Third-party backup & DR
None of these are Azure services, so they don't fit the Local/Zonal/Regional catalog format the rest of this site uses — they're commercial platforms you layer on top of, or instead of, native Azure Backup & Site Recovery. This compares the four most commonly evaluated: Rubrik, Metallic (now folded into Commvault Cloud), Veeam, and Druva — on the axis that actually drives the decision: what you're signing up to operate, not just what boxes each one ticks on a feature sheet.
What you're actually choosing between
"SaaS backup" gets used loosely by all four vendors' marketing. The real question is how much of the data plane runs on infrastructure you deploy and patch, versus infrastructure the vendor runs entirely on your behalf.
| Vendor | Model | What that actually means |
|---|---|---|
| Rubrik | Hybrid | The management plane (Rubrik Security Cloud) is SaaS, but the data plane isn't hands-off: "Exocompute" provisions an AKS cluster plus VM Scale Sets and managed disks inside your own Azure subscription, and "Cloud Cluster" deployments require you to run 3–4+ VMs yourself. |
| Metallic / Commvault Cloud | Mostly SaaS | "Direct to cloud" paths (AKS, Azure SQL in supported regions) need no customer infrastructure. Unsupported regions or compliance/firewall-restricted environments require a customer-deployed "backup gateway" VM. |
| Veeam | Three different products, three different models | Veeam Backup & Replication: fully self-managed software, wherever you run it. Veeam Backup for Microsoft Azure: still self-managed — a Linux appliance VM you deploy and patch in your own subscription. Veeam Data Cloud for Azure: the actual SaaS option, Veeam-managed end to end. |
| Druva | SaaS | No customer-deployed infrastructure for Azure workloads — agentless via native Azure snapshot APIs. Its storage layer originated on AWS and still defaults some workloads there; Azure-region storage is available per-region but is a permanent choice once set (see gotchas). |
Azure workload coverage
| Workload | Rubrik | Metallic | Veeam | Druva |
|---|---|---|---|---|
| Azure VMs | Yes | Yes | Yes | Yes |
| Azure SQL | Yes | Yes | Yes | Yes |
| Azure Blob Storage | Yes | Yes | Yes | Yes |
| Azure Files | Yes | Yes | Yes | Yes |
| AKS / Kubernetes | Yes | Yes | Separate product (Veeam Kasten) | Not found in official docs — treat as unsupported |
| Microsoft 365 | Yes | Separate product line | Separate product | Yes |
AKS support in particular is the least consistent line in this table — verify directly against each vendor's current docs before assuming coverage for a Kubernetes workload specifically.
Immutability and ransomware recovery
Rubrik — Zero Trust Data Security
Append-only backup filesystem, logical air gap, enforced MFA. Azure archival immutability specifically runs on Azure Blob's own native WORM/time-based retention locks, not a purely proprietary format.
Metallic — Air Gap Protect
No persistent connection to storage (API-only access), immutability plus multi-factor/multi-person access controls, and an ML anomaly-detection layer that flags unusual backup-size/file-activity changes before you restore from them.
Veeam — Blob-native immutability
Both Veeam products rely on Azure Blob Storage's own version-level immutability policies, not a Veeam-proprietary mechanism — and Veeam is explicit that the default immutability policy on a storage account isn't the right one; specific container-level settings are required, and can't be applied retroactively to an existing container.
Druva — Curated Recovery
Automatically stitches together a clean recovery point from the latest known-good file versions, with malware/IOC scanning of snapshots before restore. Backups are logically air-gapped by living entirely inside Druva's own cloud, never the customer's Azure subscription.
RPO/RTO, and the financial guarantees behind them
None of the four publish a fixed, committed RPO or RTO number — all four describe recovery time as workload- and configuration-dependent. Two of them back that uncertainty with a financial guarantee instead, which is worth treating as a genuinely different kind of commitment than a time SLA:
Rubrik's $10M Ransomware Recovery Warranty is gated to Enterprise/Enterprise Proactive licensing, covers only data in Rubrik-managed cloud environments, and requires an active Customer Resilience Manager engagement — a real backstop, but with real conditions attached. Druva's Data Resiliency Guarantee (also up to $10M) sits behind published SLA metrics — 99% Reliability, 99.999% Durability, up to 99.5% Availability, 100% Immutability — but requires a specific license, a minimum spend, and a "Druva Health Check," and excludes MSP customers. Neither Metallic nor Veeam publish an equivalent financial guarantee.
