Sophos and Rubrik put Microsoft 365 backup inside Sophos Central

Sophos and Rubrik have made Sophos Backup and Recovery Powered by Rubrik Cyber Resilience generally available, an add-on that lets Sophos customers restore Microsoft 365 data from within Sophos Central.

The offering brings Rubrik’s SaaS-based Microsoft 365 protection into Sophos Central, covering Exchange Online, OneDrive, SharePoint and Teams, pitched at recovery from ransomware, account compromise, insider threats and accidental deletion.

The companies said the point of the add-on is to remove the split between the tools teams use to detect an attack and those they use to recover from it, so responders can see what was affected and restore clean data without switching platforms.

Backups are isolated using an air-gapped architecture with WORM-locked immutability and customer-controlled encryption, which Sophos and Rubrik said prevents tampering even where credentials have been compromised.

Recovery can be granular or at scale, restoring emails, files, mailboxes, OneDrive accounts, SharePoint sites and Teams data to original or alternate users, including inactive accounts. The platform automatically discovers new users, sites and workloads and applies policy-driven protection through Entra ID-based controls.

Backup and recovery are managed alongside detection and response in a single console, giving teams a complete view of both threats and recovery actions. 

The release follows a strategic partnership the two companies announced in August 2025, and moves the integration into production. Sophos said it defends more than 600,000 organisations and that Sophos Central draws on more than 350 telemetry sources across endpoint, cloud, network, identity, email and business applications.

“Staying operational in a world of constant digital disruption requires confidence in your ability to quickly recover,” said Tom Foucha, vice-president of product management at Sophos.

“By bringing recovery directly into the same platform where security teams detect and respond to threats, we’re making cyber resilience practical. This gives organisations a faster, more direct way to withstand attacks and keep their business running.”

“For organisations, where Microsoft 365 anchors everything from email to collaboration to critical file storage, its resilience isn’t optional,” said Mallika Swaminathan, product management lead at Rubrik.

“Effective cyber resilience means ensuring recovery is reliable and rapid when organisations need it most. By embedding recovery into Sophos Central, we’re simplifying how organisations protect and restore their Microsoft 365 data in critical moments.”