Quest Identity Recovery Reviews

My main use case for Quest Identity Recovery is to recover critical Active Directory and Entra ID objects. Whenever they are accidentally deleted by a user or from any of our team, we have to recover them. Eventually, if there is any incorrectly modified object or if it is affected by a security incident, for example, if a user account or a security group is deleted, our team will be responsible for the recovery process and helping them to restore the object and relevant attributes or memberships so that we can reduce the disruption to applications and users.

A specific situation where I had to use Quest Identity Recovery involved one of the administrators accidentally deleting a security group that several users used for business applications. The IT team had to identify the missing group, determine its previous membership, and restore the required permissions. With the suitable backup plan and the help of Quest Identity Recovery, we were able to recover the object and its relevant relationships, reducing the work needed to recreate the group manually.

We use Quest Identity Recovery for cloud-only Entra ID objects when these objects are accidentally deleted or modified, especially concerning guest users, Microsoft 365 groups, and dynamic security groups. For instance, if an administrator accidentally changes a cloud-only group membership or deletes an application configuration, we utilize Quest Identity Recovery, which helps us identify changes through backup comparison reports and restore affected objects or supported attributes without needing to recover the entire environment. Microsoft Entra Connect only synchronizes supported identity attributes from on-premises Active Directory to Entra ID and is not a complete backup and recovery solution for cloud-only objects and properties.

Quest Identity Recovery integrates into our broader organizational strategy for resilience against identity-related disruptions as part of our identity resilience and business continuity strategy. We utilize it to protect our Entra ID and 365 configurations against accidental deletions, incorrect administrative changes, and identity-related security incidents. Its main value lies in providing backup-based granular recovery and difference reporting. For example, if a change removes critical group memberships or modifies application control assignments, we can compare the current environment with a previous backup, identify affected objects, and restore supported items without rolling back unrelated configurations. It also complements our hybrid identity strategy by covering cloud-only objects and attributes not protected by Entra Connect synchronization.

Quest Identity Recovery has positively impacted my organization by providing a return on investment that comes from reducing identity-related downtime, manual recovery effort, and the business impact of authentication failures. Typically, we faced multiple issues, such as authentication failures that prevented users from logging into applications, which could waste an entire day's work. With Quest Identity Recovery, we can speed up the process by ninety percent, saving us a lot of time.

Regarding the ninety percent faster recovery time, in a recovery scenario, restoring a deleted object from a suitable backup usually takes too much time. If we do it manually, it typically takes around ten or more hours. With Quest Identity Recovery, we can cut off sixty to seventy percent of the manual effort, making recovery much more efficient. This is especially beneficial during full directory disasters where the difference can be significant.

In terms of daily workflow changes due to Quest Identity Recovery's quick identification and restoration features, it has structured our day-to-day identity administration and reduced dependence on manual troubleshooting. Previously, when there was a change in a user's privilege, we dedicated much effort to identifying the reasons behind the deletion or privilege changes. With this tool, we can compare the current Microsoft Entra ID environment against previous backups, identify specific changes, and restore affected objects or attributes without unnecessarily rolling back unrelated data.

Quest Identity Recovery has many good capabilities through which we can recover objects and also maintain a backup and a comparison of current directory objects with the backed-up versions and recovery of group memberships and permissions.

The best features Quest Identity Recovery offers, in my opinion, are granular object recovery, backup recovery planning, and the comparison of current directory objects with the backed-up versions along with the recovery of group memberships and permissions. For Active Directory, this solution also supports forest-level disaster recovery. These features are very much helpful for administrators who really want to restore the current state rather than reconstructing identities manually.

Granular object recovery has helped us to restore specific deleted or modified user accounts, group memberships, and individual attributes without restoring the entire Active Directory environment. One example of this is when a user account was accidentally deleted, and we wanted that account to be recovered. We used Quest Identity Recovery to recover the deleted user account, which was very much helpful.

The governance and security offered by Quest Identity Recovery are significant for organizations opting for it. The tool provides role-based permissions, allowing responsibilities to be separated between viewers, backup operators, restore operators, and administrators. The platform also documents security controls for access communications and backup data, and we apply least privilege practices, restrict recovery permissions, and periodically audit who can restore privileged identities.

