“It’s all in the cloud” is not a backup strategy, and your recycle bin proves it

Fair warning before you read on: this is the one control in this series where the honest answer isn’t a fully free fix. Every other edition has found a genuine no-cost path. This one hasn’t, and dressing that up as a bargain it isn’t would undo the reason this series gets read.

The assumption that’s quietly wrong

Regular backups is one of the eight ASD mitigation strategies, and it’s the control most schools assume they’ve already got covered, because everything’s “in the cloud” now. It isn’t covered, and ASD’s own technical guidance says so directly: the native SharePoint and OneDrive recycle bin, file versioning, and Exchange retention policies that most schools are quietly relying on “are not sufficient to recover from many cyber incidents.” The specific scenario that guidance is written for is administrator account compromise, where an attacker with admin rights can permanently delete files and switch off retention policies on the way out. A recovery plan that depends on the same admin account the attacker just took over isn’t a recovery plan.

Put numbers against that. Exchange Online’s default deleted item retention is 14 days, extendable to a maximum of 30. SharePoint and OneDrive give you up to 93 days across the first and second-stage recycle bins. Essential Eight’s maturity level one expectation is backups retained in a coordinated, resilient manner in line with the school’s own business continuity requirements, restoration tested as part of a genuine disaster recovery exercise, and unprivileged accounts locked out of modifying or deleting anyone’s backups but their own. Ninety-three days of recycle bin is a grace period. It is not a business continuity plan, and a board briefed on “we’re covered because it’s cloud-based” has been given an inaccurate picture, not a dishonest one, usually, but an inaccurate one nonetheless.

Why this is the control where “free” runs out

ACSC’s own technical example for this control recommends a third-party, offline backup solution rather than relying on Microsoft’s native protections. Reputable third-party backup tools cost money. That’s the honest state of play, and it’s worth naming plainly to whoever owns the budget conversation rather than letting IT quietly absorb the gap or work around it with something that looks like a fix but isn’t.

What genuinely doesn’t cost anything: backing up tenant configuration, not just data, using Microsoft365DSC, a free, MIT-licensed tool built and maintained largely by Microsoft engineers. Most backup conversations stop at mailboxes and files and never touch configuration, Conditional Access policies, group memberships, security defaults, despite “software and configuration settings” being explicitly part of what Essential Eight expects a school to be able to restore. If your tenant configuration were quietly wrecked tomorrow, could it be rebuilt from anything other than someone’s memory of how it was set up?

Microsoft has also released its own first-party option, Microsoft 365 Backup, priced as a flat consumption charge of roughly USD 0.15 per GB of protected content per month rather than bundled into any education licence for free. Whether ACSC has updated its technical guidance to account for this option, and how the economics stack up for a typical school tenant, hasn’t been confirmed here. Treat it as something to cost out with your Microsoft partner directly, not a ready answer.

The fork this control actually carries

Backups doesn’t fork by student versus staff population the way MFA does, there’s no population to exclude here. It forks by where the data actually lives. A meaningful share of what matters most to a school, the LMS, the student information system, assessment platforms, sits outside the Microsoft 365 tenant entirely, held by third-party vendors with their own backup arrangements, or none. “It’s cloud software” is not an answer when it comes from a vendor either. Whatever a school does about its own Exchange and SharePoint retention, the LMS and SIS vendors need to be asked directly, in writing, what their backup and recovery guarantees actually are.

Where this connects to the register

None of this can be scoped properly without already knowing what’s worth backing up first, which is the exact gap the crown jewels register exists to close. A school that hasn’t done that exercise risks spending its limited backup budget protecting the wrong systems, or protecting everything equally when the risk clearly isn’t distributed equally.

Where this leaves you

The honest test: if an attacker with admin-level access wiped the tenant tomorrow, including the recycle bins, what would actually come back, and from where? For most schools relying on native retention alone, the answer is less than the compliance paperwork implies.

Best Practice - This is the way