Layeronexactlywhateachtenantneeds.

A restorable copy of the directory, held outside the tenant it protects.

Requires an active Kapsul8 subscription. Available from Starter.

• Scheduled backup across users, groups, roles, applications and conditional-access policies
• Independent of the tenant, survives the deletion that Microsoft’s in-tenant backup does not
• Long-retention copies rather than a rolling in-tenant window
• Point-in-time restore of individual objects or whole object classes

Know what changed in the directory, when, and by whom.

Requires an active Kapsul8 subscription. Available from Starter.

• Field-level drift detection between any two points in time
• Cross-tenant configuration comparison across your portfolio
• Security-baseline scoring against recognised framework controls
• Change alerting on the object classes you decide matter

Push a known-good baseline across the portfolio instead of clicking through it.

Requires an active Kapsul8 subscription. Available from Starter.

• Reusable configuration templates applied across multiple tenants
• Staged rollout with per-tenant review before anything is written
• Rollback to a previous captured state
• Bulk remediation of drift detected in Tier II

The full identity surface, including the privileged-access layer.

Requires an active Kapsul8 subscription. Available from Starter.

• Privileged Identity Management policy capture and restore
• Identity threat signals: impossible travel, brute force, token replay
• Extended object coverage across the wider directory surface
• Priority restore handling during an active identity incident