While I have not faced any specific challenges within granular attribute-level restore functionality, Quest Identity Recovery has helped us restore specific deleted or modified user accounts. For example, if a user account is accidentally deleted or any permission is changed, we can trace who made the change. This capability reduces recovery time and minimizes disruption to users while avoiding unrelated changes and reducing manual troubleshooting, supporting business continuity.

The bulk recovery process within Quest Identity Recovery influences our reliance on PowerShell scripting for similar recovery scenarios by proving useful when multiple user accounts or group memberships are accidentally deleted. Instead of restoring each object individually, we identify affected objects using backup comparison reports and can restore them in bulk, which reduces repetitive administrative work and speeds up the recovery process while minimizing the risk of missing affected objects. Quest Identity Recovery for Microsoft Entra ID allows bulk restoration of multiple users, attributes, groups, and group memberships without needing PowerShell scripting, making recovery more accessible to administrators while reducing maintenance of custom scripts.

The difference reporting capability of Quest Identity Recovery significantly contributes to audit readiness by comparing a selected backup against the current Microsoft Entra ID environment and identifying changes to users, groups, memberships, licenses, service principals, and other supported objects. The difference report showcases what changed, including modified attributes, added or removed relationships, and deleted objects. For example, if an administrator mistakenly removes a user's privileged group membership or modifies an application assignment, we use the report to identify the change, investigate its impact, and restore the affected object from a non-good backup, thus reducing manual investigation and maintaining a clear record of recovery activities.

Aspects of Quest Identity Recovery's features that contribute to our perception of its overall security posture for protecting Entra ID and Microsoft 365 data include immutable backups, granular recovery, difference reporting, and the protection of cloud identity configurations. The solution backs up supported Entra ID and Microsoft 365 objects, including users, groups, service principals, devices, applications, and conditional access policies, giving us a recovery point for when critical security settings are changed or compromised. Immutable cloud backups help protect recovery data against unauthorized modifications or deletions. Quest stores customer backup data in logically separated storage and uses Azure storage encryption at rest, while its security documentation clarifies that user passwords and password hashes are not backed up, improving confidence in the protection of sensitive identity data while supporting stronger disaster recovery and compliance strategies.

Quest Identity Recovery could be improved in areas such as maintaining recoverable backups and supporting controlled restorations of identity object configurations to enhance resilience. Additionally, sourcing immutable backup storage can help protect recovery data against tampering, fortifying one of the most important security controls that does not replace preventive measures such as multi-factor authentication, privileged access management, or threat detection.

The user interface is quite clean, making it easy for new employees to understand. However, having better supporting documentation is essential. Overall, the user interface is clean, and the documentation is quite good, but they could enhance it with more edge cases or use cases covering more end-to-end scenarios.

Regarding the accuracy and reliability of Quest Identity Recovery, this tool is very much reliable because administrators have confidence in it. As humans, we could make errors that might affect production, but we can recover those errors. Reliability still depends on successful backups, appropriate permissions for supported configurations, and tested recovery plans. I validate it through scheduled recovery drills rather than solely depending on the claims made.

Quest Identity Recovery is very stable, and we have not faced any downtime issues or crashes.

Quest Identity Recovery is very scalable; as the number of users, groups, applications, and other supported identity objects increases, the service offers centralized backup, difference reporting, and granular recovery capabilities. Scalability depends on product-supported object limits, licensing terms, backup policies, and internal configurations, making it easier to expand identity recovery coverage without adding additional recovery services. Quest states they have backed up over sixty billion Entra ID subjects within a twelve-month period, demonstrating the scale of its platform operations.

I reached out to customer support for Quest Identity Recovery, and they provided supportive and positive responses, guiding us effectively to solve our problems.

The initial implementation and integration of Quest Identity Recovery were quite difficult and robust, suggesting that the setup could be more accessible, and additional important documentation could add value.

I have seen a return on investment with Quest Identity Recovery. Whenever a user account or group membership is deleted without knowledge or a user privilege is changed, manually tracing who did that based on previous snapshots becomes a tedious task that typically takes one or two days. Quest Identity Recovery reduces that effort to one or two hours, making it much easier to identify changes and recover lost information.

Regarding pricing, setup cost, and licensing, we did not need to deploy and maintain a separate recovery service or install an activation key. The licensing model is managed through Quest, and trial access is available for evaluation. Main cost considerations involve the subscription, the number of identities or workloads covered under the commercial agreement, and the required level of recovery capabilities.

