The app signs in to your tenant as you, reads the configuration and writes it only when you say so. The portal keeps the history, shows it to your team and never touches the tenant itself.
Choose the admin centers, or everything, and sign in to Microsoft with your administrator account. The app reads every setting it knows, 484 types in all, and saves them as one snapshot.
Open any two backups side by side, or compare a backup with the tenant as it is right now. Items are marked added, changed or removed, and a changed item shows only the settings that differ, with the old value beside the new one.
Tick the items you want back and review the plan: the order they will run in and the permissions the restore will ask for. The restore signs in on its own, asking only for what those items need, and discards the sign-in afterward.
The preview reads the tenant first and shows what would be recreated, updated or left alone. Nothing is written until you confirm.
Every item records its state before and after in a journal on your computer. If the result is not what you wanted, the app offers a rollback for every change it made: it writes back the values in the journal and removes again what the restore recreated. Microsoft can refuse an item, and the result lists any that could not be rolled back; steps you carried out by hand are not undone by the app.
The next backup confirms that the tenant matches what was restored.
Some settings can only be set by a person in the admin center, or are not written automatically by the app yet. For those, the app opens a walk-through: the saved value beside the current one, only the settings that differ, a button that opens the right page of the right admin center, and a check that confirms you got it right.
Prefer to run it yourself? The app writes a PowerShell restore script you can read before you run it. It previews first and carries its own undo; your settings travel in it as data, never as commands.
The split is deliberate: whatever can change your tenant runs on a computer you control.
Signs in to Microsoft as you. Reads the tenant, writes snapshots, compares, restores and rolls back. Keeps the local vault and the restore journal. Runs scheduled backups as a Windows task. Sign-ins stay in memory and are never written to disk.
Holds your workspace, your team and the history of every tenant. Keeps hosted backups encrypted, and for local vaults only the counts. Lets your team browse and compare hosted backups and prepare restores, which the app then carries out.
The free Preview includes a sample backup of 10 setting types, up to 3 times, with browsing and comparing. You need a Windows computer and an administrator account for the tenant.