in bulk so that they can concentrate on restoring them swiftly. The cmdlet in the table below can be used for finding deleted users in an Azure AD environment. ADManager Plus, a unified Active Directory, Microsoft 365, Exchange, and Google Workspace management and reporting tool, can also be used to accomplish this task.
The following table is a comparison on how to find deleted users in an Azure AD environment using PowerShell scripts and ADManager Plus.
Prerequisites for Azure PowerShell method
- To use the Get-MsolUser -ReturnDeletedUsers cmdlet in Azure PowerShell, you need the MSOnline module to be installed on your system. Refer this page for guidance on how to install the module.
Azure PowerShell
Steps to find deleted users in an Azure AD environment using PowerShell scripts:
- Note down the required parameters (eg: -All, -ObjectId, -SearchString, -filter) by which the list of deleted users needs to be listed.
- Execute the following PowerShell script to find deleted users in an Azure AD environment.
Copied
Get-MsolUser -ReturnDeletedUsers
-MaxResults <usercount>
-EnabledFilter <condition>
Click to copy entire script
where <usercount> can be used to limit the number of results to a fixed value. If you want to query for all users, remove -MaxResults <usercount> from the script. <condition> refers to the condition used to filter the list of groups. For eg: UserPrincipalName eq 'user@zlyck.com'
ADManager Plus
Steps to find deleted users in an Azure AD environment using ADManager Plus:
- Log in to ADManager Plus and navigate to Microsoft 365 tab > Reports > User Reports > Deleted Users..
- Under Deleted Users, Select the desired Microsoft 365 tenant from the Microsoft Tenant drop-down list, select the desired domain from the Domains drop-down list, and click Generate Now.
- After the report is generated, select the filter icon, fill in the desired filters and click Apply.
Limitations of using PowerShell scripts to list deleted users in Azure AD:
- Administrators must have sufficient permissions to access details of deleted users in an Azure AD environment if they wish to use the above-mentioned PowerShell script.
- Only technicians with PowerShell expertise can execute this command.
- PowerShell scripts are time-consuming and can affect productivity.
- The value of the parameters used for filtering the list of deleted users should be exact by default.
- Bulk operations are tedious with PowerShell as it requires creating and assigning conditions, variables, and loop statements which introduces more possibilities of errors in scripts.
- Some tasks in PowerShell requires the installation of separate modules, which can be time consuming to install on all systems across an entire organization.
Benefits of using ADManager Plus:
- The ability to list and recover deleted objects in an Azure AD environment can be granularly delegated to technicians without altering their permissions elsewhere.
- ADManager Plus comes with an intuitive UI and does not demand any knowledge in PowerShell.
- Perform bulk operations with ease with just a few clicks using customizable templates, CSV Import, and a built-in search option.
- Fine tune your conditions with various attribute-based filters like Display Name, Group Type, Last Directory Sync Time, and Proxy Address.
- Add multiple conditions and decide on what basis they can be used to filter your reports.
- Reports generation comes built-in with ADManager Plus and can be performed at the click of a button.
