Synology ActiveProtect is a new line of products designed to protect data against all kinds of cyber threats. At the heart of ActiveProtect is the 3-2-1-1-0 backup strategy. The hardware and software are tightly integrated, and you manage all tasks from a single console.
Introduction To Synology ActiveProtect
This review is based on over a month of experience with the ActiveProtect appliance and conversations with Synology. I aim to give you a first impression of ActiveProtect and help you decide whether it is right for you.
Updates
It is a living document, and I might add new insights as it evolves. Updates I made since its publication:
- 24th May 2025
- added section Archive Plans
- added section ActiveProtect Replacement
- add out-of-band description to the Hardware section
- 28th May 2025
- added section Migrating to ActiveProtect
NAS versus appliance
Synology is well-known for its network-attached storage (NAS) devices. I will, therefore, briefly explain the difference between a NAS and an appliance.
A Synology NAS is a multi-purpose device that can perform many tasks, whether concurrently or not. It is driven by the DiskStation Manager (DSM) operating system and has an extensive collection of add-on applications and services.
An appliance is typically single-purpose. The ActiveProtect appliance is built on hardware similar to Synology NAS but with a different software: ActiveProtect Manager (APM). APM is both the system software and the application.
Key selling points
What are the key selling points of ActiveProtect versus a Synology NAS with backup software?
ActiveProtect is an all-in-one solution, while a Synology NAS offers a combination of backup solutions. ActiveProtect integrates Synology NAS backup solutions like Active Backup for Business, Snapshot Replication, and Hyper Backup.
However, it adds centralized management, easier backup management, better scalability, improved deduplication, and enhanced protection mechanisms.
What is the ActiveProtect magic?
In the introduction, I already mentioned the 3-2-1-1-0 backup strategy at the heart of this solution. This strategy takes the established 3-2-1 concept to the next level to cope with advanced threats like ransomware.
ActiveProtect has a lot to offer. Each component is perhaps not unique, but the combination in a single package makes this interesting. Let’s list some features I came across.
- Advanced backup strategy for optimal data protection
- scales easily to handle quickly growing amounts of data
- manages geographically distributed locations from a single console
- backs up data from different hardware platforms
- works with predefined backup templates, combining all settings of a backup task
- backup-focused system software
- network and physical isolation techniques for advanced security
- offers built-in failover capabilities of the management server
- provides a built-in hypervisor for instant recovery
- different authorization levels for optimal security of backups
- advanced deduplication features to reduce backup storage needs significantly
- ensure data integrity with WORM technology
- database protection (SQL, Oracle).
As you can see, this is quite a list. In this review, I will cover the most essential items.
The Main Concepts
Before we discuss details, I will explain the basic concepts of ActiveProtect and help you familiarize yourself with some of its terminology.
Core components
In a nutshell, ActiveProtect is built around the following three core components:
- workload
- what you want to back up
- backup
- the actual backup on the backup server, typically the appliance
- backup copy
- a copy of the backup on the backup copy server or in the cloud
The ActiveProtect appliance holds the backup. You control all components from a single console that runs on the appliance. All components together are called a site. Backup and management data flow through different networks and network ports on the appliance.
The 3-2-1-1-0 backup strategy
The bullets below briefly explain the 3-2-1-1-0 backup strategy.
- Backup and backup copy
- 3 different copies of data
- 2 different media
- of which 1 is offsite
- Immutability
- 1 copy is immutable
- Backup verification
- 0 errors after backup recoverability verification
A single appliance and a cloud service that stores a backup copy are sufficient to implement this strategy fully.
Workload
Your workload includes backing up data on client computers, physical and virtual servers, and cloud applications.
The restore capabilities of protected workloads are:
- Physical PC/Mac
- image restoration, file-level recovery, physical to virtual restore (Windows)
- Physical Windows or Linux Server
- image restoration, file-level recovery, physical to virtual restore, instant restore
- Virtual Machines (Hyper-V | VMware)
- instant, cross-platform, and file-level recovery
- SaaS (Microsoft 365)
- granular file and folder level restore, restore to different accounts, restore archive mailbox, permissions, and more
Hypervisor support
I particularly mention hypervisor support and virtual machines. I have not tested this yet, but I am impressed by the possibilities from the demonstrations I have seen.
