A substantive release this month. The theme running through the June updates is eliminating the manual work that sits between what the platform can do and what administrators actually spend their time on. AI agent governance gets a significant step forward, backup and recovery becomes more surgical, and several governance controls get smarter enforcement logic. Here is what stood out across the products most relevant to data governance and security.
Cloud Backup for Microsoft 365: item-level recovery via Express API
The headline here is granular recovery speed. The AvePoint Graph Modern API now supports automated restore operations at the file and folder level across SharePoint Online, Teams, OneDrive, and Microsoft 365 Groups — no more restoring entire site collections when you need one document back. AvePoint Cloud Backup Express extends this same granularity to file- and folder-level restores.
The operational improvement is real: recovery time objectives shrink significantly when you can target exactly what you need. And because these restores are now programmable via API endpoints, you can trigger them from your existing IT pipelines without anyone logging into the product interface.
One additional update worth noting: full-text search in Backup Data E-Discovery now extends to email Subject and Document Name fields in addition to content body. Useful when you know what you are looking for but not exactly where it lives.
Cloud Backup for IaaS + PaaS: Entra External ID and Amazon S3 coverage
Two meaningful additions here. First, the platform now supports backup and granular recovery for Microsoft Entra External ID — covering External Users, User Flows, App Registrations, and Custom User Attributes. As Microsoft transitions from Azure AD B2C to Entra External ID, having a proper backup safety net during that migration is not optional. This closes that gap.
Second, Amazon S3 protection is now available with automated discovery, immutable backups, and granular restore options at the bucket and file level. Combined with existing Azure and Google Cloud support, you now have genuine multicloud infrastructure coverage from a single portal.
For VMware environments: you can now exclude specific virtual disks (VMDKs) from backup jobs to reduce storage costs while keeping OS disks protected by default.
AvePoint Policies: smarter enforcement, less disruption
Sharing Link Expiration Enforcement now supports expiration based on last access date rather than creation date. That is a fundamentally better risk model — links that are actively being used stay alive, links nobody has touched get expired automatically.
The Site Owner Restriction and Site Collection Administrator Restriction rules now support automatic demotion. When a non-compliant user is flagged, the platform demotes them to standard member instead of blocking them entirely. Less disruption, same enforcement outcome.
The Ghost Guest User Detection rule now also supports Defined Groups, letting you precisely target or exclude specific user sets — useful for separating long-term external collaborators and service accounts from the review queue.
AvePoint Insights: Premium scan and centralised data type management
Two preview features worth tracking. Premium scan is now available in Private Preview with two modes: Verification scan links scan engine conditions to Microsoft 365 sensitive information types and validates them against risk definition profiles; Full discovery scan lets you configure scan engine conditions directly within risk definition profiles.
Also in Private Preview: AI assist for building Regular expression scan engine conditions. You describe what you want to detect in natural language and it generates the regex.
The Scan Details page has been redesigned with richer metadata — active risk definition profiles, comprehensive object scan histories. The Remove all access action is now available in batch for selected objects, and data type management is consolidated into a single workspace with on-demand SIT availability testing.
AvePoint Opus: storage routing and physical records governance
For physical records management, a new Calculate action due date rule means the system automatically calculates a parent box’s disposal date based on the furthest action due date across its folders — and blocks destruction if any folder is missing a date. That is a meaningful guardrail against accidental destruction of records still under legal hold.
A new Store in Microsoft 365 Archive rule action is available in Public Preview for SharePoint Online documents, using Microsoft’s native archiving feature and replacing archived items with lightweight placeholders while keeping them reactivable on demand.
AvePoint EnPower: AI agent lifecycle automation
EnPower now covers AI agent governance across Microsoft 365, Copilot Studio, SharePoint, and Azure AI Foundry. Dynamic workflows can trigger automated warnings, metadata updates, or ownership attestation requests based on model type, status, and governance conditions.
Power Platform gets a multi-source evaluation engine that cross-references Entra ID attributes, SharePoint profiles, and live usage history to automatically reclaim premium SKU allocations. Power Platform Solutions can now be promoted between environments directly from EnPower.
Elements: CIS Level 2 baseline and MFA enforcement
Baseline Management now includes a built-in Default CIS Level 2 Baseline for organisations with strict compliance requirements. You can now apply baselines to multiple tenants in bulk, export tenant setting coverage reports, and export deviation handling history for the past 90 days. MFA is now enforced by default for all local users.
Important: tyGraph data retention deadline
Starting August 31, a standardised three-year data retention policy will be automatically enforced across all tenants, permanently removing data older than three years. If you need to retain historical analytics beyond that window, contact your AvePoint account representative before August 1. This deadline is not flexible and the data removal is permanent.
Sources: AvePoint Confidence Platform June 2026 Release Blog — AvePoint June 2026 Release Notes (official PDF)