Veeam Undo AI for Microsoft 365: Agent Rollback, Restore Point Limits and Admin Risks

The three questions​

Veeam CEO Anand Eswaran boiled the problem down to three questions: which records changed, what did they change to, and what were they before? Telecom Reseller columnist's account of the October 15 launch ties them to a Spanish breach. According to Eswaran, a national data protection authority formally named an AI agent as the attacker for the first time. That claim comes from a vendor executive at a launch event. I could not corroborate it independently.

These are not statutory GDPR questions. The European Data Protection Board says a personal data breach covers accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Its guidance clarifies which breaches need notice to the supervisory authority within 72 hours. Not every security incident qualifies. The three questions are an operational framing of what an investigation will need to establish.

The framing separates two jobs that often get blurred:

• Attribution: which account or agent acted, and when. Identity and security logs handle this.
• Reconstruction: what the data looked like before and how to get it back. This needs version history or a backup.

Revoking an agent's access in seconds does not repair corrupted invoices or billing records.

What shipped​

Veeam Intelligent ResOps for Microsoft 365 is generally available as an add-on to Veeam Data Cloud for Microsoft 365. The press release says it comes in Foundation and Advanced editions and is also sold through Veeam Cloud & Service Providers. NAND Research notes it is not available as a standalone product. In other words, you need Veeam Data Cloud for Microsoft 365 first.

Veeam says customers connect it to Veeam Data Cloud in a few clicks, with no data migration and no re-architecture required. Those are vendor claims, not independent test results.

Veeam's documentation describes these functions:

• Discovery: inventory of users, groups, mailboxes, sites and files across SharePoint Online, OneDrive, Exchange Online and Teams, tied to Entra identity and application context.
• Classification: full content scans run separately from the metadata inventory. Findings are linked to who and what can reach the data.
• Agent discovery: supported Microsoft 365 agents and applications that can act as agents. One example view linked 821 files in a single SharePoint site to 28 data element types.
• ROT handling: quarantine of redundant, obsolete and trivial files, with a way to revert them to their original location.
• Purview labeling: import of existing Purview sensitivity labels, so findings can map to labels your organization already uses.

The Agent Activity Timeline and "Undo AI"​

The feature behind the headline is the Agent Activity Timeline. It shows access, create, modify, move and delete events by agent and data system, with hourly summaries and file-level details. An initial seven-day backfill gives recent context. Administrators can select an event and compare it with available restore points.

From there, the "Undo change" action starts recovery of supported agent file changes through Veeam Data Cloud restore points. That includes restoring a deleted file. Undo AI requires the protection connection and an available restore point for the affected data.

That scoping matters. This is file-level recovery of supported changes, not a universal rollback. An activity record is also not proof of intent or a complete forensic trail. If the right restore point doesn't exist, undo has nothing to restore from.

The hard part: legitimate edits after a bad one​

The Telecom Reseller piece raises the limit that decides whether this works in practice. Suppose an agent damages a document and a colleague then makes a valid edit to it. Reverting the file can erase the legitimate work. Analysts Steve McDowell of NAND Research and Fernando Montenegro of Futurum flagged this at the event, according to the article. The author calls it a data integrity and merge problem, not just a backup problem.

Futurum's Montenegro frames the launch around what agent rollback can and cannot undo. He also asks who will buy and operate the tool. Adoption depends on whether security and AI governance teams use iResOps, not only the backup administrators who already run Veeam.

What is preview or roadmap​

Do not plan around these yet:

• Veeam Data Platform: private preview, with Veeam saying it accompanies Data Platform v13.2, expected later in Q4 2026.
• Okta: private preview. Veeam claims immutable restore points across 29 object types and property-level comparison against a known-good state. Veeam also says Okta has no native point-in-time restore and only a 30-day soft-delete window for users. Those are the vendor's comparisons.
• GitHub and Azure DevOps: private previews planned for Q4 2026.
• Google IAM: a private preview planned for select customers.

Veeam's release does not confirm Google Workspace support. The column mentions it as planned, but I treat it as unconfirmed.

Attack context, with caveats​

The column opens with two AI-assisted attacks. Reporting on the first, a hacker using AI agents against more than 1,200 websites, comes via TechRadar:

• Researcher Snorre Fagerland estimated about $50 in tokens per successful breach, but TechRadar stresses this is an estimate, not confirmed billing.
• Deere told Reuters it saw no indication that sensitive information was accessed.
• SharkNinja said the breach hit a standalone site with product support information only.
• Cummins said it was looking into the reports.

On South Korea, Reuters reported that CrowdStrike believes the suspect used the Chinese-developed ARTEX tool alongside Anthropic's Claude Code. Reuters also reported that at least nine banks were targeted. Shinhan Bank said about 25,000 customers' personal data was compromised, and KB Kookmin Bank said 119 customers' data leaked. I could not match the column's "68,000 people" figure to these reports, so treat that number with caution.

The column's other statistics are not independently verified here, including the 82 AI identities per employee and the claim that nearly half of organizations had unauthorized AI incidents. Veeam's own report claims that over 82% of enterprises have unknown AI agents. These figures come from a vendor's own research, and the same vendor sells the fix.

What admins can do now​

You do not need to buy anything to apply the framework. Ask these questions of your own tenant:

1. Inventory: can you list every agent and AI-capable app registration that touches SharePoint, OneDrive, Exchange or Teams, including ones nobody approved?
2. Reach: for each one, which sensitive files can it read, write or delete?
3. Logging: do you retain activity records long enough to answer a regulator months later, after a short-lived agent is gone?
4. Restore points: is the data an agent can modify actually backed up, and can you restore a single file without touching a whole workload?
5. Conflicts: do you have a process for handling legitimate edits made after an unwanted change?

If you can't answer these, that gap exists whether or not you buy any product. This launch is one vendor's answer, and its documentation is clearer than its marketing about the limits: supported files, available restore points, and a short initial activity window. Test it against real production workloads before trusting it in an incident.