Restoring Microsoft 365 Without Restoring the Attack | Information & Data Manager

Restoring Microsoft 365 data after a cyber attack carries the risk of restoring the attack along with it. Commvault is targeting that problem with two paid add-ons that scan backup copies for threats and sensitive data.

The first, Commvault Threat Scan, looks for malware, ransomware, encryption activity, data anomalies and other indicators of compromise. It works across protected Exchange, OneDrive, SharePoint and Teams data.

Threat signals are then used to isolate compromised content and identify clean, trusted recovery points. The aim is to restore only known-good data, reduce the risk of reinfection and speed up recovery.

Threat Scan also applies current threat intelligence to historical backup copies held in immutable storage. That allows it to detect threats that were unknown or undetected when the data was originally protected.

Threat Scan is already available for other Commvault workloads. There it combines signature-based malware scanning with machine learning to flag unknown variants. It also analyses entropy and hash changes across snapshots, according to Commvault's documentation .

Suspicious files can be quarantined so that recovery automatically restores pre-infected versions.

The second add-on, Commvault Data Posture 360, maps where sensitive data resides across Microsoft 365. That includes personally identifiable information and intellectual property.

Data Posture 360 was previously called Risk Analysis. It surfaces exposure risks so teams can prioritise their response.

Microsoft 365 has more than 450 million paid commercial seats worldwide, according to Microsoft figures cited by Commvault. Attackers often target the emails, attachments and shared files held in the platform.

"Commvault is bringing three key elements to the resilience equation with Microsoft 365: detection, visibility, and clean recoveries," said Pranay Ahlawat, Chief Technology and AI Officer at Commvault.

"Resilience and compliance depend on identifying threats fast, understanding if sensitive data is exposed, and what's safe to restore," Ahlawat said.

Spokane Industries uses Commvault to protect its Microsoft 365 data.

"During a cyber incident, knowing what data can be safely restored is just as important as having a backup," said Matt Pancheri, IT Manager and Systems Administrator at Spokane Industries.

"Commvault gives our team a way to investigate our protected Microsoft 365 data and make more informed recovery decisions, helping limit disruption to the business," Pancheri said.

IDC Research Director Jennifer Glenn said flagging compromised data in Microsoft 365 backups gives security and data protection teams the information they need.

"This is essential for enterprises to prove operational data is both recoverable and trustworthy," Glenn said.

Both capabilities are planned for early access preview in the coming weeks, with general availability targeted for early 2027. They will be sold as add-ons to Commvault Backup and Recovery for Microsoft 365, and either can be purchased independently.