Sophos and Rubrik have announced the general availability of a Microsoft 365 backup and recovery offering for Sophos customers, delivered through Sophos Central.
The product, titled Sophos Backup and Recovery Powered by Rubrik Cyber Resilience, is designed to help organisations recover Microsoft 365 data after incidents including ransomware, account compromise, insider threats and accidental deletion. It follows a strategic partnership between the two companies announced in August 2025.
Microsoft 365 is widely used for email, identity and collaboration, and has become a frequent target for attackers seeking to exploit compromised identities to access data and disrupt operations. The companies are positioning the integration as a way to bring backup and restoration workflows into the same console used for threat detection and response, with the aim of reducing reliance on separate tools during an incident.
According to Sophos, the add-on integrates Rubrik’s SaaS-based protection for Microsoft 365 into Sophos Central and covers Exchange Online, OneDrive, SharePoint and Teams.
Key capabilities listed include air-gapped, immutable backups using WORM-locked immutability and customer-controlled encryption; the ability to restore emails and files at a granular level or at scale; automated discovery and protection of new users and workloads using Entra ID-based controls; and management of recovery actions in Sophos Central alongside detection and response activity.
“Staying operational in a world of constant digital disruption requires confidence in your ability to quickly recover,” said Tom Foucha, vice president of product management at Sophos. “By bringing recovery directly into the same platform where security teams detect and respond to threats, we’re making cyber resilience practical. This gives organisations a faster, more direct way to withstand attacks and keep their business running.”
“For organisations, where Microsoft 365 anchors everything from email to collaboration to critical file storage, its resilience isn’t optional,” said Mallika Swaminathan, product management lead at Rubrik. “Effective cyber resilience means ensuring recovery is reliable and rapid when organisations need it most. By embedding recovery into Sophos Central, we’re simplifying how organisations protect and restore their Microsoft 365 data in critical moments.”
Sophos said the new capability is available as an add-on for its customers. The company also stated it supports more than 600,000 customers worldwide and that Sophos Central integrates telemetry sources across endpoint, cloud, network, identity, email and business applications, which it said can provide additional context for recovery.
