ConnectWise Cloud Backup Breach: Microsoft 365 Audit and Response Steps

Between October 13 and 15, 2026, someone got hold of the credential that the ConnectWise Cloud Backup app (formerly SkyKick) uses to access Microsoft 365. They used it to sign in to customer tenants as the app itself, with no phishing and no MFA prompt involved. If any tenant you manage has a ConnectWise or SkyKick app consented, start by disabling those service principals (don't delete them). Then check service principal sign-ins and audit logs from October 13 onward. And if you build multi-tenant SaaS, take note: one leaked app credential can reach every customer at once.

Below is a timeline built from the primary sources, followed by a response checklist and lessons for teams building apps that customers consent into their tenants.

What happened, in order

The fullest public account comes from Huntress, whose analyst Jonathan Semon published a running timeline. Todyl published its own findings independently, and ConnectWise's trust advisories give the vendor's side. All times are UTC.

The Hacker News reported a figure of 173 tenants on October 17. Huntress's last published count was 162. The difference most likely reflects updates between the two, but read either number as a lower bound. Both Huntress and Todyl point out that the credential works in every tenant where the app is consented, so the people who saw these sign-ins only saw part of the exposure.

Microsoft's security intelligence team called it an "active supply chain attack", according to The Hacker News. Microsoft said the attacker likely used permissions the app already held, including Directory.ReadWrite.All, did reconnaissance through the Graph API, and tried to add credentials to service principals as a backdoor.

What's still unknown

• How the credential leaked. ConnectWise says the cause is under investigation and it hasn't determined whether a product vulnerability played a part.
• Whether data was taken. In the tenant Huntress examined most closely, the audit log showed no mail or file access. But Microsoft Graph directory reads leave no audit trail by default. Todyl found read activity in tenants with active backup subscriptions that it couldn't attribute either way. ConnectWise says it has no evidence that backup archives were accessed. It also says it can't see into downstream customer tenants, so it can't tell you whether yours was affected.

Why MFA and Conditional Access didn't help

This is the part to understand even if you've never used ConnectWise. Todyl's analysis shows the attacker used the OAuth 2.0 client credentials flow. When an application presents a valid credential, Entra ID issues an app-only token with no user involved. The sign-in logs showed Conditional Access status as notApplied.

So none of the user-focused controls applied: MFA, phishing-resistant authenticators and location-based Conditional Access. The token carried whatever permissions an admin had approved when the backup app was first installed. According to Todyl, that included full mailbox access through Exchange Web Services, OneDrive and SharePoint files, Teams chats, and the ability to restore data into the tenant.

There are two more details that matter during cleanup:

1. Disabling the app doesn't kill tokens already issued. Todyl notes that existing tokens stay valid for up to 90 minutes after you disable the service principal.
2. Persistence can outlast the original credential. The second-stage activity Huntress found added secrets to other trusted apps, with expiry dates in 2028. Even after ConnectWise rotated its own credentials, those added secrets would still work. That's why the checklist below covers every app credential, not just ConnectWise's.

Response checklist for affected tenants

These steps combine the guidance from Huntress, Todyl and ConnectWise. Work through them for your own tenant and for every customer tenant you manage. ConnectWise specifically asks partners to include dormant SkyKick connections.

1. Export logs before they expire

Todyl warns that Entra ID Free keeps sign-in and audit logs for only 7 days. Activity on October 13 will start dropping out around October 20. Export sign-in and audit logs now, before you change anything.

2. Disable (don't delete) the affected service principals

Go to Entra admin center → Enterprise applications, set the filter to All applications, search by app ID, open Properties, and set Enabled for users to sign-in? to No. Before you do, export the app's permissions from its Permissions page. Disabling keeps the consent, so you won't need to grant it again when the service comes back. The app IDs Huntress and The Hacker News listed:

In older tenants these may show up as "SkyKick Cloud Manager". Todyl says all SkyKick/ConnectWise apps are published from the tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7, which helps you find any you've forgotten about.

3. Hunt in sign-in logs

Go to Monitoring → Sign-in logs → Service principal sign-ins. The default User sign-ins tab won't show any of this. Filter on the Cloud Backup app ID and look for:

• IP 144.172.64.128 (AS14956, RouterHosting)
• User agents Python-urllib/3.12 or python-requests/2.31
• Any IP outside Microsoft/Azure ranges. Huntress says normal traffic from this app comes from private Azure IPv6 space.

Todyl suggests looking back to October 1, or as far as your retention goes. Huntress noticed the attacker seemed to favour tenants whose names begin with "A", so if you manage many tenants, check those first. Every tenant still needs checking, though.

