# What can your IT provider’s apps reach in Microsoft 365? URL: https://casterconsulting.hu/en/connectwise-microsoft-365-breach/ Published: 2026-10-18 Updated: 2026-10-18 Author: Caster Consulting > Probably more than you think, as this week's ConnectWise incident showed. Attackers signed in to hundreds of Microsoft 365 environments as a backup service's app, and multi-factor authentication did not stop them. **Short answer: probably more than you think, and now is a good time to check.** This week's ConnectWise incident showed that in a Microsoft 365 environment, the user password is not the only way in. There are also the apps you once gave permission to: backup, email filtering, device management. If one of those vendors is breached, the attacker walks in with your permission, and multi-factor authentication does nothing about it. ## What happened? ConnectWise Cloud Backup (formerly SkyKick) backs up Microsoft 365 data, mostly for the clients of managed service providers (MSPs). To do that, it uses permissions granted in Microsoft Entra ID. According to the security firm Huntress, someone obtained the app's credential and, from 15 October, began signing in to customers' Microsoft 365 environments as the app. Not as a user, but from a script, so there was no multi-factor prompt anywhere in the flow. The numbers grew quickly. On 16 October, Huntress confirmed unauthorised sign-ins in 162 environments. A day later it had found almost 1,000 environments with sign-in attempts from the attacker's address, more than 300 of them successful. Huntress itself stresses that this does not mean data was taken in all of those 300. In some places the attacker went further. According to BleepingComputer and Huntress, related ConnectWise apps assigned themselves administrator roles in roughly 50 environments, mostly Exchange Administrator. In one case an app made itself Global Administrator and then added new client secrets, valid until 2028, to other apps in the tenant. That is a back door: it keeps working even after the original app is disabled. BleepingComputer also cites an administrator whose affected app had not been used in years. ConnectWise shut the service down on 17 October and disabled seven application identities. The company says it has found no sign that stored backup data was accessed. But according to its 18 October update, quoted by BleepingComputer, scheduled backups are not running while the service is down, restores are unavailable, and no restoration date has been given. ConnectWise has not said how the credential leaked, and iTnews reports it cannot confirm whether any individual customer environment was actually accessed. ## What does this mean for a small business? Two things, and neither is really about ConnectWise. **First: permissions don't expire on their own.** In many small businesses, someone clicked "Accept" years ago on a backup, archiving or reporting tool. The tool was replaced; the access stayed. A typical situation is that the managing director has no idea how many third-party apps can read company email. Often the IT provider doesn't know exactly either. Multi-factor authentication, if you set it up well (we covered that in [MFA and password management for SMEs](/en/mfa-password-management-smes/)), protects user accounts. It does not protect app access. **Second: your backup is a vendor too.** If you relied on this service, your Microsoft 365 backup has not run for days, and you can't restore anything. If ransomware or an accidental mass deletion hits you in that window, there is nowhere to recover from. One backup with one vendor is not a strategy. It is a hope. Our article on [ransomware and backup strategy](/en/ransomware-backup-strategy/) explains how to build one properly. This is also a supply-chain question in the regulatory sense. If your company falls under NIS2, supply-chain security is one of the risk-management measures the directive lists, and "which vendors hold keys to our systems" is exactly the kind of question it expects you to be able to answer. To be clear: none of this means you shouldn't trust an external IT provider. It means you need to know which keys you handed over, and what is done with them. ## What should you do now? 1. **If you use ConnectWise or SkyKick products (or aren't sure),** ask your IT provider today. Huntress recommends disabling, not deleting, the affected apps, and checking every app for secrets or certificates added since 13 October that you didn't create. 2. **Review third-party apps.** In Microsoft Entra, the Enterprise apps list shows which app has which permissions; Microsoft's documentation walks you through it step by step. Anything you don't recognise, or that hasn't signed in for years, should be disabled together with whoever manages your IT. 3. **Ask your IT provider three questions:** which of their apps can access your Microsoft 365 environment, with which roles, and who tells you if one of their own vendors is breached. If you can't get a written answer, that is an answer too. 4. **Have a second backup.** Keep a copy of your Microsoft 365 data in a separate, independent place, and test a restore at least once. You don't want to find out whether it works on the day you need it. 5. **Limit who can grant new apps access.** Users shouldn't be able to click "Accept" on their own for an app that asks for company email or files; require administrator approval instead. ### A quick way to measure your exposure Count three things in your tenant: how many enterprise apps have admin-consented permissions, how many of those have not signed in during the last 90 days, and how many hold an administrator role. The second and third numbers are where to start. In most tenants they should be close to zero. If you'd like someone to review which access rights and backups protect your company systems, take a look at our [infrastructure](/en/infrastructure/) service. ## Sources - [Huntress – ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) - [BleepingComputer – Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/) - [iTnews – Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants](https://www.itnews.com.au/news/stolen-connectwise-skykick-credential-exposed-microsoft-365-tenants-629721) - [Microsoft Learn – Review permissions granted to enterprise applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions) - [EUR-Lex – Directive (EU) 2022/2555 (NIS2), Article 21](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)