This bulletin covers Druva’s September 2026 releases, along with the August changes still worth acting on. Every item carries the date Druva announced it.

Worth acting on now

Ransomware Detection on your backup data

Druva has added Ransomware Detection, a multi-stage framework that uses machine learning and pattern recognition to spot ransomware activity inside data that has already been backed up. It combines behavioural indicators with forensic validation, and it does not need a learning period before it becomes useful. Supported on VMware virtual machines, Azure virtual machines and AWS workloads (EC2 and EBS volumes).

This is the one to look at first, because it changes what you can say about a recovery point before you restore it. Availability is limited by licence type, region and other criteria, so talk to Druva support or to us about whether your tenant qualifies. Announced 17 September 2026.

Upgrade your eDiscovery Download Client before it stops working

Versions of the eDiscovery Download Client older than v2.3.0 are now end of life, because of new DigiCert G2 root CA certificates. If you do not upgrade to v2.3.0 or later you risk service interruption on legal hold downloads.

The current v2.4.0 also adds NAS support, so legal hold custodian data and metadata can be downloaded straight to a network attached storage location instead of to local disk first, which removes the local capacity ceiling on large collections. Mount and authenticate the NAS before starting the download. Announced 19 September 2026.

Reset your Managed Services Center passwords, then turn on MFA

From August, but still action-required if you have not done it. Druva has made a strong password policy mandatory for every administrator who signs in to the Managed Services Center console, and added TOTP-based multifactor authentication. The order matters: administrators have to reset their passwords to meet the new policy before they can configure MFA. Announced 6 August 2026.

Because MSC spans multiple customer environments, we would use this as the prompt for a wider access review on your side — privileged administrator accounts, partner and sub-partner access, tenant administrator access and service-account permissions. Those are our recommendations rather than changes Druva shipped.

Add Microsoft 365 Teams to your Cyber Recovery Plans

Teams can now be included as a resource type in Cyber Recovery Plans and runbooks, so recovering Teams during a ransomware incident or a mass corruption event becomes part of an orchestrated, repeatable workflow rather than a manual scramble. Restoring a Team also restores its associated SharePoint site.

If you already run Cyber Recovery Plans for Microsoft 365, this is a good moment to revisit your recovery sequences and decide where Teams sits in the priority order. Announced 27 August 2026.

Scan before you restore on Azure VMs

File-level restores from Azure VM backups can now be scanned before the restore completes. The workflow combines antivirus and indicator-of-compromise scanning with threat filtering and quarantine of anything malicious.

The practical change is to the shape of the recovery process. It moves from backup, restore, investigate to backup, scan, validate, restore, which matters when the incident you are recovering from is the reason the files are suspect in the first place. Requires an Advanced Ransomware Recovery or Premium licence. Announced 3 August 2026.

Also new in September

• ServiceNow incident ticketing from Managed Services Center — MSC can now create ServiceNow incidents automatically when SIEM alerts fire for MSC or customer environments, update them as the alert develops and close them when it resolves. Announced 3 September 2026.
• Quota management with decimals and automation APIs — quota and increment values can be set as decimals for more precise storage allocation, with new APIs to manage quotas and threshold configuration programmatically. Announced 3 September 2026.
• Auto-archival for Service Monitoring alerts — alerts clear automatically when the underlying resource is disabled, deleted or excluded from monitoring, which cuts alert fatigue. Announced 3 September 2026.
• Agentless protection for Canonical OpenStack — proxy-based backup and recovery with auto-discovery of virtual machines, restoring to the same or an alternate project or region. Announced 21 September 2026.
• Ceph RBD as a Proxmox backup storage target. Announced 21 September 2026.
• TurboTier with Dell PowerProtect Data Domain — keeps data local on the Dell appliance while synchronising backups to the cloud, with UI-based management, extended retention of up to 90 days, multi-instance topology and automatic failover. Announced 21 September 2026.
• Oracle on RHEL 9 — Oracle DTC now backs up and restores Oracle databases running on Red Hat Enterprise Linux 9. Announced 21 September 2026.
• 30-day free trials for Okta, Active Directory and Dynamics 365 — new customers start one at signup, existing customers from the Workloads section of the console. Subject to regional availability. Announced 25 September 2026.
• ServiceNow Australia version support for the Druva integration, covering Australia Cloud and FedRAMP GovCloud. Announced 20 September 2026.

Also new in August

• Clearer Azure VM file-level restore — the console now validates disk types, volume configurations and supported operating systems before a restore starts, and error messages explain the root cause with remediation steps in the interface. Announced 17 August 2026.
• File-level restore on deduplicated VMware volumes — FLR is now supported on VMware VMs running Windows NTFS volumes with Data Deduplication enabled. Announced 17 August 2026.
• Dynamics 365 in consumption reporting — Total Allocated Active Users and Total Active Users now appear in the daily and monthly chargeback reports, which helps with chargeback, billing and capacity planning. Announced 14 August 2026.
• A single global MCP Server endpoint at mcp.druva.com/mcp, replacing region-specific URLs, which simplifies automation and AI integrations across multi-region deployments. Announced 27 August 2026.

Agent and proxy versions

Released 21 September 2026: Canonical OpenStack 7.0.0-1056138; Proxmox 7.0.0-1039288; TurboTier for Dell PowerProtect 6.3.4-1047411 (public cloud) and 6.3.4-1046038 (GovCloud); Oracle DTC 8.0.2-1049743.

Released 17 August 2026: VMware backup proxy 7.1.2-1013527; file servers (Windows and Linux), NAS and MS SQL 8.0.1-1007181; disaster recovery AWS proxy 7.0.3-1003642; Oracle DTC 8.0.1-1007181; Oracle PBS 7.0.2-1003652; Nutanix AHV 6.3.9-1004398; SAP HANA 7.0.0-1003667; Proxmox 7.0.0-1003646.

Druva recommends upgrading for performance and compatibility.

Want a second pair of eyes on your Druva setup?

Arrosoft manages Druva environments for partners and their customers. If you would like your Cyber Recovery Plans, Managed Services Center settings or eDiscovery client versions reviewed against these changes, get in touch.

Full detail: Cyber Resiliency release notes, Cloud Platform release notes, Enterprise Workloads release notes, Managed Services Center release notes and Druva for Microsoft 365 release notes.