Pricing
This is one of the more genuinely differentiating facts across the four — two publish real numbers, two don't:
| Vendor | Public pricing? | Detail |
|---|---|---|
| Rubrik | Not public | No pricing published anywhere on rubrik.com or in Marketplace listings I could access. |
| Metallic / Commvault Cloud | Public list pricing | Published per-unit rates at commvault.com/saas-pricing: VM Backup ~$102.49 per 10-VM pack/month, Database Backup $90/TB/month, File & Object Backup $58.50/TB/month, Kubernetes Backup $90/TB/month. Underlying cloud storage consumption and traditional software licensing are still quote-based. |
| Veeam | Split — SaaS is public, self-managed isn't | Veeam Data Cloud for Azure: $42/TB/month billed annually, all-inclusive, published at veeam.com. Veeam Backup & Replication and Veeam Backup for Microsoft Azure: no public pricing, quote/reseller-based. |
| Druva | Not public | Quote-based. Docs do publish the consumption mechanics (1 credit = 1 TB deduplicated data/month, usage-threshold alerts, early-deletion fees) but not the price of a credit. |
Third-party sales-intelligence sites (Vendr, Eon, G2) publish estimated contract values for Rubrik and Druva — deliberately not repeated here as fact, since neither vendor confirms them directly. Treat any number you see attributed to those two outside their own pricing pages as an estimate, not a quote.
One real gotcha per vendor
Not a general feature gap — specifically the kind of thing that's cheap to check before you commit and expensive to discover after.
Rubrik: "SaaS" still means real Azure footprint
Exocompute provisions an AKS cluster, VM Scale Sets, managed disks, and VNet plumbing inside your own Azure subscription, and Cloud Cluster deployments need 3–4+ customer-run VMs. Budget and network/security ownership for that footprint before assuming a hands-off SaaS model — and note that docs.rubrik.com now sits entirely behind a login wall, limiting pre-purchase self-service research.
Metallic: large Azure SQL databases are silently skipped
By default, Azure SQL databases larger than 2TB are excluded from backup entirely (Azure's own export operations tend to fail past ~20 hours). There's an override setting, but out of the box a large production database can go unprotected without an obvious warning. Also Azure public-cloud only — sovereign clouds (Germany, China) aren't supported.
Veeam: the "Azure-native" product still isn't managed
Veeam Backup for Microsoft Azure is a Linux appliance VM you deploy, network, and patch yourself — sequential version upgrades, specific outbound firewall requirements, and service-account permissions you have to maintain. Only Veeam Data Cloud is genuinely SaaS-managed; don't conflate the two when comparing operational burden.
Druva: region choice is permanent, and Azure Gov has a real gap
You can now route Azure workload backups to Azure-region storage instead of AWS, but a storage-rule region mapping is permanent once set, and some capabilities (Disaster Recovery, Hyper-V) still route to AWS regardless. For Azure Government specifically, data lands in AWS GovCloud — which Druva's own blog states is not currently within its FedRAMP authorization boundary.
If you just want a starting point
- Want zero infrastructure and pricing you can budget from today: Metallic/Commvault Cloud or Veeam Data Cloud — both publish real per-unit rates and run fully managed for their SaaS-mode workloads.
- Already running Veeam elsewhere and want one tool everywhere: Veeam Backup & Replication — accept that you're operating the infrastructure yourself.
- Want the most aggressive ransomware-recovery guarantee and can absorb quote-based pricing: Rubrik or Druva — read the guarantee's conditions closely before treating it as a blanket promise.
- Have Azure Government requirements: confirm Druva's FedRAMP boundary gap doesn't apply to your workload before shortlisting it.
See the native option this compares against. The Azure Backup & Site Recovery catalog entry has the sourced RPO/RTO and cost signals for Microsoft's own service.
Backup isn't the same as HA. See HA, DR & Backup for where each mechanism actually fits, before picking a vendor to fill the backup role specifically.
Third-party products change pricing, packaging, and product names on their own schedule — verify current specifics directly with each vendor before a purchase decision, especially given Metallic's recent rebrand into Commvault Cloud and the general pace of change in this market.