ConnectWise Cloud Backup app identities abused to sign into Microsoft 365 tenants
A trusted multi-tenant app with mailbox- and directory-wide scopes is already being used to read customer tenant data, so any organization that ever consented to ConnectWise Cloud Backup or Cloud Management must revoke that consent and hunt its sign-in logs now rather than wait for the investigation to close.
Attackers obtained ConnectWise's Microsoft 365 application credentials and used the Cloud Backup (formerly SkyKick) service principal — which holds broad delegated access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed — to sign into MSP partner and end-customer tenants. ConnectWise disabled seven ConnectWise application identities and shut off customer access to Cloud Backup; Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, and Huntress reported confirmed unauthorized sign-ins in 162–173 tenants.
Affected: ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) — app ID 506e08f9-6e9a-4da4-942b-a099a03644ae; ConnectWise Cloud Management — app ID 2399d300-6fca-4e6a-a686-399fefe75b83; ConnectWise Cloud Management - MS Teams — app ID 24205314-2b89-4e07-a2a4-579e898a5640; ConnectWise Cloud Management - Exchange Online — app ID b78f6a77-d4e5-46fb-87e5-d1648bd02519; ConnectWise Cloud Management - MS Graph — app ID 0de14c77-b9b0-4137-9360-34878a929827; ConnectWise Cloud Management - Partner Center — app ID 412dcf96-176d-4b3a-a1b0-4981ad66971e; ConnectWise Cloud Management - SharePoint Online — app ID b2b55f5b-7758-4719-8d8f-88ae172e6bdb; Microsoft 365 tenants of ConnectWise MSP partners and their end customers
How to Test
In Entra ID, list enterprise applications and service principals for the seven ConnectWise app IDs (start with 506e08f9-6e9a-4da4-942b-a099a03644ae and 0de14c77-b9b0-4137-9360-34878a929827); then review Entra service-principal and non-interactive sign-in logs plus the Microsoft 365 unified audit log (MailItemsAccessed, FileAccessed, Add delegated permission grant, Add service principal credentials) for activity attributed to those apps from October 15, 2026 onward, and compare source IPs against the ConnectWise advisory and Microsoft indicators; presence of the app alone is not compromise — look for sign-ins and data access you did not schedule.
How to Mitigate
Revoke the OAuth consent grants and delete/disable the service principals for the seven listed ConnectWise application identities in every tenant, remove any unexpected app credentials or delegated permission grants they created, rotate ConnectWise portal and MSP admin credentials and re-enroll MFA for accounts touched by the activity, re-consent only after ConnectWise confirms the identities are clean, and preserve/export audit logs for the affected period.