We evaluated other options before choosing Quest Identity Recovery, including Entra ID's native recovery capabilities and other third-party solutions such as Microsoft-focused backup platforms and identity recovery tools. We considered alternatives such as native recovery and Rubrik identity recovery. However, from our requirements perspective, Quest Identity Recovery suited us most, and we opted for it.

Quest Identity Recovery is deployed through Quest's cloud-hosted security management platform. We can also deploy it on-premises as well with Active Directory recovery and the agent installed on a suitable server.

The hosted service of Quest Identity Recovery uses cloud infrastructure from Microsoft Azure. We utilize multiple other services running on Azure, from virtual machines to Active Directories and Entra IDs, making Azure our primary cloud provider.

We contacted them directly for Quest Identity Recovery, and I believe they provided the necessary information.

My advice for others looking into using Quest Identity Recovery is to carefully check your requirements against what the product offers to ensure alignment, and only proceed with deployment if both match.

I rate Quest Identity Recovery an eight out of ten because of the granular recovery, protection for identity environments, and the ability to reduce the effort to recover from accidental changes or disasters. The two points I deducted stem from some delays in reflection whenever there is a recovery speed in complex scenarios, along with some automation gaps and storage costs.

Quest Identity Recovery is primarily used for active roles migration and recovery management for Active Directory. I have used Quest Identity Recovery following the accidental deletion of critical AD objects to identify who performed the deletion, what objects were deleted, when it was deleted, and to find a valid backup containing all those objects. Quest Identity Recovery was then used to restore the objects with their attributes, memberships, and permissions.

Quest Identity Recovery also handles SID and security considerations by validating the SID of the object, verifying group memberships and access control permissions, and checking that the application reliance on AD groups continues to function.

Quest Identity Recovery offers several best features including AD object and attribute recovery, domain controller recovery, recovery of deleted users, groups, computers, and OUs, authoritative and non-authoritative AD recovery, Recycle Bin integration, Forest recovery scenarios, backup validation and health checks, recovery of group policy objects, comparison of AD objects before and after recovery, and integration with Quest Change Auditor for audit purposes.

I rely most on the restore of objects and integration with Change Auditor for audit purposes. The comparison and recovery capability of Quest Identity Recovery compares the missing object, changes attributes, group membership, object permission, and differences between the backup and the production, which significantly helps in restoring.

Quest Identity Recovery has positively impacted my organization as it is one of the most reliable tools, providing confidence that any human error can be recovered. It has definitely helped in reducing downtime through instances where human errors resulted in objects being deleted. The tool quickly detects these incidents when integrated with Change Auditor and avoids downtime by enabling rapid restoration upon notification. It uses granular recovery and prioritizes critical identities such as restoring service accounts, service groups, administrators, and business-critical users first. It also avoids unnecessary DC rebuilds, allowing recovery of AD objects from existing backups rather than performing lengthy domain controller rebuilds. It validates replication immediately and allows automation for certain objects, reducing time and adding business value.

Quest Identity Recovery could be improved with better automation, faster recovery, and reduced storage usage to lower infrastructure costs and investments.

Quest Identity Recovery's AI capabilities still need improvement regarding governance and security. It should recommend a specific recovery point, automatically identify which objects were affected by an incident, predict dependencies between users, groups, GPOs, application service accounts, and generate a recovery plan before execution.

Regarding the accuracy and reliability of output from Quest Identity Recovery's AI capabilities, it provides some overview of the capabilities, but there is still room for improvement with better planning before execution.

A situation that would prompt the use of Quest Identity Recovery for cloud-only Entra ID objects is the accidental deletion of cloud-only users, groups, and other identity objects, administrative errors, or an identity management incident where the object does not have an on-premises source of authority. The key difference observed is that with Entra Connect synchronization, the on-premises Active Directory object is normally the source of authority. If a synchronized user is deleted in Entra ID, recovery can often be performed by restoring the on-premises AD object and allowing synchronization to recreate or restore the cloud representation depending on the scenarios and object state.

My advice to others looking into using Quest Identity Recovery is to first identify the most critical identity recovery scenarios before implementing Quest Identity Recovery. Do not view it simply as a backup product, but as a part of an identity disaster recovery strategy. I have been using Quest products for almost ten years and would rate this product an eight out of ten.