ConnectWise Cloud Backup Compromise: Microsoft 365 Tenant Risks, Indicators, and Response

What happened in ConnectWise Cloud Backup Compromise:

ConnectWise disclosed a security incident involving the compromise of multiple trusted application identities used by its Cloud Backup and Cloud Management services.

Attackers used compromised ConnectWise Cloud Backup and Cloud Management application credentials to access customer Microsoft 365 and Microsoft Entra ID tenants.

By authenticating as applications, the attackers did not need to compromise user credentials or bypass user MFA protections.

The investigation identified sign-in activity associated with malicious infrastructure across approximately 1,000 Entra ID tenants and roughly 300 successful sign-ins; the latter figure counts sign-ins, not confirmed compromised tenants.

The incident highlights the growing risk posed by attacks targeting trusted third-party cloud applications and service principals that possess elevated permissions across multiple customer environments.

What is a service principal in Microsoft Entra ID?

A service principal is an application’s identity within a Microsoft Entra ID tenant.

In this incident, attackers used compromised application credentials rather than user credentials. The application’s granted permissions determined which Microsoft 365 resources it could access.

How did attackers use ConnectWise application credentials to access Microsoft 365 tenants?

ConnectWise Attack Type

• Cloud identity compromises involving the abuse of trusted third-party application credentials.
• Attackers gained access to ConnectWise application identities and authenticated directly as legitimate applications within customer Microsoft 365 tenants.

Potential access included: Exchange Online, SharePoint Online, Microsoft Teams, Microsoft Graph, Microsoft Entra ID, Office 365 Management APIs

How did the ConnectWise Cloud Backup attack work?

The observed attack path demonstrates how compromised application credentials can provide access through existing trust relationships: 

• Threat actors obtained privileged ConnectWise application credentials.
• Stolen credentials were used to authenticate against Microsoft Entra ID.
• Valid OAuth access tokens were acquired through existing application permissions.
• Existing permissions allowed attackers to enumerate and access Microsoft 365 resources.
• Persistence could be achieved through:
  • Creation of new applications
  • Registration of rogue service principals
  • Addition of client secrets to trusted applications
  • Assignment of Global Administrator privileges
  • OAuth permission abuse

Which organizations were targeted in the ConnectWise attack?

Huntress identified a second targeted wave against 16 organizations operating within:

• National Security
• Government Policy
• Trade
• Critical Minerals sectors

Investigators observed attempts targeting Microsoft Graph, Exchange Online, SharePoint Online, Teams, Azure Resource Manager, and Entra ID.

Why is the ConnectWise Cloud Backup compromise dangerous for Microsoft 365?

This attack abused trusted application identities already authorized within customer environments.

Since authentication originated from legitimate service principals, activity may appear normal and bypass many traditional user-focused security controls.

Affected ConnectWise Application IDs:

• ConnectWise Cloud Backup
  • 506e08f9-6e9a-4da4-942b-a099a03644ae
• ConnectWise Cloud Management
  • 2399d300-6fca-4e6a-a686-399fefe75b83
• ConnectWise Cloud Management – MS Teams
  • 24205314-2b89-4e07-a2a4-579e898a5640
• ConnectWise Cloud Management – Exchange Online
  • b78f6a77-d4e5-46fb-87e5-d1648bd02519
• ConnectWise Cloud Management – MS Graph
  • 0de14c77-b9b0-4137-9360-34878a929827
• ConnectWise Cloud Management – Partner Center
  • 412dcf96-176d-4b3a-a1b0-4981ad66971e
• ConnectWise Cloud Management – SharePoint Online
  • b2b55f5b-7758-4719-8d8f-88ae172e6bdb

Why does the ConnectWise compromise matter for risk and business impact?

