{"id":851,"date":"2026-10-22T21:00:06","date_gmt":"2026-10-22T21:00:06","guid":{"rendered":"https:\/\/managedt.com\/blog\/connectwise-disables-cloud-backup-microsoft-365-credential-incident\/"},"modified":"2026-10-22T21:00:07","modified_gmt":"2026-10-22T21:00:07","slug":"connectwise-disables-cloud-backup-microsoft-365-credential-incident","status":"publish","type":"post","link":"https:\/\/managedt.com\/blog\/connectwise-disables-cloud-backup-microsoft-365-credential-incident\/","title":{"rendered":"ConnectWise Disables Cloud Backup After Microsoft 365 Credential Incident"},"content":{"rendered":"
Updated October 22, 2026 at 4:59 PM ET<\/em><\/div>\n

ConnectWise disabled Cloud Backup and related cloud services after identifying unauthorized access to application identities associated with its Microsoft 365 backup product. The incident may have exposed downstream MSP tenants to sign-in attempts, while ConnectWise said it had not identified confirmed downstream customer compromise.<\/p>\n

The affected product, formerly called SkyKick, can hold permissions to access Microsoft 365 services including Exchange mailboxes, OneDrive, SharePoint and Teams. Businesses using the product through a managed service provider should review Microsoft 365 tenant activity, application credentials and administrator roles while ConnectWise continues its investigation.<\/p>\n

What happened<\/h2>\n

Dark Reading reported<\/a> that ConnectWise identified unauthorized access on October 14 to application identities associated with ConnectWise Cloud Backup. The software vendor, which primarily serves managed service providers, disabled Cloud Backup for partners and clients on October 17 and later disabled SaaS Security and Cloud Management as the investigation and remediation work continued.<\/p>\n

Backups, restores, SaaS Security monitoring and Cloud Management functions were unavailable at the time of the report. ConnectWise said it had revoked certificates used by affected application connections, invalidated affected shared Cloud Backup credentials, rotated or disabled compromised identities and engaged an incident response firm.<\/p>\n

The company has not confirmed whether a specific vulnerability was exploited in the attack chain. ConnectWise said its monitored environments showed no successful threat activity after mitigation, and it had no indicators that Cloud Backup partner backup data had been compromised.<\/p>\n

Are you affected?<\/h2>\n

ConnectWise Cloud Backup is a SaaS backup service for Microsoft 365 data. Customer organizations grant it permissions inside their Microsoft 365 and Entra environments, and the product can generally access Exchange mailboxes, OneDrive, SharePoint, Teams and other Microsoft 365 workloads.<\/p>\n

ConnectWise said downstream impact remained under investigation and that it had not identified confirmed downstream customer compromise. The company also said it does not have independent visibility into customer Microsoft 365 environments, so it cannot independently determine whether a partner or customer tenant experienced unauthorized activity. Huntress and Todyl take a more cautious approach and consider successful authentication using the application credentials to represent downstream impact.<\/p>\n

Huntress reported sign-in activity linked to more than 1,000 Entra tenants from an IP address associated with the unauthorized activity, with successful activity in more than 300 of those tenants. Huntress also reported seeing a ConnectWise application obtain Global Administrator access in two tenants and add credentials for other applications to preserve access.<\/p>\n

Todyl recommended that organizations presume compromise for tenants with the Cloud Backup application enabled and said the affected Microsoft Entra application ID is 506e08f9-6e9a-4da4-942b-a099a03644ae<\/code>. The research firm also reported that the actor accessed SkyKick partner tenants in tenant-ID order, including tenants where the application had never been installed. ConnectWise has not said whether partner data, including tenant lists, was exposed.<\/p>\n

What to do now<\/h2>\n
    \n
  1. \n
  2. Review the ConnectWise disclosure status post and the indicators of compromise supplied there.<\/li>\n
  3. Check each managed customer tenant and the organization\u2019s own Microsoft 365 tenant, including dormant SkyKick connections.<\/li>\n
  4. Review sign-in activity for the affected application and for related Microsoft 365 applications, using the indicators identified in ConnectWise\u2019s advisory.<\/li>\n
  5. Review credentials and administrator roles, including any Global Administrator assignments and newly added application credentials.<\/li>\n
  6. Confirm data retention and restore options with ConnectWise while backups and restores are unavailable.<\/li>\n<\/ol>\n

    For a small business, the immediate check is whether its managed service provider uses ConnectWise Cloud Backup, formerly SkyKick, and whether the business has granted the application access to its Microsoft 365 tenant. The source does not state that a particular Microsoft 365 version or setting is required for the check. The affected shared credentials and application connections should be treated according to ConnectWise\u2019s current advisories.<\/p>\n

    SEOScanPro\u2019s GEO Grids are not relevant to this incident. The applicable work is tenant-level Microsoft 365 review, credential management and application permissions, which are separate from website visibility or search reporting.<\/p>\n

    Why the Microsoft 365 permissions matter<\/h2>\n

    ConnectWise Cloud Backup\u2019s access to Microsoft 365 data means that a compromise of its application identities can affect more than the backup service itself. Depending on the permissions granted, the application may be able to reach mail, files, collaboration data and administrator functions.<\/p>\n

    That access model explains why the investigation extends beyond ConnectWise\u2019s own environment. The company can review its application identities and monitored systems, but customer tenant activity requires review by the organizations and managed service providers responsible for those tenants.<\/p>\n

    The disagreement between ConnectWise and outside security researchers centers on how much can be concluded from authentication activity. ConnectWise says findings about stored archives are separate from possible activity in live Microsoft 365 environments. Huntress and Todyl argue that successful access to customer tenants with the affected application credentials is itself a sign of downstream impact, even when access to specific data has not been shown.<\/p>\n

    What remains unknown<\/h2>\n

    ConnectWise has not disclosed whether partner data or tenant lists were exposed. Microsoft did not respond to Dark Reading\u2019s request for comment at the time of the report.<\/p>\n

    ConnectWise also said that its findings about stored archives were separate from possible activity in live Microsoft 365 environments. The investigation therefore continues across credential exposure, tenant sign-ins, permissions, backups and any evidence of unauthorized activity.<\/p>\n

    FAQ<\/h2>\n

    Is ConnectWise Cloud Backup currently available?<\/h3>\n

    ConnectWise disabled Cloud Backup for partners and clients on October 17. Backups and restores remained unavailable while the investigation and remediation work continued. SaaS Security monitoring and Cloud Management functions were also disabled over the weekend.<\/p>\n

    Which Microsoft 365 environments should be checked?<\/h3>\n

    ConnectWise recommends reviewing the organization\u2019s own Microsoft 365 tenant and each managed customer tenant, including dormant SkyKick connections. The source does not identify a specific Microsoft 365 version or setting to check.<\/p>\n

    What should organizations do about ConnectWise application credentials?<\/h3>\n

    ConnectWise says it revoked certificates, invalidated affected shared Cloud Backup credentials and rotated or disabled compromised identities. Huntress recommends reviewing credentials and administrator roles, including possible added application credentials, and checking for persistence.<\/p>\n

    Related coverage<\/h2>\n