ConnectWise Disables Seven Application Identities After Microsoft 365 Tenant Compromise

ConnectWise has disabled seven application identities and temporarily suspended several cloud services after threat actors gained unauthorized access to its application credentials and compromised Microsoft 365 environments.

The IT management software provider announced the measures on October 17, 2026, as part of its ongoing investigation into the security incident. The company said it identified the issue on October 14 through its cybersecurity monitoring and subsequently activated internal and external incident response procedures.

The incident is particularly concerning because compromised application identities can allow attackers to access customer Microsoft 365 tenants through application permissions, potentially without stealing individual users' passwords.

Seven Application Identities Disabled

ConnectWise confirmed that it disabled the following application identities at 07:00 UTC on October 17:

• ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
• ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
• ConnectWise Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
• ConnectWise Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
• ConnectWise Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
• ConnectWise Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
• ConnectWise Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb

The company also revoked certificates associated with affected application connections and suspended its Cloud Backup service. SaaS Security and Cloud Management were temporarily taken offline while the investigation continues.

ConnectWise warned that disabling the affected connections prevents new authentication through those connections but does not undo changes attackers may have already made inside customer tenants.

Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Credentials, permissions, or access mechanisms established through separate application identities may require additional remediation.

Cloud Backup Services Remain Suspended

The suspension has disrupted scheduled backups and access to affected backup archives and restoration capabilities.

ConnectWise said existing backup archives remain encrypted, isolated, and preserved. The company reported no evidence that the archives had been breached or accessed by the attackers.

However, customers may face temporary limitations in their ability to run scheduled backups or restore data until the affected services become available again.

The company also said it had not observed successful threat activity in the environments it monitors since implementing its mitigation measures. It cautioned that this does not establish the security status of downstream customer environments, which it cannot directly observe.

How Compromised Application Credentials Could Expose Microsoft 365

Application identities in Microsoft Entra ID allow software services to authenticate and access Microsoft 365 resources according to their assigned permissions.

If an attacker obtains an application's credentials, they may be able to authenticate as that application and request access tokens without compromising individual user accounts.

Depending on the permissions granted, this access could expose Exchange Online mailboxes, SharePoint documents, Microsoft Teams data, directory information, and other Microsoft services.

The risk can increase when applications have extensive permissions for backup, administration, and cloud management operations.

Investigators described potential persistence techniques that involve adding compromised applications to privileged directory roles, creating new application registrations, or adding client secrets to other trusted applications. Such changes can provide alternative authentication paths that may survive the revocation of an original credential.

These are potential consequences of application identity compromise; the available incident details do not establish that every technique was used in every affected tenant.

Huntress Reports Additional Targeted Activity

Managed security provider Huntress reported observing malicious sign-ins associated with the incident through October 15, 2026.

According to Jon Semon, Principal Security Operations Analyst at Huntress, the last observed malicious sign-in from the original address occurred at 08:45 UTC on October 15, with targeted manual activity continuing until approximately 14:20 UTC that day.

Huntress said it had not identified new malicious activity since October 15, but noted that the absence of further activity did not establish whether the attackers had lost all access.

The security provider also reported evidence that the threat actors targeted ConnectWise Cloud Management applications associated with Exchange Online, Microsoft Teams, and SharePoint. Huntress confirmed abuse of the Teams application in one tenant.

Huntress further identified a second, targeted wave of unsuccessful attempts originating from 144.172.64[.]128 on October 15. The attempts focused on a narrow group of 16 tenants associated with policy, national security, trade, and critical minerals.

The activity reportedly involved two sweeps:

• 09:25:04 to 12:35:50 UTC: Attempts to obtain Microsoft Graph tokens through the SkyKick application.
• 13:54:39 to 14:20:24 UTC: A second sweep that appeared to involve manual targeting of Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Microsoft Entra, and Office 365 Management APIs.

Huntress reported identifying sign-in activity associated with the IP address across nearly 1,000 Entra tenants, with approximately 300 successful sign-ins. In some tenants, the absence of a corresponding service principal reportedly prevented the attacker from gaining access despite a successful sign-in.

These figures reflect Huntress's investigation and should not be interpreted as confirmation that every tenant with a successful sign-in was compromised.

Recommended Actions for Microsoft 365 Administrators

ConnectWise partners and customers should investigate both their own Microsoft 365 environments and every managed customer tenant, including environments with dormant SkyKick connections.

Recommended actions include:

1. Verify affected applications: Review the seven application identities and keep affected connections disabled until further guidance is provided.
2. Review sign-in records: Examine Entra sign-in logs from October 13, 2026, onward, paying particular attention to activity originating from 144.172.64[.]128.
3. Preserve audit evidence: Export relevant sign-in, directory audit, and application activity records before making changes that could affect forensic evidence.
4. Inspect application credentials: Check application registrations, client secrets, certificates, service principals, owners, and recent credential changes.
5. Review privileged access: Investigate unexpected Global Administrator assignments, application permissions, consent grants, federation trusts, and policy modifications.
6. Check Exchange Online: Look for suspicious mailbox forwarding, inbox rules, transport rules, and unauthorized delegated mailbox access.
7. Investigate suspicious identities: Identify other applications or accounts that may have been modified or used during the incident.

Organizations should also verify whether their tenants contain unauthorized applications or credentials that could provide attackers with alternative access paths.

Strengthening Microsoft Entra Application Security

Huntress highlighted several Microsoft Entra controls that can help limit the impact of stolen application credentials.

Application management policies can restrict or block client secrets on application registrations and limit credential lifetimes. Reducing the number of administrators who can manage applications can also make it harder for attackers to establish persistence.

Conditional Access for workload identities, where appropriately licensed and configured, can restrict the locations from which applications are allowed to authenticate. Microsoft Entra ID Protection can also help identify risky service principals.

These controls complement, but do not replace, credential reviews, audit-log monitoring, and incident response.

Investigation Continues

ConnectWise has not yet established whether a product vulnerability contributed to the compromise. The precise mechanism through which the application credentials were exposed remains under investigation.

The incident demonstrates how the compromise of a trusted software provider's application identities can create risks across multiple customer environments. Unlike conventional account compromise, application credential theft can enable access through privileged service identities and may leave attackers with additional persistence mechanisms even after the original connection is disabled.

Organizations using ConnectWise cloud services should follow official incident updates, investigate their Microsoft 365 tenants independently, and verify that no unauthorized credentials, permissions, or administrative changes remain.