First, ActiveProtect currently supports two hypervisors:
- Microsoft Hyper-V
- VMware Vsphere
In addition, ActiveProtect has a built-in hypervisor for emergency disaster recovery (instant restore) and backup verification.
When you add a hypervisor to a site, ActiveProtect can back up all virtual machines on that hypervisor and automatically protect future virtual machines.
ActiveProtect can instantly restore to the built-in hypervisor or another hypervisor, even from a different platform (cross-platform restore) if a hypervisor is no longer available (V2V). File-level recovery is also possible.
ActiveProtect can restore a physical Windows PC or Windows and Linux servers to a virtual machine (P2V).
Backup Server
You centrally manage the workloads from an ActiveProtect appliance. This is the backup server providing both storage and backup management tasks.
Multiple backup servers can share the workload if one server lacks enough storage or the endpoints are at different locations. You still manage all processes from a single console on the site, the management server. A Synology NAS with Active Backup for Business can be a backup server on an ActiveProtect site.
Only the DP7400 rack-mounted model can add other backup servers to its site. The DP320 and DP340 are designed to be either a backup server in a site with a DP7400 or to act standalone.
Backup Copy Server
To enforce an advanced backup strategy, you make copies of your backup to another server or cloud service. This can be another ActiveProtect appliance or a Synology NAS with ActiveProtect Vault that you host in another location. Supported Synology NAS models are the Synology HD6500, SA3410, and SA3610.
Alternatively, you can use a cloud service like Synology C2 Object Storage or an AWS S3 server. Once you have added remote storage to your site, you can configure this storage location in a Protection Plan.
Site and Licensing
You can link multiple backup servers into a site or cluster. A single ActiveProtect console centrally manages all backup servers on the site.
A site can contain up to three backup servers without buying additional licensing. Licensing is not dependent on the number of workloads or storage used.
You need a license for each backup server beyond the three on your site. A permit is valid for one year before it expires. An expired license prevents you from making new backups, but not accessing and restoring existing ones.
Management server
The Management Server is where you manage all workloads, backup servers, and backup copy servers within a site from a single console.
With ActiveProtect, you can add a second server to form a pair in an Active/Failover Management Server configuration. The failover function covers all site settings, protection plans, users, and backed-up data.
The Management Server in a site and the Active/Failover pair require the Synology DP7400 model. This is one of the limitations of the DP320 and DP340 desktop models.
Protection Plans
A Protection Plan is like a template, containing all the backup task settings. It significantly simplifies backup management. You configure your Protection Plan within a site.
You can create different Protection Plans for clients and servers, with varying backup frequencies, retention needs, or backup copy servers. A change to a Protection Plan is instantly effective for all endpoints and their backup.
There are two types of Protection Plans:
- for physical and virtual machines
- for SaaS
ActiveProtect comes with one protection plan of each type by default. You can duplicate and edit an existing plan or create one from scratch. With each type, you can make standard or immutable backups. See below for more about immutability.
Archive Plans
You can archive backed-up data that does not need a regular backup, but should remain available for some time. Similar to Protection Plans, ActiveProtect offers Archive Plans for this purpose.
Archiving is moving backups from a Protection Plan into an archive. The backup is still there, and you can restore it, but new backups of the Protection Plan no longer protect the data.
There is one default Archive Plan with 30-day retention, and you can create custom plans. In your Archive Plan, you define the retention period and whether or not to keep the latest version.
Hardware
Currently, there are three ActiveProtect appliances: one large-capacity rack-mounted and two desktop models with smaller storage capacities. All models come preconfigured with all components, like HDDs, and two models with an SSD cache in the box.
You need the rack-mounted model to build a site where multiple backup servers join. Only the rack-mounted model supports the Active and Failover Management Server roles.
All models have similar features, but smaller models have some software limitations besides fewer resources, such as storage capacity and processing power.
Each model has at least two Ethernet LAN ports, one for data (LAN) and one for management (MGMT). The rack-mounted model has two data LAN ports and room for additional data LAN ports.
