When MSPs review Microsoft 365 security, user accounts naturally get plenty of attention. A recent incident involving ConnectWise Cloud Backup, formerly SkyKick, is a reminder to give the applications working behind the scenes the same scrutiny, including those connected to the provider’s own environment.
In short, a compromised vendor credential allowed attackers to authenticate to customer tenants through a trusted application. ConnectWise has taken containment measures and published remediation guidance, while Guardz and Huntress have shared findings that can help MSPs investigate exposure and strengthen their defenses.
An application identity became an entry point
Huntress documented unauthorized Cloud Backup application sign-ins on Oct. 15 that obtained Microsoft Graph access tokens. Those tokens carried permissions already granted to the application, potentially exposing mailboxes, files and directory information.
“The credential belonged to an application, not a person,” Elli Shlomo, head of security research at Guardz, wrote in field notes supplied to ChannelPro.
It’s a distinction that matters since application-only authentication operates without a user or an MFA prompt, so securing employees’ accounts alone does not address this access path.
Huntress also observed a Cloud Management application assigning itself Global Administrator in one partner tenant and adding credentials to two other applications. That creates a second response task, which is to look for additional access an attacker may have established, even after the original connection is disabled.
ConnectWise takes protective action
ConnectWise revoked affected connection certificates, invalidated shared Cloud Backup credentials and engaged outside incident response specialists. It suspended Cloud Backup and the integrated SaaS Security and Cloud Management services while investigation and remediation continued.
In its Oct. 19 update, the company reported no successful threat activity in the environments it monitors since Oct. 17 at 5 a.m. UTC. It also said it had no evidence that encrypted backup archives had been accessed.
Those findings concern stored archives and ConnectWise’s monitored environments, but do not establish whether individual customers’ live Microsoft 365 tenants experienced unauthorized activity. Partners still need to review those environments, and should assess recovery points and the resulting protection gap from certain service suspension while following ConnectWise’s restoration guidance.
Start with your own tenant
Shlomo’s field notes describe an approximately nine-minute sequence on Oct. 15 in which application identities assigned themselves Exchange Administrator rights across selected tenants. Guardz characterized the sequential activity as consistent with a scripted process.
Several affected tenant names suggested IT service providers, although Guardz was still verifying their identities. The researchers also distinguished those off-cycle role grants from application installation activity and kept separate password-spraying observations apart pending evidence linking them.
MSP’s are urged to start with their own tenant, then review customer environments. An unexpected privilege change in a provider’s environment warrants investigation, particularly where management applications have access across customers.
Turn the ConnectWise incident findings into action
Guardz recommends checking Microsoft Entra directly, preserving sign-in and audit logs, and disabling affected applications without deleting them. Review activity from Oct. 13 onward and collect evidence promptly; Entra retention can be as short as seven days, depending on licensing.
Inspect service principal sign-ins and audit events where an application adds itself to a directory role. Check for unauthorized secrets, certificates, permission grants, mailbox rules and forwarding settings. Review other trusted applications, too: Disabling the original connection does not remove credentials added elsewhere.
Guardz’s technical analysis highlights why multiple log sources matter: Authentication, directory changes and resource access may appear in different records. A single audit view cannot provide the whole picture.
Use ConnectWise’s current application IDs and technical guidance to scope the review, and keep affected connections disabled pending formal restoration instructions.
For customers, pair a clear status update with documented action. Take note of what was checked, what was found and how protection is being maintained during the interruption. Then make application permissions and identity monitoring part of routine security reviews, which turns the incident’s lessons into a stronger operating practice.
Matt Whitlock is ChannelPro’s tech editor, bringing more than 25 years of technology industry experience and a practical perspective on the tools and trends shaping the IT channel. A seasoned editor, podcast host and event moderator, he covers hardware, cybersecurity and emerging technologies with a focus on what they mean for IT service providers. Through product reviews, analysis and industry conversations, he helps MSPs and MSSPs separate useful innovation from marketing hype, with a little humor along the way.
Image: DALL-E
