ConnectWise Cloud Backup (SkyKick) Credential Misuse: What to Check in Microsoft 365

What happened

ConnectWise Cloud Backup backs up Microsoft 365 mailboxes, OneDrive, SharePoint and Teams. To do that, it is registered in Microsoft Entra ID as an app that each customer approves once, and it then signs in to every approving tenant as itself, with its own credential.

According to Huntress, that credential was used between 06:13 and 08:34 UTC on 15 October from an address at a hosting provider (144.172.64.128), not from the cloud addresses the app normally uses. The sign-ins went through customer tenants in alphabetical order of their tenant ID, seconds apart, which points to a script working through a list. By the evening of 16 October, Huntress had confirmed unauthorized sign-ins in 162 tenants; later reporting put the count at 173.

In one tenant, a ConnectWise Cloud Management app made itself a Global Administrator and then added new secrets to two other apps, including a management tool used by the customer's managed service provider. The new secrets were set to stay valid until 2028, so whoever added them could come back even after the original credential is reset. In about 50 other tenants, Cloud Management apps gave themselves directory roles, mostly Exchange Administrator; whether those changes were the attacker or the vendor's own automation has not been confirmed.

ConnectWise has said it found "no evidence that Cloud Backup partner backup data has been compromised," and it has closed the app's access while it investigates. How the credential was stolen has not been published. The investigation is still going on, and the numbers above may change.

Why multi-factor authentication did not stop it

When an app signs in on its own behalf, no person is signing in, so there is no one to ask for a second factor. The app proves who it is with a secret or a certificate that only the vendor holds. Whoever holds that credential can sign in to every tenant that approved the app, with every permission the customer granted, from anywhere.

Customers also have fewer controls over a vendor's app than over their own staff. Conditional Access for apps covers the apps an organization registers itself, not apps owned by another company, so a customer cannot block a vendor's app by location. The control sits with the vendor.

Are you affected?

You are exposed if any of these apps is approved in your Microsoft 365 tenant. In the Microsoft Entra admin centre, open Enterprise applications, set the filter to All applications, and search for each Application ID:

All seven are published from ConnectWise's tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7. If one of them is there, also open Sign-in logs, choose the Service principal sign-ins tab (the default tab shows people only), and filter by the app. Sign-ins from 144.172.64.128, or from any address that is not Microsoft's, need investigating. A clean sign-in log does not prove that nothing was read: some directory reads leave no audit record.

What to do now

1. Disable the apps; do not delete them. In Enterprise applications, open each ConnectWise app, choose Properties, and set Enabled for users to sign in to No. Deleting the app removes your approval and its history; disabling stops new sign-ins. Tokens already issued can stay valid for up to about 90 minutes.
2. Remove admin roles you did not grant. In Roles and administrators, check Global Administrator, Exchange Administrator, Application Administrator and Privileged Role Administrator for any ConnectWise or SkyKick app, and remove it unless you assigned it on purpose.
3. Check every app for new secrets and certificates. Look at App registrations and Enterprise applications, especially management and security tools, and remove any secret or certificate added since 13 October 2026 that nobody on your team created. In the audit log, the events to look for are "Add service principal credentials" and "Update application – Certificates and secrets management".
4. Review Conditional Access exclusions that name these apps.
5. Keep the apps disabled until ConnectWise confirms that all of its credentials have been reset. Disabling pauses new backups, but it does not delete the backups ConnectWise already holds; confirm your retention and restore options with ConnectWise.
6. If your managed service provider runs ConnectWise tools, ask them which of your tenants had these apps, what they found, and whether their own management apps had secrets added.

The wider lesson: vendor apps are part of your attack surface

This was not a weakness in Microsoft 365. It is how multi-tenant apps work: a backup, security or management tool that you approve once keeps its access until you remove it, and its security is the vendor's. Most Microsoft 365 tenants have dozens of these apps, many approved years ago by someone who has since left. A few questions are worth asking every vendor whose app can read your mail or files:

• Does your app sign in with certificates kept in a hardware or managed key store, or with a password-like secret?
• Does it ask only for the permissions it needs, and separate read access from changes?
• Could your app ever give itself an admin role or add credentials to other apps? If so, why?
• How would you notice your app signing in from somewhere unexpected, and how quickly would you tell us?

In your own tenant, review the approved apps and their permissions at least once a quarter, remove the ones nobody uses, limit who holds Application Administrator and Cloud Application Administrator, and set an app management policy that stops long-lived secrets from being added to your own app registrations.

How Lavawall® helps

Lavawall's Microsoft 365 monitoring keeps an up-to-date list of every third-party app approved in your tenant, with its publisher and the permissions it holds, so you can see what a vendor can reach before something goes wrong. When a vendor reports that one of its apps was misused, as happened here, Lavawall sends a critical alert to every organization whose tenant has that app, and emails its Super Admins and their managed service provider with what happened and the steps above. Organizations that add the app later are alerted too, until the issue is closed.

Sources

• Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks
• SpecterOps: ConnectWise SkyKick breach, how to check your Microsoft 365 tenant
• The Hacker News: compromised ConnectWise credential used to sign in to Microsoft 365 tenants

Figures are from the reports above as of 18 October 2026. The investigation was still under way when this was written, and we will update this article as confirmed details are published.