Complete Microsoft 365 recovery. Not just the mailboxes.
Kapsul8 backs up more than mail and files: calendars, contacts, archive folders, Microsoft 365 Groups and SharePoint lists. Mail restores at the item level, three ways: side-by-side into a staging folder, in place, or an exact-state revert on the source mailbox that also removes what was added after the chosen point. Microsoft 365 Groups conversations and Planner are captured too, browsable and eDiscovery-exportable rather than restored back into Microsoft 365. Agentless, encrypted with the tenant's own key, and logged in a tamper-evident audit chain, ZAR-billed and SA-resident.
04:00
04:00
04:00
04:00
12:10
04:00
From consent to protected in three steps.
No installers, no per-user setup, no passwords stored. The connection is a Microsoft admin-consent flow.
An admin approves the Microsoft consent screen. Kapsul8 talks to the tenant through Microsoft Graph from that moment on.
Exchange, OneDrive, SharePoint and Teams. Protect every one, or start where the risk is.
One full baseline backup, then delta sync forever: only changed data moves, on schedule, without touching users.
Four workloads, and exactly where each restore stops.
Backed up, browsable, exportable for eDiscovery and restorable back into Microsoft 365 are four different things, and most product pages collapse them. These four cards keep them apart — including the two we keep for eDiscovery and cannot put back.
Mail, calendar, contacts, and the archive folder. Mail is delta-synced; calendar, contacts and the archive folder are re-listed in full each run. Restore a single item, a folder (without its subfolders) or the whole mailbox to any retained point in time; nested folders are not rebuilt.
Per-user drive backup with item permissions. Restore a file, a folder or a whole drive as it stood at any retained restore point; files added since stay, and item permissions are recorded, not re-applied.
Document libraries, custom lists, site pages and subsites, kept in structure with permissions. Restore an individual document, or a list as a set that skips the items still there; item permissions are recorded, not re-applied.
Top-level channel messages restore into Teams with their original author and timestamp; their replies, reactions, inline images and attachments are not restored, and a message whose author no longer exists in the tenant is reported rather than restored. Selected messages that are missing from their channel come back in a new “(Restored YYYY-MM-DD)” channel in the same team, never into the live channel, and a message still there, edited or not, is left as it is. A whole channel or team is restored as a new channel or team. Private and shared channels are not restored: each is declined, or skipped in a whole-team restore, with the reason given, so one is never recreated as a standard channel. Channel files restore like any SharePoint file when the team’s SharePoint site is backed up. Microsoft 365 Groups conversations and Planner are captured, browsable and eDiscovery-exportable; Kapsul8 does not restore them back into Microsoft 365. 1:1, group and meeting chats are captured in the backup, but are not yet browsable or exportable in the portals and are not restored back into Teams. Chats hosted in another organisation’s tenant (external meeting threads) can’t be captured by a tenant-scoped connector; the backup logs them as out of scope rather than skipping them silently.
Three ways to restore. Three places to land it. Any retained restore point.
Recovery beyond mailboxes and files: a calendar, contact list, archive folder or SharePoint list restores as a set that skips what is already there, so a single deleted event, contact, archived message or list item comes back without duplicating the rest (a contact or list item edited since the backup can come back as a second copy, and lists restore in place only). Archived mail comes back into the main mailbox, not the archive, and only the main mailbox is checked for messages already there.
Restored mail and files land in a clearly labelled staging folder, all in that one folder rather than in their original subfolders; calendar events and contacts land in a new restore calendar or contact folder. Nothing that already exists is changed — the safe default when you are not certain what the live state should be.
Puts items back where they came from: the live mailbox, drive or site. Mail, calendar events and contacts: what is missing is added back, and anything still there is left untouched. Files: a missing file is re-created and an unchanged one skipped; a file that changed since the backup is kept, and the backed-up version is restored beside it under a “(restored YYYY-MM-DD)” name — or, if you choose for that restore, replaces it (the ransomware-recovery choice) or is skipped. Microsoft does not support an app-only replace of a file protected with a sensitivity label, so Replace cannot overwrite those files. Teams: missing channel messages come back under their original author and time in a new “(Restored YYYY-MM-DD)” channel in the same team; messages still in the channel are left alone. Approval-gated because it writes to live data; a Teams restore, which writes only to a new channel or team, is run by an MSP administrator.
Rolls a mailbox back to a chosen point and removes what was added after it — the mode for undoing a compromise. Blocked while a legal hold is in force; soft-deletes, never shreds.
In place, side-by-side into a staging folder, or, for mail, into another user’s mailbox in the same tenant or in another tenant managed by the same MSP
Restore points as often as every four hours, retained up to seven years
Every restore needs a second person to approve it — in-place, exact-state and side-by-side alike · the one exception is a child job under an already-approved whole-tenant restore, which inherits that approval · no mail or file restore can be requested under an active legal hold
Three calls every MSP knows. Three quiet endings.
A mail item was hard-deleted weeks ago, the recycle bin has long moved on.
Open the snapshot timeline, pick the day it still existed.
That one item restored to the mailbox. Nothing else touched.
A OneDrive file was saved over, the good version no longer exists in the live tenant.
Pick a restore point from before it was saved over.
The file as it was then, restored beside the saved-over one, in its place if you choose, or in a staging folder.
A user leaves. The license is freed, but their history can’t just disappear.
The seat moves to Archived at 50% of the active rate, with no add-on billing.
Everything stays restorable for the full retention period, or under legal hold.
Why the storage bill stays small.
Two mechanics compound. Delta sync means only changed data ever moves after the baseline, and the cursor persists, so throttling or an outage never forces a restart. Content-addressable storage means identical files across users are stored exactly once. How much smaller the stored footprint is than the raw estate depends on how much duplicate content the tenant holds.
Deduplicated once, then encrypted, dedup happens before per-tenant encryption, so savings never come at the cost of isolation.
Ransomware can’t delete what it can’t touch.
Your managed backups live outside your Microsoft tenant — on independent storage your Microsoft administrators hold no keys to — written to write-once storage governed by S3 Object Lock in compliance mode. An attacker who steals Microsoft admin credentials can encrypt or wipe what’s inside your tenant, but has no path to reach, alter or delete the copy Kapsul8 holds. Under compliance-mode Object Lock, a locked restore point can’t be changed or deleted by anyone — a rogue insider, or even VaultFuzion — until the retention period you set lawfully expires. Microsoft’s own native backup is append-only rather than deletion-proof, and stays inside your tenant’s Microsoft data boundary and geo. Kapsul8 keeps a separate copy you control, in write-once storage, for the full retention period you set.
Microsoft native-backup behaviour verified against Microsoft documentation on 04/09/2026; Microsoft revises these capabilities regularly.
Every snapshot arrives ready for scrutiny.
Each client encrypted with its own key, cryptographic isolation, not a shared vault.
Every backup, restore, and retention action lands on a tamper-evident audit ledger.
Configurable from 30 days to 7 years, with automatic disposition when periods lapse.
A SHA-256-sealed certificate on object-level disposition and crypto-shred, recording what was disposed of, how and when.
Priced per seat. The rate falls as you grow.
Starter R29.99, Growth R22.99, Scale R14.99, Volume R11.99, Enterprise custom. Identical product in every band; the seat count you commit to sets the rate. Seats whose mailbox is no longer found in Microsoft 365 archive at half the active rate instead of billing full price forever; pausing a mailbox does not archive it.
Frequently asked questions.
Point it at a tenant and watch the first baseline land.
Tell us about your MSP and we will reply within one business day. Tenant and partner-portal configuration typically follows within one to two business days.