How to Restore a Deleted Workspace to the Directory

Title
How to Restore a Deleted Workspace to the Directory
URL Name
Restore-a-Deleted-Workspace-to-the-Directory

Question
Answer

We have workspaces that were:

How can we reset the status or add the items back into ProvisionPoint?

Deletion Options

Workspaces can be deleted from M365 and ProvisionPoint using actions from our app.  
Owners or Admins can also choose to delete items directly in M365. The deletion mismatch compliance policies can pick this up and apply the deleted status or remove them from ProvisionPoint.
 
Expand here to learn about the delete options within ProvisionPoint

Delete the Workspace in M365

When a workspace has been deleted using the Delete the Team/Site/Planner/Viva Engage Community/Group action, the status will be updated in the info page and in the directory list, but will remain in ProvisionPoint.
The Delete options can also be initiated by a Lifecycle Policy.
  
If a Custom or Site Directory List has been setup, this will either be flagged in the 'PPDeleted' Column as true or will be removed from the list.
Check the Integration tab setup to confirm.
 

Delete from ProvisionPoint

If the workspaces should be removed from ProvisionPoint, use the 'Delete from the Directory' action or lifecycle action. When the action is run the ProvisionPoint Directory will no longer display the workspace.
The Directory will no longer show the workspace to any users, including Admins
 
 
If 'Delete from directory' is run before the 'Delete the Workspace' action, the Microsoft Team/Site/etc will be left in place, but ProvisionPoint will not show them.
 
Whatever the reason for the deletion, this can mean that workspaces are no longer being monitored via our compliance policies or allow actions to be run on them. 
There is an option to restore the workspace to ProvisionPoint or update the deletion status to match M365.
 
 

Restore Workspaces

Restore in M365

Regardless of how the deletion happened a soft delete in M365 is completed giving you 30 days to restore. 
ProvisionPoint can not restore any deleted Groups, Sites or Teams in M365, this task must be completed in M365
This can take up to 24 hours to restore.
Ensure if the items are group connected that the Group is restored as well as the other elements.
 

Restore in ProvisionPoint

Once this is restored in M365, the Team or Site will need to be restored to the directory in ProvisionPoint to access the history, lifecycle, timeline, info.
As there is no instance shown in the directory, the restore can only be completed using our API. 
Before continuing, please read the [insert ProvisionPoint Workspaces API Setup article] to ensure this is already enabled for you to use. 
 

Identify Instance's

To collect the service instance id of the workspace to restore either:
  1. Collect from the 'Site Directory List' configured in the integration tab.
  2. Use the API to get the deleted workspaces
  3. Raise a ticket with support providing the name and the URL of the workspaces that were deleted.

Permissions

To make an API call to restore the App Registration (created in the API setup) must be added to a security group that has been granted the 'App Managers' role in ProvisionPoint.
 
In the image example, PP_API holds the service principal for the API I created. The name of the App Registration will also appears as the person who ran the API call. To change this you can use a delegated requestor.

API call endpoint

The ProvisionPoint API is a REST API so can be called using PowerShell, PowerAutomate or other REST applications.
The details for the API call can also be found in our Run Actions using an API call article.
 
Example of the body for a Power Automate Flow. In the example below,
  1. The URI has been added to a variable and the service instance id of '3258' has been added. This could be dynamically added using the manual trigger as well.
  2. The authentication has been added by variables. Our Http calls will need advanced > Active Directory OAuth setup. These details will link to your app registration
 
 
If you are planning on running this via PowerShell, use our example script and modules folder found in Resources.
Below you can see the details needed to build the action body for the Rest call.
Add authentication and connection to your API using an example attached
$ServiceInstanceId=3258

$action = @{

ActionTypeId= 44

}

$Response = Invoke-PPNewServiceInstanceAction -ServiceInstanceId $ServiceInstanceId -ServiceInstanceAction $action # -DelegatedRequestorUpn $DelegatedRequestor
 
Once this has run successfully the timeline will be updated:
 

Known Issues - Partial Restore in M365

If only the Site has been restored, but the group cannot, this will fail to restore. We complete the restore to the GroupId we have held.

As each workspace is linked to a Service definition which in turn is linked to a service type, this defines if a Group is expected. If we cannot find the Group we cannot restore.

There are two options available:

  1. If you do not want to re add a group 
    1. Delete the workspace from ProvisionPoint 
    2. Import it into a Service Definition that matches the Service type of Site Collection > Team Site (no Group)
  2. If a Group is needed 
    1. Add a Group/Team to your Site in Microsoft (this will have a new GroupId),
    2. Delete the current workspace from ProvisionPoint
    3. Import the Group into the same service definition as before
  3. If a Group is needed and you want to retain the timeline history
    1. Add a new Group/Team to your Site in Microsoft (this will have a new GroupId),
    2. Provide the new GroupId to our support team who will ask for this to be updated internally.
    3. Run the restore script.
    4. This can have a delay of 3 weeks to apply the fix
ProvisionPointSECURTIY, COMPLIANCE & GOVERNANCE