Rubrik (NYSE:RBRK) said it has integrated its platform with Microsoft Defender (NASDAQ:MSFT), linking real-time identity threat detection with automated tools for identity rollback and system recovery. The collaboration was unveiled at the RSAC 2026 conference.
The integration enables organizations to feed Microsoft Defender alerts directly into Rubrik’s identity recovery workflows. This allows security teams to investigate incidents, undo malicious identity changes and restore affected systems across hybrid environments.
Research from Rubrik Zero Labs shows that 90% of IT and security leaders consider identity-based cyberattacks their top concern. The new integration is designed to bridge the gap between detecting a threat and restoring operations, helping organizations move from a compromised state to recovery within hours instead of days.
“Detection is only half of the battle,” said Anneka Gupta, Chief Product Officer at Rubrik. “Organizations need the ability to quickly and surgically reverse malicious identity changes and completely restore their infrastructure.”
The joint solution allows customers to match threat alerts with identity modifications, reverse malicious identity changes without requiring full domain restoration, restore verified identity states using immutable recovery points and maintain visibility across hybrid identity environments such as Active Directory and Entra ID.
Over the past 15 months, Rubrik has expanded its identity protection offerings, adding recovery tools for Active Directory and Entra ID, support for environments using multiple identity providers including Okta, and integrations with security platforms such as CrowdStrike Falcon Identity Protection.
According to the company, the integration supports Rubrik’s broader Identity Resilience strategy, which focuses on ensuring identity systems remain secure, accessible and recoverable during cyberattacks, operational disruptions and compliance events.