If a deprovisioned user was re-enabled manually rather than via the Undo Deprovision option, the account might be repeatedly deleted by the daily scheduled task, even though the user account is restored from AD backup.
The user account gets deleted by a built-in scheduled task. By default, the scheduled task runs daily at 3 AM.
The scheduled task identifies user accounts to be deleted by the value of the edsvaDeprovisionDeletionDate attribute.
The attribute value is set by the User Account Permanent Deletion policy when user account is deprovisioned.
Option 1 (recommended)
Repeat steps 1 - 2 for each user account you want to stop from being deleted.
Option 2 (advanced)
Repeat the steps 1 - 8 for each user account you want to stop from being deleted.