In a disaster or cyber-recovery scenario, organizations often struggle to identify which users and data are critical for immediate recovery to achieve a "minimum viable business" state. This is particularly challenging for large-scale environments, such as healthcare organizations with tens of thousands of users and hundreds of terabytes of data. IT leadership faces significant concerns about recovery speed, as traditional mass-restore methods can take days to complete, stalling business continuity.

Rubrik Microsoft 365 Autonomous Business Recovery (ABR) is a business-centric recovery platform for Microsoft 365 that transforms recovery from a technical process into a business continuity strategy by restoring the right people, with the right data, at the right time.

ABR integrates with Entra ID to simplify user grouping and prioritize restoring essential users. ABR can reduce recovery time from days to hours by narrowing the recovery scope to only the most important and relevant data for key individuals. This approach allows our customers to define the who (critical users or groups) while Rubrik determines the what (essential data) to restore first.

One Million SharePoint File Restores = Nine Million API Calls

The primary technical hurdle for large-scale M365 recovery is the limitation of Microsoft APIs. These include:

Hard Ceilings: Enterprise tenants are capped at 6 million API calls per day, with additional restrictions in 5-minute windows to prevent server spikes. Once these limits are reached, data movement stalls entirely until the quota resets.

The Multiplier Effect: Restoring a single file is not a single action but a sequence of technical handshakes. For example, restoring one SharePoint file requires 9 separate API calls.

For example, a single SharePoint file restore requires 9 API calls. So restoring 1 million files requires 9 million API calls, which immediately exceeds daily quotas and stalls data movement until the next quota reset.

Consider a company with 250 million SharePoint items spanning years of data. If a major cyberattack or accidental deletion occurs, restoring the entire 250 million items could take months under the 6-million-call daily API cap. If you include Exchange and OneDrive items, the recovery period will be even longer. A lengthy recovery process is simply unacceptable, as critical data users need for their jobs today remains inaccessible. 

The inability to prioritize and immediately recover the most critical, high-impact data renders the backup and the lengthy recovery process practically useless in a real-world disaster scenario, extending recovery times to weeks or months. Businesses cannot survive such long outages!

How ABR Solves the API Call Problem

ABR mitigates API bottlenecks by limiting recovery to the most recent, critical data (typically the last 1-7 days). By focusing on a specific subset of data for high-priority users, the organization can significantly reduce the number of API calls required. This allows organizations to resume operations quickly while the remaining data is restored in the background.

Here’s how you can implement Rubrik ABR to reduce recovery time from days to hours:

• Entra ID Integration: Rubrik leverages existing Entra ID groups (dynamic, modern, or nested) to identify priority users. Only groups explicitly added to the Rubrik Security Cloud (RSC) are inventoried. Rubrik recommends creating high-level priority groups (e.g., Priority 0, Priority 1) with nested critical user groups within the priority groups.

• Core Group Definition: Admins define the core users for recovery using the Entrata ID groups.

• Workload Coverage: ABR currently covers Exchange, OneDrive, and SharePoint, with Teams support coming soon.

   

• Granular Recovery Windows & Workload Selection: Admins select the workloads for recovery and a recovery window of 1-7 days, based on the most recent data. 

   

• SharePoint and OneDrive Access Log Analysis: ABR analyzes user activity logs from M365 audit logs to identify content accessed, created, or modified by users within the selected Entra groups, within the recovery window timeframe (e.g., last 1-30 days). This ensures that even if a critical file resides in a non-critical site (e.g., a Finance file accessed by IT Operations), it is included in the recovery plan.

• Exchange Metadata Analysis: ABR analyzes existing Exchange backup metadata and searches index files to identify items created or modified within the recovery window timeframe (e.g., last 1-30 days).

• Pre-Recovery Planning: ABR generates a comprehensive recovery plan for all workloads, providing the admin with visibility into the process before the restoration begins.

   

• Recovery: RSC then instructs the recovery operation to resume, quickly restoring critical recent data, using limited API quotas to restore relevant data first. 

Once the high-priority recovery is complete, the restoration of remaining user data continues in the background to ensure full environment parity over time.

Benefits for Technical Implementers and M365 Practitioners

Shifting from a bulk restore mindset to a prioritized autonomous approach gives ABR several key advantages for M365 practitioners:

• Drastic RTO Reduction: Reduces the Recovery Time Objective for a minimum viable business state from days to hours.

• Operational Efficiency: Automates data identification based on user criticality to eliminate the manual task of mapping users to specific sites or files.

• API Quota Management: Optimizes Microsoft's daily API limits by prioritizing high-value data to prevent recovery operations from stalling.

• Scope Discovery: Analyzes access logs to capture critical files across silos, including non-critical SharePoint sites.

• Declarative Strategy: Enables a business-centric recovery where admins define priority groups in Entra ID while automation handles the execution.

• Phased Business Continuity: Enables rapid resumption of operations with the most recent 1 to 30 days of data.

   

Ready to see it in action? Explore the Rubrik Protection for Autonomous Business Recovery demo and learn how your organization can benefit!

SAFE HARBOR STATEMENT: Any unreleased services or features referenced in this document are not currently available and may not be made generally available on time or at all, as may be determined in our sole discretion. Any such referenced services or features do not represent promises to deliver, commitments, or obligations of Rubrik, Inc. and may not be incorporated into any contract. Customers should make their purchase decisions based upon services and features that are currently generally available.