You use the MGMT port to manage the appliance. Best practice is to connect that port to a restricted network. You find the idea behind separate ports in the Air Gap function, which separates the appliance from the network. Another feature is the out-of-band (OOB) function, which can be used to manage the appliance in case you can not reach it via the web interface.
The Air Gap works on the regular LAN port, keeping the MGMT port always available. The OOB function works on the MGMT port.
Deduplication
ActiveProtect supports two types of deduplication:
- source side
- cross-site
These techniques can significantly reduce the required storage space and optimize the data bandwidth in transit, leading to faster backup and restore speeds.
Deduplication requires an ActiveProtect Agent on the client or server, ActiveProtect appliances as a backup or backup copy server, or a Synology NAS with ActiveProtect Vault as a backup copy server.
Support
You might need support. Creating a support case from the Appliance Console > Support Center application is easy.
Synology Enterprise Support handles all DP device and ActiveProtect cases, resulting in quick replies. I found the support very responsive.
Protecting The Backup
ActiveProtect is not only about making backups. It also includes several features to protect that backup. I already mentioned the backup copy to another ActiveProtect appliance, a Synology NAS, or a cloud service.
Air Gap
Another feature is the Air Gap. With the Air Gap, you restrict access to the backup device. Synology recommends applying the Air Gap to backup copy servers rather than primary backup servers for optimal protection.
The Air Gap feature is server-specific and consists of two distinct settings:
- firewall
- isolation settings
Air Gap settings apply to the DATA network interface, not the MGMT interface. The MGMT interface should be on a restricted network and only accessible by the appliance administrators’ workstations.
With the Firewall, you restrict access to the DATA network interface by IP address or address range. All backup and backup copy servers in a site are automatically added to the default allow list.
With Isolation Settings, you disconnect the DATA port from the network according to a schedule. There are three isolation methods:
- deny all connections
- deactivate NICs
- shutdown server
Least-privilege access
ActiveProtect enforces the principle of least-privilege access without making this complicated. The graph below schematically represents the three ActiveProtect consoles and the required authorizations.
The super admin account has access to every aspect of ActiveProtect, including the Appliance Console with system settings and the Management Center.
You create the super admin account and manage it from the Appliance Console when setting up the appliance. There will only be one super admin. Currently, you can not protect the super admin account with two-step authentication.
Next is the APM default admin group. Members of this group have access to the Management Center and can control every aspect of the application, including site configuration and protection plans. They can also backup and restore accounts. You manage these accounts from the Management Center.
Here, the super admin or APM admin can create other users and delegate administrative tasks to them. The delegated tasks are Backup, Restore, and Monitoring. You can delegate one or more tasks to a user or group. This applies to both local and domain/LDAP users and groups.
Immutable and WORM
You can further protect backups with two read-only technologies: immutability and WORM (Write Once, Read Many).
When you create a Protection Plan, you choose between an immutable or standard plan in the wizard’s first screen. Note that you can not change this setting afterward. The period of immutability is the retention period you define in the plan. You can create an immutable plan for the physical and virtual machines and the SaaS plans.
With an immutable plan, you create immutable backup copies to a backup copy location like another DP device, a NAS with ActiveProtect Vault, or Synology C2 Object Storage.
You create a shared folder on a Synology NAS for ActiveProtect Vault. If this shared folder is protected with WORM, you make a non-editable backup copy destination.
Three Faces Of ActiveProtect Manager
ActiveProtect Manager is the name of the system software and application that is tightly integrated with the hardware. You manage ActiveProtect from a web user interface.
In the browser, you enter the IP address or the fully qualified domain name of the MGMT LAN interface. Depending on whether or not you add a port number or alias to the URL, you open one of the three windows of ActiveProtect Manager:
- Appliance Console
- Management Center
- Recovery Portal
I will discuss each window below.
Appliance Console
The URL with port number, by default port 5001, is where you log in to the Appliance Console. This console lets you manage system resources, network, and disks, join an LDAP/directory service, and configure the UPS. It looks like a stripped-down version of Synology DSM.
You need super admin privileges to log in to the Appliance Console. A super admin manages the device settings that are not part of the backup-related features.
