Is Cayosoft Guardian the same product category as Lavawall®?

Yes for the M365 / Entra ID config backup & rollback function. Cayosoft Guardian and Lavawall®'s configuration module both monitor changes across Entra ID, Microsoft 365, Intune, and Teams, and offer rollback. Lavawall® also covers Azure subscription resources (NSGs, Key Vault, RBAC, managed identities); check Cayosoft's documentation for its Azure coverage.

What about on-premises Active Directory?

It is not in Lavawall®'s scope, so Cayosoft is the better choice if on-premises AD coverage and forest recovery are primary requirements. Lavawall® focuses on cloud: M365, Entra ID, Intune, and Azure subscriptions.

How does pricing compare?

For most MSP-served SMB and mid-market clients, Lavawall® is materially less expensive. Cayosoft uses enterprise quote-based pricing typical of identity-protection vendors. Lavawall® is included free in the Complete tier and otherwise priced as an MSP add-on at C$3.95 / US$2.95 per user per month.

What about Exchange Online transport rules?

They are on the Lavawall® roadmap. Cayosoft collects Exchange transport rules through PowerShell, which is currently the only practical way: Microsoft Graph (v1.0 and beta) does not yet expose transportRules. Lavawall®'s Graph-based collector currently shows this as a roadmap item; we will ship either a Graph collector when Microsoft adds the endpoint, or a PowerShell-based collector if customer demand outpaces Microsoft's roadmap. If transport-rule rollback is mission-critical to you today, that is a real reason to pick Cayosoft.

You can. They overlap on Entra ID and M365, so most customers pick one. The decision usually comes down to whether you need on-prem AD coverage (Cayosoft) or Azure subscription scope plus the rest of an MSP platform (Lavawall®).

Lavawall®: The Alternative to Cayosoft Guardian

Cayosoft Guardian is a hybrid identity protection platform purpose-built for Microsoft environments. It continuously monitors Active Directory, Microsoft Entra ID, Microsoft 365, Teams, Intune, and Exchange Online; logs every change with full who/what/when/where context; and offers attribute-level rollback and patented Instant Forest Recovery for catastrophic AD scenarios. Cayosoft is the most direct competitor for Lavawall®'s M365 / Entra ID / Azure configuration backup & rollback module.

Where Cayosoft and Lavawall® diverge is in scope and packaging. Cayosoft is identity-first and includes on-premises AD with forest recovery, which is strong for enterprises with hybrid AD where AD recovery is a board-level concern. Lavawall® is cloud-first and adds Azure subscription resources (Network Security Group rules, Key Vault access policies, RBAC role assignments, managed identities) to the same change-monitoring + rollback engine, plus file integrity monitoring and event-log analytics on every Lavawall®-managed Windows, macOS, and Linux endpoint. Lavawall® itself is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance built into the same agent and console, at MSP pricing rather than enterprise identity-tool pricing.

For an MSP that needs M365 and Entra ID config backup as one capability among many, Lavawall® is typically the right answer. For an enterprise IT org whose dominant concern is on-premises AD recovery from ransomware, Cayosoft is.

Where Lavawall® wins

Azure subscription scope. Conditional Access and role assignments are only part of the cloud attack surface. The rest includes NSG rules opening 3389 to the world, Key Vault access policies handing service principals secret read, and managed identities chained to subscription-level roles. Lavawall® snapshots these, diffs them, and rolls them back. Check Cayosoft's documentation for its Azure subscription coverage.

Endpoint file integrity & event-log monitoring in the same console. When attackers compromise tenant config they typically pivot to endpoints: write a script to a domain controller, modify a hosts file, harvest credentials from a workstation. Lavawall®'s cross-platform agent monitors file changes and Windows / macOS / Linux event logs from the same console as the config backup. Check Cayosoft's documentation for its endpoint coverage.

Bundled with the rest of the platform. Configuration backup is one Lavawall® module; the same agent and console handle patching, M365 breach detection, AV/EDR coexistence, GRC compliance evidence, administrator elevation, helpdesk, and remote support. For MSPs, that's one console, one bill, one vendor relationship instead of stacking Cayosoft alongside an RMM, a GRC tool, an app-control product, and so on.

MSP-native pricing. Cayosoft is sold per-tenant on enterprise quotes. Lavawall®'s configuration backup & rollback is bundled in the Complete tier or available à la carte at C$3.95 / US$2.95 per user per month. For SMB-served MSP clients, that's a materially lower per-tenant cost.

Plan → approve → execute rollback workflow. Rollbacks are a strict three-step lifecycle: plan generation (no Graph calls), admin approval, and operator execution. Dry-run mode lets you preview every Graph call. Continue-on-error is per-rollback. Designed for MSPs operating across many client tenants with audit trails.

Audit-log correlation built into the change feed. Each change is correlated with the Microsoft 365 unified audit log to surface the user principal name, IP, and country of the person who made it. Lavawall® is both detection and evidence collection.

Where Cayosoft Guardian wins

On-premises Active Directory. Cayosoft watches AD on-prem, attribute-level, and offers patented Instant Forest Recovery for catastrophic AD outages. For organizations whose AD is the keystone of their identity environment and ransomware preparedness is a board-level item, Cayosoft is the better choice.

