Ransomware protection for Microsoft 365 that starts with the backup
Ransomware encrypts files in OneDrive and SharePoint and syncs the damage into every copy Microsoft keeps. GraphCapsule keeps immutable backups outside your tenant, spots an attack in the backup itself and restores the last clean state.
Why Microsoft 365 alone does not stop ransomware
Microsoft 365 is built to keep your data available, not to roll it back. Version history, recycle bins and retention policies live inside the same tenant an attacker has just taken over — and an account with admin rights can change or empty them.
Encrypted files also look like ordinary edits. OneDrive syncs them, SharePoint versions them, and by the time someone notices, the encrypted copies have replaced the good ones. A backup only helps if it is kept apart from the tenant, cannot be altered and tells you which restore point is still clean.
Four layers against ransomware
Each one works on its own; together they make sure a clean copy survives the attack.
Immutable backups
Backups are isolated from your Microsoft 365 tenant. Sealed archive data is protected against modification and deletion by database-level triggers and verifiable through SHA-256 hash chains — including against actions by application administrators.
Detection in every backup run
Backup Shield checks every run with six independent signals: entropy and compression analysis, a 30-day baseline per mailbox, and matching against more than 100 known ransomware file extensions and ransom-note names.
Suspicious snapshots are frozen
When a critical signal fires, or two independent signal families agree, the affected snapshot is frozen so encrypted data cannot overwrite your clean backups. A Clean Score from 0 to 100 shows the health of every run.
A clean copy in a second EU data center
Only backups that pass the checks are replicated to geographically separate storage in the EU and verified with SHA-256 — so a restore point survives even if the primary storage is hit.
How it works
- 01
Back up continuously
GraphCapsule backs up Exchange Online, OneDrive and SharePoint automatically and measures the entropy and compression of every item as it goes.
- 02
Detect and isolate
After each run, Backup Shield compares it with the baseline, scores it and freezes anything suspicious before it can reach the replica.
- 03
Restore the last clean state
Pick the last clean restore point and bring back single files, folders or whole mailboxes — to the original location or to another user.
Frequently asked questions
- Does Microsoft 365 protect against ransomware?
- Microsoft 365 has malware filtering and version history, but both run inside your tenant. If an attacker gets admin rights, or encrypted files sync into the cloud, versions and retention can be overwritten or deleted. The copy that survives is an independent, immutable backup outside the tenant.
- How does GraphCapsule detect ransomware in a backup?
- Backup Shield combines content analysis (entropy, compression ratio and entropy uniformity) with a 30-day behaviour baseline per mailbox and a curated feed of ransomware indicators. Snapshots are only frozen on a critical finding or when two signal families agree, which keeps false alarms down.
- Can ransomware encrypt or delete my backups?
- Backups are stored outside your Microsoft 365 tenant and encrypted with AES-256-GCM before they reach storage. Sealed archive data cannot be modified or deleted, and verified clean runs are additionally replicated to a second EU data center.
- How quickly can I recover after an attack?
- Most restores complete within minutes; a single item typically takes under three seconds, depending on its size and the Microsoft 365 API. You choose the restore point, so you can go back to the state before the attack began.
- Is Backup Shield included in every plan?
- Backup Shield is an add-on for any plan and is billed by replicated storage, with no per-mailbox fees. Encryption and point-in-time restore are part of every plan; WORM archiving is included from the Professional plan.
Related topics
Backup Shield
Ransomware detection for Microsoft 365 backups from six signals, including entropy and IOC matching, plus replication to a second EU data center.
Security
How GraphCapsule protects Microsoft 365 backups: AES-256-GCM encryption before storage, keys in HashiCorp Vault, optional customer keys, EU-only storage.
Email archiving
Tamper-proof email archiving for Microsoft 365: WORM storage with SHA-256 hash chains, retention from 1 to 10 years, legal hold and eDiscovery export.
Exchange Online backup
Exchange Online backup for mailboxes, shared mailboxes, calendars and contacts. Restore single emails or whole mailboxes in minutes, hosted in the EU.
From our blog (in German)
Ransomware in Microsoft 365: Warum das Backup früher hinschauen mussRead the articleProtect your Microsoft 365 data today
30 days free with up to 5 mailboxes, no credit card required. Set up in minutes.