How a Student Information System (SIS) import can silently delete Canvas enrolments

The data-loss event most likely to catch a Canvas administrator off guard is not a breach. It is a routine Student Information System (SIS) import that runs overnight, does exactly what it was told to do, and quietly removes enrolments that should still be there. No alert fires. The first sign is usually a student reporting they have lost access to a course, or a teacher noticing a section has emptied out. By then the import has already completed, and the clock on undoing it has started.

This is not a rare bug. It is a documented consequence of how Canvas SIS imports behave in batch mode, and administrators have warned each other about it for years. Understanding the mechanism is the difference between a near miss and a bad week.

How batch mode decides what to delete

A standard SIS import adds and updates the rows in the file you upload. Batch mode does something more aggressive, and ordinarily more useful: it treats your file as the complete, authoritative picture of a term. Canvas's own API documentation puts it plainly. A batch-mode import is "deleting any data previously imported via SIS that is not present in this latest import." Enrolments, sections, and even courses that fall outside the file get concluded or removed.

That behaviour is correct when the file really is complete. The trouble is the number of ordinary ways it might not be. An upstream SIS drops rows during a sync. A scheduled export runs against a partial dataset. A date filter is set slightly wrong, or a term is scoped more broadly than intended. In each case the file looks valid, the import succeeds, and Canvas faithfully removes everything the file failed to mention. The system is working exactly as designed. The assumption that failed was that the file was complete.

Why it happens silently

Three things make this hard to catch. The import runs on a schedule, often overnight, so no one is watching it. The result is a success, not an error, because nothing went technically wrong. And the damage is proportional to the gap in the file, so a small upstream glitch can remove a large number of enrolments without tripping an obvious alarm. The discovery almost always comes from the people affected, after the fact.

What Canvas gives you, and where it stops

Canvas does provide guardrails, and they are worth turning on. There is a change-threshold setting that, in the words of Canvas's SIS Imports API documentation, means "the batch cleanup process will not run if the number of items deleted is higher than the percentage set." It catches the worst mass-deletion cases before they apply. Careful scoping of the batch term limits the blast radius. These reduce the risk; they do not remove it, and the threshold is opt-in, so an import configured without it has no brake.

When a deletion does get through, there is a recovery path, but it is narrower than most administrators assume. Canvas can restore the states an import changed, including items removed during batch cleanup, but only for a limited time: "Restore data is retained for 30 days post-import. This endpoint is unavailable after that time." The safety net exists, but it is time-boxed, and the clock starts at the moment of the import you did not know was wrong.

It is worth seeing that 30-day window in context. Instructure's own availability documentation describes a backup model of roughly 35 days of point-in-time recovery and four months of rolling snapshots. That is an infrastructure-resilience story: it is how the platform recovers from a data-centre-level failure, not a per-course records archive. For an Australian education or training organisation, record-retention obligations are measured in years, not days. ASQA, for instance, requires VET records to be retained and retrievable for at least two years. A 30-day SIS restore window does not meet that, regardless of whether it happens to cover a given mistake.

Instructure itself treats long-term retention as a separate job from running the platform. It offers a distinct product, Canvas Archiving powered by K16, for capturing and keeping enrolment information, submissions, discussions, and gradebook records over time. That is worth noting not as a criticism but as a signal: operational backups and long-term, recoverable retention are different needs. Recovering your own course data is a job someone has to own, and by default that someone is the institution.

A few things worth checking now

Before the next scheduled import runs, three checks are worth a few minutes. First, whether your batch-mode imports have a change threshold set at all, and at what percentage. Second, who would notice a silent mass deletion, and how, given the import reports success either way. Third, how long ago your last import ran, because the 30-day restore window may already be closing on something no one has spotted. None of these prevent the failure outright, but together they shorten the time between a bad import and the moment you can still do something about it.

What actually protects you

The durable answer is the discipline this whole category comes down to: an independent copy of your data that you control, retained for as long as your obligations require, and a restore you have actually tested rather than assumed. An SIS misfire is recoverable for 30 days; a tested, retained backup is recoverable on your timeline, not Canvas's. And testing matters as much as keeping. A backup you have never restored is a hope, not a control.

If you want to start with the testing half today, our free Canvas Restore Drill Template walks through restoring an export into a clean environment and recording the result in a form an auditor can read. Retenta builds on that with continuous, immutable backup of your Canvas course content in Australia, restored and verified on a schedule. To be plain about scope: capturing the relational layer an SIS import specifically puts at risk, enrolments among it, is on our roadmap rather than in the product today. We would rather say that than imply a capability we have not shipped. The principle that protects you, an independent and tested copy, is the same either way. You can see what we cover on the pricing page.

Further reading: the mechanics of batch mode, the change threshold, and the 30-day restore window are documented in Canvas's

SIS Imports API reference

.