Group Policy Object (GPO) and AD-specific objects. GPO change tracking, FSMO role changes, schema modifications: Cayosoft is built for these. Lavawall® doesn't cover them.

Real-time change capture for AD. Cayosoft Guardian Protector (the free tier) and the paid Audit & Restore product capture AD changes in near real time. Lavawall®'s collector cycle is configurable per object type but typically polls every 15–60 minutes.

Standalone identity focus. If identity protection is a discrete budget line not tied to RMM/GRC/helpdesk, Cayosoft fits cleanly into a Microsoft-shop's identity stack alongside Defender for Identity, Entra ID Protection, and similar tools.

Feature comparison

Feature	Lavawall®	Cayosoft Guardian
Conditional Access policies	Yes	Yes
Entra ID role assignments / PIM	Yes	Yes
Entra ID users (cloud + hybrid, attribute-level diffs)	Yes	Yes
Administrative units	Yes	Yes
App registrations / service principals	Yes	Yes
OAuth permission grants (delegated & admin-consented)	Yes	Yes
Intune device-config / compliance / app-protection	Yes	Yes
Microsoft Teams team-level settings	Yes	Yes
Exchange Online transport / mail-flow rules	Roadmap (Graph API gap; see note below)	Yes (PowerShell collector)
On-premises Active Directory objects	No	Yes, primary use case
Group Policy Object change tracking	No	Yes
AD Instant Forest Recovery	No	Yes (patented)
Real-time change capture	Polling (15–60 min, configurable)	Real-time
Azure subscription RBAC role assignments	Yes	Check Cayosoft's documentation
Azure Network Security Group rules	Yes	Check Cayosoft's documentation
Azure Key Vault access policies	Yes	Check Cayosoft's documentation
Azure managed identities	Yes	Check Cayosoft's documentation
File integrity monitoring on endpoints	Yes (cross-platform agent)	Check Cayosoft's documentation
Endpoint event-log analytics (Windows / macOS / Linux)	Yes	Check Cayosoft's documentation
Plan → approve → execute rollback workflow	Yes (auditable)	One-click rollback
Dry-run rollback (preview every API call)	Yes	Check Cayosoft's documentation
Audit-log correlation in change feed	Yes (Microsoft 365 unified audit log)	Yes (Cayosoft change history)
Severity rating per change	Yes (info/low/medium/high/critical)	Yes (canned alert types)
Bundled with patching / RMM	Yes, one platform	Check Cayosoft's documentation
Bundled with GRC / framework evidence	Yes, 70+ frameworks	Check Cayosoft's documentation
Bundled with helpdesk & remote support	Yes	Check Cayosoft's documentation
Pricing model	Per-user MSP add-on or bundled	Enterprise quote-based
Free tier	Scout (domain scanner only)	Guardian Protector (monitoring; no rollback)

Who should pick which?

Pick Lavawall® if…

MSPs serving SMB and mid-market clients with M365, Entra ID, Intune, and (often) Azure subscriptions, where AD on-prem is either not present or already covered by another tool.

You want Azure subscription resources (NSG, Key Vault, RBAC) covered alongside identity.

You want one platform (config backup, RMM, GRC, helpdesk, breach detection) instead of stacking specialist tools.

You want MSP per-tenant pricing instead of enterprise per-user quotes.

Pick Cayosoft Guardian if…

On-premises Active Directory is core to the environment and forest recovery is a board-level concern.

You need GPO change tracking and AD-schema-level coverage that pure cloud tools don't provide.

You're an enterprise IT team with a dedicated identity-protection budget line and don't need the rest of an MSP platform.

Frequently asked

Is Cayosoft Guardian the same product category as Lavawall®?: Yes for the M365 / Entra ID config backup & rollback function. Cayosoft Guardian and Lavawall®'s configuration module both monitor changes across Entra ID, Microsoft 365, Intune, and Teams, and offer rollback. Lavawall® also covers Azure subscription resources (NSGs, Key Vault, RBAC, managed identities); check Cayosoft's documentation for its Azure coverage.
What about on-premises Active Directory?: It is not in Lavawall®'s scope, so Cayosoft is the better choice if on-premises AD coverage and forest recovery are primary requirements. Lavawall® focuses on cloud: M365, Entra ID, Intune, and Azure subscriptions.
How does pricing compare?: For most MSP-served SMB and mid-market clients, Lavawall® is materially less expensive. Cayosoft uses enterprise quote-based pricing typical of identity-protection vendors. Lavawall® is included free in the Complete tier and otherwise priced as an MSP add-on at C$3.95 / US$2.95 per user per month.
What about Exchange Online transport rules?: They are on the Lavawall® roadmap. Cayosoft collects Exchange transport rules through PowerShell, which is currently the only practical way: Microsoft Graph (v1.0 and beta) does not yet expose transportRules. Lavawall®'s Graph-based collector currently shows this as a roadmap item; we will ship either a Graph collector when Microsoft adds the endpoint, or a PowerShell-based collector if customer demand outpaces Microsoft's roadmap. If transport-rule rollback is mission-critical to you today, that is a real reason to pick Cayosoft.
Can I run both?: You can. They overlap on Entra ID and M365, so most customers pick one. The decision usually comes down to whether you need on-prem AD coverage (Cayosoft) or Azure subscription scope plus the rest of an MSP platform (Lavawall®).