4. Hunt in audit logs

Look for Add member to role, Update application and Add service principal credentials events, especially between about 01:00 UTC on October 15 and 02:00 UTC on October 16. Flag any service principal that added itself to a directory role or changed another application. Then:

• Remove any directory roles ConnectWise/SkyKick apps don't need, especially Global Administrator and Privileged Authentication Administrator.
• Check the client secrets and certificates on all enterprise apps and app registrations, particularly security and management tools, for anything added since October 13 that you didn't create.
• Check Conditional Access exclusions that mention these apps.

5. Check for mailbox-level persistence

ConnectWise's advisory adds checks that are easy to forget: unauthorized mailbox forwarding, inbox and transport rules, delegated mailbox access, federation trusts, consent grants and recent policy changes.

6. Plan for the backup gap

While Cloud Backup is suspended, scheduled backups aren't running. ConnectWise says existing archives aren't affected, but anything that changes during the outage won't be in a recovery point. Note your last successful backup date for each tenant. If the outage goes on, consider a temporary second backup, and don't re-enable any ConnectWise app until the vendor confirms all credentials have been reset.

Turn on the logging you'll wish you had

Both investigations ran into the same limit: without Microsoft Graph activity logs, you can't see which IP made a given Graph request or what an app read. Todyl notes these logs need Entra ID P1 or P2 and don't cover the past, so enabling them today won't help with October 15, but it will help with the next incident.

As Practical365 describes, you enable them under Entra's Diagnostic settings: add a setting, tick MicrosoftGraphActivityLogs, and send it to a Log Analytics workspace, Event Hub or storage account. Volume and cost depend on how many apps call Graph in your tenant, so check ingestion for a few days after you switch it on.

Hardening against the next vendor credential leak

You can't stop a vendor from leaking its own credential, but you can limit the damage.

• Restrict app credentials with policy. Entra's app management policies can block new password secrets and cap credential lifetimes, either tenant-wide or per app. For multi-tenant apps provisioned from another tenant, you apply the policy to the service principal. Existing credentials keep working; the policy blocks new ones that break the rules. That's exactly the step this attacker used to persist.
• Limit who can edit applications. Huntress recommends restricting the Application Administrator and Cloud Application Administrator roles.
• Remove apps you no longer use. Todyl points out that Conditional Access can't be applied to third-party multi-tenant apps. For those, the controls you have are least-privilege consent and removing whatever you don't need. Huntress mentions Conditional Access for workload identities (extra licensing required), but by Todyl's account it wouldn't have covered a vendor app like this one.
• Watch for risky service principals. Huntress suggests Microsoft Entra ID Protection to flag service principals behaving oddly.

Lessons for SaaS builders shipping multi-tenant apps

If your product asks customers to consent to an Entra app, as backup, compliance, email or AI-agent tools often do, you hold the same kind of credential ConnectWise did. These takeaways are our reading of the incident, not vendor guidance:

1. Ask only for scopes you use today. The damage here grew because the app could write to the directory and restore data, not just read. Split read-only and write permissions into separate apps or ask for them step by step, so one leaked credential isn't a skeleton key.
2. Treat the app credential as your most sensitive secret. Keep certificates in an HSM-backed key store, limit which workloads can use them, and know how fast you could rotate them across every customer.
3. Watch your own app's sign-ins from your side. The tenant-by-tenant crawl in GUID order, from a hosting-provider IP, is the kind of pattern a publisher could catch quickly. Alert when your app authenticates from outside your known egress ranges.
4. Publish usable indicators early. ConnectWise's first advisory on October 16 listed an IP and user agents, but, according to Todyl, didn't name Microsoft 365, the app or its credential. Security vendors filled the gap. Customers can only act on what you give them: app IDs, time windows and clear guidance on whether to disable.
5. Have a plan for the outage. Revoking a compromised credential means stopping your product for every customer. Decide in advance how you'll communicate that and what fallback customers will have.

If you're comparing third-party tools that ask for tenant-wide permissions, write down the requested scopes during evaluation. Our AI tools directory is a starting point for shortlisting, but permission review has to happen in your own tenant.

What to watch next

• ConnectWise's root cause. How the credential leaked, and whether a product flaw was involved, will decide whether this was a one-off. Follow the advisories page for restoration instructions.
• Final tenant count and any evidence of data access. Expect the 162/173 figures to change as more MSPs and security vendors check their telemetry.
• Microsoft's response. Watch for new defaults or detections around third-party service principals that give themselves directory roles.

What to do today: export your logs, disable the seven app IDs, review every app credential added since October 13, and turn on Graph activity logging so you have better visibility next time.