ConnectWise Disables Cloud Backup After M365 Attack

ConnectWise Disables Seven App Identities Tied to M365 Compromise

ConnectWise disabled seven of its application identities on Saturday, October 17, 2026, after the company said unknown threat actors obtained unauthorized access to those identities and used them to compromise customer Microsoft 365 tenants. According to ConnectWise's security notice, the disabled identities include the one tied to ConnectWise Cloud Backup, identified by the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The company said its investigation is ongoing and that it has suspended the Cloud Backup service as a precaution.

ConnectWise is a software vendor whose remote monitoring, ticketing, and backup tools are widely used by managed service providers (MSPs) to administer client networks and cloud environments. An application identity, in this context, is an OAuth app registration inside a customer's Microsoft Entra ID (formerly Azure Active Directory) directory. Entra ID is Microsoft's cloud identity and access management service that controls sign-ins and permissions across Microsoft 365. When an MSP tool like ConnectWise Cloud Backup is set up for a client, Microsoft issues it an application identity with specific permissions, such as the ability to read and back up mailbox or SharePoint data, inside that client's Microsoft 365 tenant. If an attacker gains control of the credentials or tokens behind that identity, they can potentially use the same trusted permissions the vendor was granted, without needing to compromise individual user accounts directly.

ConnectWise has not disclosed how many customer tenants were affected, how the application identities were initially accessed, or the identity of the threat actors involved. Those details, along with the scope of any data exposure, remain unclear as the investigation continues.

Why Third-Party App Identities Are a Growing Attack Surface

This incident is a reminder that the biggest risk to a Microsoft 365 tenant is not always a phished employee password. It can be a trusted vendor integration that was granted broad permissions years ago and rarely reviewed since. MSP tools that back up mail, files, and Teams data typically need elevated, tenant-wide permissions to function, which makes their application identities a high-value target. A single compromised vendor identity can potentially touch every client tenant that vendor services, turning one breach into a multi-organization event.

This pattern echoes earlier MSP supply-chain incidents where attackers targeted remote management software to reach downstream clients rather than attacking each business individually. For healthcare practices, tax and accounting firms, and other small businesses that rely on an MSP for IT support, this means your security posture is only as strong as the weakest vendor identity with access to your tenant, even if your own staff did everything right.

What This Means for Your Business

Most small and midsize organizations do not have visibility into which third-party applications hold permissions inside their Microsoft 365 environment unless they or their MSP actively audit it. ConnectWise customers, and anyone whose MSP uses ConnectWise products, should not assume this is someone else's problem to track down.

What To Check and Do Now

Regardless of whether you manage your own Microsoft 365 tenant or rely on an MSP, these steps will help you confirm exposure and tighten controls:

• Ask your MSP directly: If a managed service provider administers your Microsoft 365 environment, ask in writing whether they use ConnectWise Cloud Backup or any of the seven disabled identities, and request confirmation of what actions were taken.
• Review enterprise applications in Microsoft Entra ID: In the Microsoft 365 admin center or Entra admin center, check Enterprise Applications for any ConnectWise app registrations and note their granted permissions and last sign-in activity.
• Check sign-in and audit logs: Look for unusual mailbox access, large data exports, or new mail forwarding rules around the window this incident was disclosed, since compromised backup permissions could allow bulk data access.
• Apply least privilege going forward: When re-enabling or replacing any vendor backup integration, confirm it requests only the specific Microsoft Graph permissions it needs rather than broad, tenant-wide access.
• Require admin consent review: Configure Entra ID so that new third-party application permissions require administrator approval rather than automatic consent, reducing the chance a future compromised vendor credential can silently gain access.
• Watch for official ConnectWise updates: Monitor ConnectWise's own advisories for confirmation of affected customers and next steps, rather than relying solely on secondhand reporting.

ConnectWise has not yet published a full timeline or root cause, and Bellator Cyber Guard will track this story as more details emerge. In the meantime, the safest assumption for any organization using ConnectWise backup tools is that verification, not wait and see, is the right posture.