October’s Druva releases push backup further into incident response. This bulletin covers the general availability of Threat Watch, Threat Hunting and Cyber Recovery Runbooks for Microsoft 365, the new Identity Resilience behavioural insights and guided recovery across Entra ID, Okta and Active Directory, Microsoft 365 Archive support for SharePoint Online, the October Enterprise Workloads agent and proxy builds, and Recovery Intelligence for Microsoft 365 in GovCloud.

Identity Resilience: recovering servers is not recovering

The most consequential October release is behavioural insight and guided recovery for identity. Druva now shows the blast radius of a compromised identity across Microsoft Entra ID, Okta and Microsoft Active Directory.

• Identity change timeline — tracks created, modified and deleted objects.
• Blast-radius visibility — identifies affected identities and relationships.
• Behavioural insights — helps identify suspicious identity modifications.
• MITRE ATT&CK mapping — correlates risky changes with relevant attack techniques.
• Recovery recommendations — suggests recovery actions for the changes identified.
• Guided recovery — helps administrators restore impacted identity objects.

Take a ransomware incident where an attacker compromises an administrator account and modifies identity permissions. The capability walks you from identifying the compromised identity, through the changes it made and the users, groups and relationships affected, to spotting privilege escalation and persistence activity, and on to guided recovery of those objects.

The underlying point is worth repeating to customers: restoring servers and applications is not enough if the identity infrastructure is still compromised. You will restore into the same open door.

Threat Watch, Threat Hunting and Cyber Recovery Runbooks are GA for Microsoft 365

Three capabilities reached general availability together, and between them they change what a Microsoft 365 backup is for. Threat Watch identifies potential threats and suspicious activity affecting protected data. Threat Hunting investigates backup data to find compromised or suspicious content. Cyber Recovery Runbooks provide structured recovery workflows following an incident. Recovery validation helps identify safer recovery points before you restore anything.

The operational gain is mostly about confidence: less risk of restoring infected data, better incident investigation, standardised recovery procedures, and less manual effort when something has actually happened.

A smaller October addition that will save someone an afternoon: you can now select Restore Missed Items from an Exchange Online restore job, and Druva creates a new restore job containing only the missed items, reusing the original restore settings. It is available on request through Druva Support.

Your SharePoint policy probably does not cover archived content

Druva now supports protecting SharePoint Online content stored in Microsoft 365 Archive — the lower-cost tier organisations move inactive sites into while retaining permissions, metadata and compliance settings.

• Detect archived SharePoint sites.
• Identify archived files at the individual file level.
• Include archived content in backup protection.
• Retain the last backed-up version of archived files.
• Restore archived files through the standard restore interface.
• See an Archived label in the restore view.

Until now, archived SharePoint content had to be reasoned about separately when reviewing protection coverage, which in practice often meant it was not reasoned about at all. Review your SharePoint backup policies and confirm that archived sites and files sit inside protection — and inside recovery testing.

Enterprise Workloads: the October agent and proxy builds

October was a bug-fix month for Enterprise Workloads rather than a feature release, but the agent and proxy revisions matter in production.

• Windows File Server, Linux File Server, Microsoft SQL Server, NAS and Oracle Direct to Cloud — 8.0.2-1077869
• VMware Backup Proxy — 7.1.2-1076666
• Enterprise Workloads AWS Proxy — 7.0.3-1087976
• Oracle Phoenix Backup Store — 7.0.2-1077803
• Hyper-V FLR Proxy — 6.3.5-443722
• Nutanix AHV — 6.3.9-1077844
• SAP HANA — 7.0.0-1039308
• Proxmox — 7.0.0-1076659
• OpenStack — 7.0.0-1076684

Cloud availability is not uniform, so check before you plan. The October File Server agent is listed across AWS Public Cloud, Azure Public Cloud and AWS GovCloud; the SQL Server version is listed for AWS Public Cloud and GovCloud, but not Azure Public Cloud.

The routine still applies: review installed agent and proxy versions, compare them against the October revisions, check workload-specific compatibility, schedule upgrades during approved maintenance windows, and validate backup and restore operations afterwards.

Recovery Intelligence for Microsoft 365, in GovCloud

Announced on 24 October, Druva brought Recovery Intelligence for Microsoft 365 into its FedRAMP-certified GovCloud environment, covering OneDrive, SharePoint Online and Exchange Online.

• Pre-recovery threat hunting — identify non-impacted backup snapshots before recovery starts.
• Cyber Recovery tab — recovery-focused visibility inside the Microsoft 365 restore workflow.
• Scheduled Cyber Recovery Testing — automated recovery exercises to validate readiness.
• Live Incident Recovery — recover critical resources into a secure environment using verified clean snapshots.
• Application-level recovery — recover a whole business application stack in one coordinated action rather than resource by resource.

Together these reduce the risk of reinfection during recovery. One caveat: this is documented in the GovCloud release notes, so do not assume identical availability in commercial cloud tenants.

Security and administration round-up

• Identity security — Behavioural Insights and Guided Recovery. Review privileged identity changes.
• Microsoft 365 — Threat Watch and Threat Hunting GA. Evaluate activation and licensing.
• Recovery security — Cyber Recovery Runbooks. Develop and test recovery procedures.
• SharePoint — Microsoft 365 Archive protection. Validate archived content coverage.
• VMware and cloud — Ransomware Detection. Evaluate clean recovery point identification.
• Administrator access — View-Only Administrator role, from September. Apply least-privilege access.
• Identity provisioning — SCIM 2.0 integration, from September. Evaluate automated administrator provisioning.

Want to test any of this properly?

Arrosoft can review your SharePoint policies for archived content, check your Enterprise Workloads agents against the October builds, and help you build and rehearse a Cyber Recovery Runbook before you need one. Get in touch.

Full detail: Druva cyber resiliency release notes and release notes for Druva for Microsoft 365.