You can switch to the Management Center or Recovery Portal with the same credentials from the Appliance Console.
Management Center
When you use the URL without a port number or an alias, you get the Management Center login screen. As mentioned earlier, this is the application where you manage all backup-related features.
To log in to the Management Center, you must be a super admin or an APM default admin, or you have been delegated the Backup, Restore, or Monitoring task.
You can switch to the Recovery Portal and Appliance Console with the same credentials from the Management Center.
Recovery Portal
You can access the Recovery Portal by entering the URL plus the alias /portal in the web browser. Here, you can find the backups for which you have restore permissions.
In addition to the different admins I discussed earlier, users can have restore permissions for a particular backup, such as their computer. When that user logs on, they find that backup listed and can perform a Self-Service Restore.
ActiveProtect Replacement
With ActiveProtect at the heart of your corporate backup strategy and data protection, I came up with a question that nobody I talked with seems to ask (or even understand): replacement.
Whether you want to replace a DP device for a newer or bigger sibling, or the device is broken or lost, a replacement is on the horizon, somewhere in your future.
Each DP device, or a group of devices in a site, contains two crucial pieces of data:
- backup data
- site configuration data, like:
- users and delegations
- Protection and Archive Plans
- connection keys for Protection Plans
- access keys to remote storage
After testing with a single DP device, I discovered that the site configuration could not be stored outside ActiveProtect. Therefore, when this information is lost, all backups are lost, and all workloads must be connected again with a new Protection Plan and a connection key.
Regarding the backup data, I took precautions with remote storage in the cloud. I discovered that the remotely stored backup copy is accessible for restoration as long as the original backup is on the DP device.
In a wiped or new DP device, I can connect to the remote storage, assuming I have the proper keys, but I cannot access the contents for a restore. This can be an issue for companies with legal obligations to store data for a specified period (seven, ten years, or even longer).
I also discovered that you can not copy backups from the backup copy on the remote storage to the DP device. When I accidentally deleted a backup on the DP device, with all site configuration intact, I lost the connection to the backup copy on the remote storage.
These findings, along with others, are shared with the developers in Taiwan. I received confirmation that these issues exist and that only an HDD replacement to another device is currently available as a recovery method.
So far, Synology has explained that all data is safe in a multi-layered site with an Active and Failover Management Server. This solution will have some redundancy regarding configuration data, but I remain skeptical regarding backup data recovery.
Hands-on Experiences
Overall, I am pleased with how the appliance and the ActiveProtect Manager are set up. The three ways to access the appliance (Appliance Console, Management Center, Recovery Portal), the functionality I find in the different screens, and the required permissions make sense. I like the concept of an ActiveProtect site, including the active and failover management servers within that site.
I explored the Appliance Console, Management Center, and Recovery Portal. In the Management Center, I created backups, restored them, and created a protection plan. I also made backup copies to a remote storage Synology C2 Object Storage bucket that I created.
The machines I tested with ActiveProtect are:
- Windows 10 Pro (physical), Windows 11 Pro (2x virtual, one on an Intel-based Mac, one on an ARM-based Mac, both with Parallels virtualization software)
- Windows Server 2022 with GUI and Windows Server 2025 without GUI (both virtual on Intel-based Mac)
- Ubuntu Linux 22.04 (virtual on Intel-based Mac)
- Synology NASs (both physical and virtual).
I currently do not have any hypervisors, such as VMware vSphere or Microsoft Hyper-V. I would love to have it for testing, and I am looking into it.
The Appliance Console did not bring up any questions. Any Synology DSM administrator feels at home immediately.
Management Center
The Management Center is where the action is. All items in the left column are grouped into two sections or categories: Workloads and Management. Good. This organization makes perfect sense once you become familiar with what is what. You set up the site, plans, and users in the Management section. The Workloads section collects and organizes all the stuff to be backed up.
The concept of an ActiveProtect Site with central management of multiple backup servers and remote storage is excellent. The Protection Plan concept, like templates, is impressive when I consider all the options that go into creating a Protection Plan. I am not familiar with how the competition handles this, but Synology’s approach makes it easy to manage. Kudos.
