ConnectWise: review the trust behind your cloud apps.

What the vendor reported

ConnectWise says it discovered unauthorized-access activity associated with Cloud Backup on 14 October 2026 and began incident response. Its public updates distinguish the investigation from confirmed access to backup data. Read the current Trust Center notices for service status and restoration instructions; a dated security article should not authorize reconnecting an affected integration.

What Microsoft observed

Microsoft’s 21 October analysis describes stolen application credentials being used to authenticate to downstream environments and, in some cases, perform Graph and directory operations. It reports AI-assisted automation through ARTEX. It also distinguishes an earlier password-spray campaign with no observed successful authentication from later application-identity activity. These are different evidence sets: attempts, successful sign-ins, changes and data access must not be collapsed into a single breach count.

Why a password reset is not the whole response

Microsoft’s service-principal documentation explains that an application can authenticate using its own certificate or secret without a user. Reviewing only employee sign-ins therefore misses a different identity path. Our practical recommendation is to keep a separate application-access register alongside the staff access list. For each integration, assign a business owner who can explain why it needs its current permissions and a technical owner who can pause it safely.

Find the correct app in every tenant

The vendor’s investigation guide includes current and former SkyKick application identities. It directs administrators to match Application IDs, preserve evidence and verify local settings in each tenant. A vendor-side action is different from a customer-tenant setting. Follow the live official list rather than a display name or an abbreviated identifier copied from social media. Review dormant connections as well as active ones.

Build a review record that can be handed over

Our suggested worksheet is intentionally small. Its purpose is to stop one administrator’s memory becoming the only record of an important integration. Start with the systems that hold customer mail, documents, billing or privileged administration. If an outsourced IT team runs the review, ask for a separate result for your tenant, with the remaining evidence gaps stated explicitly.

• Tenant, Application ID, local Object ID, vendor and business owner.
• Enabled state, granted permissions and the actual business purpose.
• Available log sources and the time range each one covers.
• Observed events, who validated them and the action taken.
• Outstanding questions, restoration conditions and the next review date.

Follow what happened after authentication

A sign-in is a pivot for investigation, not a conclusion about files or mailboxes. Ask the reviewer to separate the identity event from the operation that followed. An unexplained credential addition deserves a different response from a failed sign-in. Microsoft’s compromised-app playbook covers containment and remediation of the app and the resources it can reach. Preserve configuration and investigation evidence before irreversible changes, while allowing the response lead to contain urgent harm.

Check permissions against the job

Microsoft’s least-privilege guidance distinguishes delegated access from application permissions. Review the permission type as well as its name. Our procurement recommendation is to require a written explanation for broad directory or content access before connecting a new vendor. Give that approval an expiry or review date. When the business no longer needs the integration, plan its removal with its owner instead of leaving it indefinitely authorized.

Set clear recovery conditions

For your incident plan, define what must be true before an integration is re-enabled: the vendor has issued restoration instructions, your authorized responder has reviewed the relevant changes, and a controlled business test has succeeded. Verify that the backup workflow and a representative restore work as intended. A backup job showing success is a different result from recovering usable data. Record what was tested, where the test data went and who accepted the result. Do not treat an absence of retained logs as proof that no access occurred.

What to ask your IT provider this week

Ask for a bounded answer that your operations team can use. This is a proposed review brief, not a claim that your environment has been compromised.

• Which third-party apps can act without an employee signing in?
• Have you reviewed every Microsoft 365 tenant we own or manage?
• Which permissions are necessary, and which can be reduced?
• What activity was verified, what remains uncertain, and how long are the logs retained?
• Who approves restoring a suspended integration, and what business test proves it works?