• Cloud Supply-Chain Risk: This incident demonstrates how compromising a single trusted SaaS provider can provide access into hundreds of downstream customer environments. The attack resembles a cloud supply-chain compromise where trust relationships become the primary attack vector.
• Privilege Escalation Opportunity: Compromised application identities may possess permissions sufficient to:
  • Read email data
  • Access SharePoint content
  • Collect Teams communications
  • Enumerate Entra ID objects
  • Modify application permissions
  • Create persistence through rogue application registrations
• Persistence & Long-Term Access: Even after ConnectWise revoked affected credentials, attackers may retain access if they successfully:
  • Added new client secrets
  • Created new applications
  • Granted OAuth permissions
  • Assigned administrative privileges to service principals
• Stealth & Detection Challenges: Because malicious activity originated from trusted service principals instead of user accounts, organizations relying solely on user-focused security monitoring could miss signs of compromise.

Potential Alerts & Detection Opportunities:

• Microsoft Entra ID
  • Service Principal Sign-In from Unusual IP
  • New Client Secret Added
  • Application Credential Added
  • OAuth Consent Grant Modification
  • Application Ownership Change
  • New App Registration
  • Administrative Role Assignment to Application
• Exchange Online
  • Mailbox Permission Changes
  • New Inbox Rules
  • Mail Forwarding Rules
  • Transport Rule Changes
  • Delegated Mailbox Access
  • Unusual Mailbox Access Patterns
• SharePoint Online
  • Bulk File Downloads
  • Unusual API Activity
  • Suspicious Document Access
  • Service Principal Driven Data Collection
• Microsoft Teams
  • Teams API Access
  • Unauthorized Conversation Access
  • Teams Data Enumeration
  • Abnormal Application-Based Access

What should organizations do to investigate and reduce exposure?

Start by reviewing sign-ins and application permissions. Investigate suspicious activity and remove unauthorized access.

Immediate: Investigate and contain (0–7 days)

• Check sign-in activity: Review logs from October 13, 2026, onward. Search for activity from 172.64.128 and prioritize the affected ConnectWise application IDs.
• Review application access: Check service principal sign-ins, OAuth permissions, and application ownership. Investigate newly added secrets or certificates and remove unauthorized access.
• Investigate security alerts: Use Microsoft Defender XDR to review unusual application activity and suspicious access to Exchange, Teams, and SharePoint.
• Check email settings: Look for unauthorized inbox rules, forwarding, mailbox permissions, and transport rule changes.

Near-term: Strengthen controls (2–6 weeks)

• Restrict workload access: Use Conditional Access to limit eligible service principals to trusted public IP ranges. It does not cover third-party SaaS or Microsoft applications, multitenant applications, or managed identities.
• Tighten application approvals: Limit who can administer applications, require approval for OAuth consent requests, and review third-party integrations.
• Set up monitoring: Use Microsoft Sentinel to flag new applications, added credentials, permission increases, and unusual service principal sign-ins.
• Monitor identity risk: Enable Microsoft Entra ID Protection and review risky service principals and suspicious OAuth activity.

For organizations building a broader identity-first security strategy, a Microsoft Zero Trust Assessment can help identify gaps across identity, applications, data, Microsoft 365, Azure, and Conditional Access. 

Strategic: Review regularly (quarterly)

• Keep permissions minimal: Give applications only the access they need and regularly review API permissions.
• Remove unused integrations: Retire applications and third-party connections that are no longer needed.
• Review application security: Check enterprise applications, OAuth grants, service principal credentials, and role assignments.

How can ProArch help strengthen Microsoft 365 security?

Compromised third-party applications can expose Microsoft 365 data through permissions already granted to them. ProArch helps organizations assess that exposure, strengthen controls, and detect suspicious activity.

• Assess security gaps: ProArch’s Microsoft 365 Security Assessment reviews application permissions, identity and access controls, audit logging, and suspicious activity alerts, with a prioritized remediation plan.
• Strengthen application governance: Review enterprise applications and OAuth permissions, tighten consent controls, and improve visibility into risky applications using Microsoft Entra ID and Defender for Cloud Apps.
• Monitor and respond: ProArch’s 24/7 Managed Detection and Response services use Microsoft Defender and Sentinel to monitor threats across identities, cloud applications, and Microsoft 365, investigate suspicious activity, and support containment.