The Workloads section is well-designed to accommodate various types, including personal computers (PCs) and physical servers. This is again reflected in the protection plans, including whether an agent is required on the PC or server, and so on. The SaaS or cloud service is currently limited to Microsoft 365, but I expect Google Workspace will be added. In the log, I saw the package was already loaded.
I initially did not understand the Archive Plans, but I figured it out. When you no longer backup a physical, virtual, or SaaS machine, you can archive the workload with an Archive Plan. From there, you can open the workload in the Recovery Portal.
Fun facts
Fun fact: I renamed a Windows machine after it was added to the site and backed up. The new name quickly appeared in the Management Center. Nice.
Another fun fact: I was able to install and use the ActiveProtect Agent on a Windows 11 ARM machine. I am unsure if there is native code for ARM or whether the emulation in Windows is that good, but it works.
Users Management
I looked at it from a functional perspective. The APM default admin can control the Management Center and create other users. You can delegate administrative tasks to users who are not members of the APM default admin group. I find delegation of administration a helpful feature, which is often overlooked by the way (a similar feature was introduced in DSM7, but nobody talks about it.)
There are three tasks to delegate: Backup, Restore, and Monitoring. You can assign multiple functions to a user or custom group.
When the appliance joins a domain or LDAP service, you can delegate full or partial permissions inside the Management Center to a domain user or group. Access to the Appliance Console as a super admin is restricted to the local super admin account.
Restore
This finally brings me to the topic of restoration. I’m not very happy with how things are today. Who can restore a backup?
It seems that there are two options.
- APM admins and users who have delegated restore permissions can log into the Management Center, select a backup, right-click, and choose Open Recovery Portal to perform a restore
- every user who has Self-Service Restore (SSR) permissions for a machine can open the Recovery Portal and find that machine on the screen to restore; this option seems to be on a per-user and machine basis. I am unable to assign SSR permissions to a group, and I am also unable to group machines or assign restore permissions to a user.
What I can restore depends on the type of machine. There are three options:
- entire machine
- browse files
- restore to the virtual machine
I cannot restore an entire Synology NAS machine, but I would love to see that in the future.
The browse files option is cumbersome. The file or selection of files is downloaded to the computer you work with. If I need to move them back to their original location, I must manually relocate them to the server’s designated location. I hope there will be some improvement in this area.
I understand that this works for a user granted the right to restore a specific machine’s backup from the Recovery Portal, but I envisioned a better option.
Synology Resources
Synology offers product information, a knowledge base, articles, a public client case, and excellent videos. This collection will grow over time.
Product information
Knowledge Center
There is an extensive collection of articles in this area. Some examples are:
- Getting to know ActiveProtect with a PDF download
- Active Backup for Business Admin Guide for ActiveProtect Manager with PDF download
Public client case
Videos
- Introducing ActiveProtect Manager by Cody Hall, product manager, Synology America
- Rethinking Recovery: Building a comprehensive data protection strategy by Danlin OU, pre-sales Synology Benelux
- ActiveProtect Overview: Secure Your Data video series
Third-party blogs
Please don’t take my word for granted. A few resources outside Synology have published information about ActiveProtect. Each of the posts listed below presents an alternative perspective on the matter.
- ITPro, Synology ActiveProtect DP7400 review
- Blackvoid / Luke Manestar, Synology DP7400 review
- NAScompares, Synology DP320 NAS Review – A New Kind Of Synology Solution
Summary
ActiveProtect addresses the issue of data protection in a manner that every business today should adopt. The impact of cyberattacks on our lives is enormous and increasing yearly. Data protection is more than a good backup strategy. It is about protecting the backups and making the restore effortless.
Appliance
Synology is entering the backup appliance market and recognizes it must bring something to the table to compete. I do not pretend to have intricate knowledge of the big players in this market, but I think Synology pulls some strings here. Being new in this market has the advantage of building a solution for today and tomorrow from scratch.
Synology has a reputation for building NASs with tightly integrated hardware and software. They have experience with the specific needs of enterprise corporations. The ActiveProtect appliance offers a rich feature set in an easy-to-manage package.
