Commvault announced identity auditing, Tier 0 exposure mapping, and AI-guided remediation across Active Directory, Entra ID, and Okta. With identity recovery now widely offered, the move pushes Commvault toward ground long worked by identity specialists.
What Is Covered in This Article:
- New IDRecover capabilities: Cross-provider auditing, Tier 0 exposure mapping, and AI-guided remediation, planned for early access in the coming quarters.
- Recovery is widely offered: Data protection vendors have broadly extended recovery into identity, so competition is moving toward exposure and context.
- Specialist overlap: Identity specialists have mapped Tier 0 attack paths for years; Commvault’s edge is tying findings to recovery.
- Buyer priorities: Identity threat detection and posture management both appear among top-cited identity initiatives in Futurum’s survey data.
- Defining “trusted”: Buyers should press on exactly which Entra ID and Okta objects, including non-human identities, get audited and restored.
The News: On October 28, 2026, Commvault announced new identity resilience capabilities spanning Active Directory, Microsoft Entra ID, and Okta. Cross-provider identity auditing will track changes to identities, permissions, and access configurations across all three, while identity attack intelligence will inventory an organization’s most privileged (Tier 0) identity assets and show who controls them. AI-guided recommendations are meant to help teams address risky access, roll back unwanted changes, and recover trusted identity configurations.
Commvault points to the growing use of multiple identity providers in large enterprises, and to the spread of AI agents and other non-human identities, as the drivers.
The auditing and attack intelligence capabilities are planned for early access in the coming quarters as part of Commvault IDRecover, a newly named identity portfolio. They build on automated Active Directory forest recovery (2025), Okta coverage (announced March 2026), and Active Directory Pre Recover (announced September 2026). Commvault will share more at SHIFT 2026 in Nashville, November 10-12.
Commvault Moves Identity Resilience From Recovery Toward Exposure
Analyst Take: Commvault wants its identity portfolio to know which changes are dangerous and what a trusted configuration looks like before anything breaks, and to use that knowledge when it restores one afterward. That moves it earlier in the sequence than the directory and identity provider recovery that much of the backup market has added over 2025 and 2026.
Identity infrastructure offers attackers an unusually good return on their effort. Compromise the accounts and systems that grant access (what Microsoft’s access model calls Tier 0, the control plane), and much of the rest of the environment follows. Help-desk social engineering aimed at Entra ID and Okta accounts has featured in several high-profile incidents over the past two years, which helps explain why identity now sits on the agenda of teams that would not have considered it their problem not long ago, and why this announcement puts Commvault in front of identity and security teams as much as the recovery buyers it knows well.
Three Identity Providers, One Audit Trail
The cross-provider design matches how most large organizations run identity. Large enterprises rarely run a single identity provider; Active Directory, Entra ID, and Okta often coexist, linked by synchronization and federation, and attackers move along those links. A single audit trail across all three, plus an inventory of who controls the most privileged assets, addresses a gap that per-provider tooling tends to leave open.
It also connects to something we have argued for some time: recovery has to restore the identity layer first, and the hard part is less about having a backup than about knowing which state is clean. Change auditing and Tier 0 mapping are, in effect, inputs to that decision.
The Contest Moves From Recovery to Exposure
Identity recovery on its own is no longer much of a differentiator. Rubrik, Cohesity (working with Semperis), Druva, and Veeam, among others, have extended protection to some combination of Active Directory, Entra ID, and Okta, and Microsoft’s native Entra ID backup, currently in preview and included with existing licensing, sets a baseline that third parties will need to clear.
Mapping Tier 0 exposure is different ground, worked for years by identity specialists such as Semperis, Quest, and Netwrix, alongside identity threat detection offerings from larger security vendors. Commvault’s move into that space is legitimate, though the outcome is open: the specialists bring depth on attack paths, while Commvault brings the ability to act on what it finds through its recovery tooling.
Three Teams With a Claim on the Budget
Identity teams, the security operations center, and backup and infrastructure teams all have a plausible claim on this purchase, and they rarely share a budget. Our 1H2026 Cybersecurity Decision-Makers Survey suggests the interest is there, directionally: among identity-focused respondents (N=93), 41% placed identity threat detection and response (ITDR) among their top three initiatives for the next 12 to 18 months, with continuous identity security posture management close behind at 32%.
To us, Commvault’s stronger argument is the link to recovery: tying exposure findings to its Cleanroom and Threat Scan capabilities, so that the platform that spots a dangerous change can also return identity to a known-good state. Competing head-to-head as a detection product would put it on the specialists’ home ground.
Defining “Trusted” Will Matter
For buyers, the useful questions are specific. Which objects get audited and restored in Entra ID and Okta: Conditional Access policies, application assignments, service principals, federation settings? How are non-human and AI agent identities covered, given that Commvault cites them as a driver?
Several of Commvault’s recent identity items, including these and Active Directory Pre Recover, are announced for early access rather than generally available, so evaluation timelines should account for that.
What to Watch:
- Will IDRecover arrive on a firm schedule? Several Commvault identity capabilities are in or headed for early access. Watch whether SHIFT 2026 brings general availability dates and packaging that buyers can plan around.
- How far does coverage reach into non-human identities? Service principals, workload identities, and AI agent identities live largely in Entra ID and Okta. Depth of auditing and rollback there will matter more than the number of providers supported.
- Who owns the purchase? Identity, security operations, and backup teams each have a claim. Whether Commvault and its channel can reach identity buyers, not only existing backup buyers, will shape adoption.
- How do identity specialists respond? Some may deepen their own recovery capabilities, while others pursue partnerships with data protection vendors, as Semperis has done with Cohesity.
- What does Microsoft’s native backup change? Once Entra ID backup and recovery reaches general availability, third-party offerings will need to show clear value beyond what is included with existing licensing.
For more information, read the full announcement from Commvault.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
Commvault Q1 FY 2027: AI and Identity Security Drive Subscription Momentum
Upwind’s $400M Series C Is a Bet on Independent Cloud Security
PyTorch 2.15: Open-Source AI’s Production Inflection Point
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
