Layeronexactlywhateachtenantneeds.

A restorable copy of the directory, held outside the tenant it protects.

Requires an active Kapsul8 subscription. Available from Starter.

• Scheduled backup across users, groups, roles, applications and conditional-access policies
• Held outside the tenant, so the copy survives the tenant itself — and able to rebuild hard-deleted objects, not only ones still inside a recycle-bin window
• Keeps history for as long as you set it, from seven days to ten years, or indefinitely
• Point-in-time restore of individual objects or whole object classes

Know what changed in the directory, when, and by whom.

Requires an active Kapsul8 subscription. Available from Starter.

• Field-level drift detection between any two points in time
• Cross-tenant configuration comparison across your portfolio
• Security-baseline scoring against recognised framework controls
• Change alerting on the object classes you decide matter

Push a known-good baseline across the portfolio instead of clicking through it.

Requires an active Kapsul8 subscription. Available from Starter.

• Reusable configuration templates applied across multiple tenants
• Per-tenant review before anything is written
• Per-tenant rollback of a deployment to the state captured before it
• Conditional Access What-If: test how a tenant’s live policies treat a given sign-in, and scan sample sign-ins for gaps no policy covers

Identity threat detection and identity hygiene, on top of Orchestration.

Requires an active Kapsul8 subscription. Available from Starter.

• Identity threat detection: impossible travel, brute force, token replay and eleven more detectors. Sign-in-based threat detectors need Microsoft Entra ID P1 or P2.
• Cross-tenant threat correlation across your portfolio
• Break-glass account vault with scheduled password rotation
• Hygiene engine and configuration export as JSON