Enterprise businesses
Who is it for? The ActiveProtect solution, based on the three available models, is built around the DP7400. You can add appliances such as failover management servers, backup servers, or backup copy servers. You can include a Synology NAS with Active Backup for Business as a backup server or an enterprise-model Synology NAS with ActiveProtect Vault.
Early adopters will probably be corporations with Synology NASs as file servers or backup servers running the Active Backup suite for their client computers and SaaS applications. With ActiveProtect, you manage these backup tasks centrally and add additional protection. Next are corporations not tied to a specific supplier for all IT services, and feel the need to implement better security for their business and clients.
Small and medium businesses
Is ActiveProtect interesting for small and medium businesses? Feature-wise, yes, but there is a catch. With a single DP320 or DP340 desktop model, you can implement the 3-2-1-1-0 backup strategy. You do not need a DP7400 for that. You create an immutable backup on the appliance, and the Synology C2 or AWS S3 cloud service stores a copy of the backup.
However, the current limitations on the desktop models limit their intrinsic value. You cannot add a second appliance as a backup server on the same site, and you cannot add a Synology NAS with ActiveProtect Vault as a backup copy server. Furthermore, only a few enterprise (read: big) NASs are currently supported for ActiveProtect Vault.
Synology made the desktop models as satellites orbiting the primary appliance, the DP7400. I would applaud the opening up of these restrictions and allowing a NAS with a smaller capacity to run ActiveProtect Vault in conjunction with an ActiveProtect desktop model. Desktop models with larger storage capacities or more flexibility in storage options would also be a welcome addition. This will open up more markets for this otherwise interesting product.
Migrating to ActiveProtect
ActiveProtect is a great solution for the small and medium-sized business market, and it would be even easier with a well-defined migration scenario. Users who currently have a Synology NAS for backup benefit from enhanced data protection with ActiveProtect. Deploy a DP device and make the NAS a backup copy server and remote storage.
To enable this scenario, two changes in the current ActiveProtect software suite are necessary:
- allow a DP320/340 in a single-site deployment to add (at least) one backup copy server
- enable ActiveProtect Vault on recent Plus models that support WORM
If the current NAS is an Active Backup for Business server, migrate the workload to the ActiveProtect device first and then offload the NAS. An ActiveProtect Migration Assistant would be a great tool for that. Next, configure the NAS as a backup copy server running ActiveProtect Vault.
More to come
I am aware that ActiveProtect is a work in progress. Complete backup support for Synology NAS and Google Workspace is on my wishlist. Both features are probably in the wings and will land soon (my assessment, nothing confirmed).
To wrap up, I feel confident about implementing ActiveProtect today. During my testing, I understood what ActiveProtect is capable of with a single device. A real-world simulation with multiple backup servers in an ActiveProtect Site is next on my list to test and try. As I said, it is a work in progress, improving daily.
Test And Try
If you want to test out ActiveProtect in your organization, don’t hesitate to contact Synology. If you are located in the Netherlands, you can contact me directly. You can hire me with a DP320 to set up a Proof of Concept.
About Paul Steunebrink / Storage Alchemist
Paul is an MSP from the Netherlands. As an IT consultant, he has worked with businesses of all sizes, from 1 to over 100,000 employees, since the late 1980s up until today.
Among many other projects, he designed and engineered a Windows 2000 Active Directory for 30,000 users in 800 branch offices connected to two fiber-linked, redundant data centers near Amsterdam, The Netherlands, for a Dutch bank. During his ten-year tenure at that same bank, he worked on several high-profile projects, mainly designing a secure network for the managing board.
As an avid photographer and Apple Mac and Synology NAS user, he started supporting creative professionals with their storage and backup solutions. In 2019, he established the Storage Alchemist brand, focusing on Synology solutions for businesses.
In his spare time, Paul loves to investigate every aspect of the Synology NAS and publishes his findings on his website as “the manual he wished he had when he started this.”
He also loves to take his camera and go out, playing with light as a poet, grabbing the ultimate shot, which will eventually never happen. That’s live.
Thanks for reading
This post is donationware, and I made it to help you. Please consider leaving a comment or even buying me a coffee if it did. I will be eternally grateful.
Paul Steunebrink / Storage Alchemist