Cloud ERP Infrastructure: What Australian Business Needs

Cloud ERP is two different things wearing the same label. Software-as-a-service ERP, like Xero or NetSuite, runs entirely on infrastructure the vendor owns and secures. Traditional ERP (on-premises Dynamics NAV or Business Central, older SAP deployments) can be lifted onto cloud infrastructure like Azure, but someone still has to provision, secure and back up that infrastructure. Vendors rarely explain which one you’re buying.

That distinction matters more than most ERP sales conversations let on, because it decides who’s holding the bag when something goes wrong. A slick product demo doesn’t tell you who’s responsible for your backups. This guide does.

What Counts as “Cloud ERP”?

If your ERP is SaaS (you log into a URL, the vendor pushes updates, and there’s no server for anyone to patch), the vendor owns the infrastructure entirely. Xero, most of NetSuite, and modern Dynamics 365 Business Central all fall into this bucket. You’re buying access, not infrastructure.

If your ERP was “lifted and shifted” onto cloud virtual machines (a traditional on-premises-style ERP now running in Azure instead of a server in your office), you or your provider are still responsible for that infrastructure. It’s cloud in the sense that it’s off-site. It’s not cloud in the sense that someone else handles the operational load.

The Infrastructure Questions Vendors Don’t Answer

Every ERP vendor will quote you an uptime figure. Almost none of them will volunteer answers to the questions that determine whether your business recovers cleanly from a bad day: how backups work, who can access the data, and what happens when a staff member leaves.

In practice, the problem is rarely the ERP software. The businesses that get burned are the ones who assumed the vendor had their backups covered, their access reviewed and their integrations locked down, and found out otherwise during an incident rather than before one.

Who’s Responsible for What: The Shared Responsibility Model

Cloud providers like Microsoft operate on a shared responsibility model: the provider secures the infrastructure underneath the cloud, and you’re responsible for what you put on top of it. That means your data, your identities and your access policies. Your ERP vendor operates inside that same model one layer up, and the split doesn’t disappear just because the product looks polished.

Does Cloud ERP Meet Australian Data Residency Requirements?

Not automatically. Some ERP platforms let you pin your data to an Australian region; others default to wherever’s cheapest for the vendor unless you specifically request otherwise. If your ERP holds employee or customer personal information, that’s a question worth resolving against the Australian Privacy Principles before you commit, not after an auditor asks.

This is the same question to ask about Microsoft 365 and Azure environments generally. Data residency is a setting, not a guarantee, and it only counts if someone has checked it.

Who Should Manage This?

If you’re running a SaaS ERP, you don’t need someone hosting servers. You need someone managing the identity and access layer that connects your team to it: enforcing MFA, reviewing who has access after someone leaves, and making sure the ERP isn’t the weak link in an otherwise secure environment.

If you’re running self-hosted ERP on cloud infrastructure, you need that plus someone accountable for the servers themselves. That covers patching, backups that are tested (not just scheduled), and a real recovery plan rather than an assumption that one exists.

Either way, this isn’t a separate project from the rest of your IT. It’s the same managed cloud and security work that covers the rest of your environment, applied to the system that happens to run your finances. Book a discovery call if you want a second opinion on what your current setup is actually covering.