Alcion sets sights on M365 backup-as-a-service

Kasten’s founders have moved from backing up containers to protecting Microsoft 365, with their latest startup Alcion and its AI-enhanced backup-as-a-service based on open source Corso software.

The pitch is that SaaS apps need backing up and protecting against malware. The largest and most popular such app is the Microsoft 365 suite. API access can be used to integrate external systems, and AI can be used to enhance ransomware attack detection and response. An open source tool base can engender a community around Alcion, and so grow users faster than otherwise.

Niraj Tolia, Alcion
Niraj Tolia

CEO and co-founder Niraj Tolia blogs: “Our mission is to protect all the world’s data against both malicious threats and accidents, and we are building a company to accomplish this, with community and intelligence as the foundational building blocks.”

Alcion is an early stage startup, and its M365 coverage limited. It protects Exchange, SharePoint files within Document Libraries, with Pages and Lists support coming soon, and also OneDrive. Teams support is also coming soon.

Backups are stored in an S3-style vault of the user’s choice – meaning AWS, Backblaze and GCP, with Azure Blob support coming soon.

The biz says it has an efficient and simple-to-use GUI, and time from onboarding to first backup is in the single-digit minutes area. Backups can be scheduled manually or invoked automatically – for instance Microsoft Defender threat signals can invoke proactive backups – with multiple daily backups that adjust to user activity. This feature involves predictive analytics and AI.

Alcion says it has a malware elimination feature. Discovered malware is skipped to create clean backups, which can be used to recover from ransomware attacks. Ransomware attacks can be detected as they happen – though no details are supplied as to how this is done. The software also has delayed and cancelable deletion of backups to thwart cyber attacks – this prevents backups from being easily targeted by hackers or malicious insiders.

The functional features include a resilient, high-throughput, fault-tolerant data mover optimized for Microsoft 365 API limitations. Microsoft’s Graph API enables external programs to access Microsoft’s cloud service resources and was initially released as the Office 365 Unified API.

Alcion says its backup engine is purpose-built to work with the Graph API’s unpredictable latencies and error rates to deliver fast and reliable backups. It will recover from backup failures in case of transient outages or upstream throttling of the Microsoft APIs.

Backups are based on incremental changes for speed, but are always stored as full backups for fast restores. Alcion provides end-to-end encryption, tenant isolation, per-tenant encryption keys, and incident reporting.

An Alcion blog and pair of case studies are available for reading. Alcion M365 BaaS can be tried free for 21 days.

Other companies protecting Microsoft 365 include Assigra, Cohesity, Commvault’s Metallic, Druva and HYCU – but not OwnBackup, which protects Microsoft Dynamics 365.


Alcion was started in 2022 by CEO Niraj Tolia and VP Engineering Vaibhav Kamra. They previously founded containerized app protection startup Kasten, which was acquired by Veeam in October 2020 for $150 million in stock and cash. Alcion is a distributed company with its headquarters in Santa Clara, CA. It has taken in $8 million in seed funding.