ConnectWise disables application identities after Microsoft 365 tenant incident

ConnectWise has disabled seven application identities and suspended its Cloud Backup service after unknown attackers gained unauthorized access to application identities and compromised Microsoft 365 tenants. The IT management software provider took the mitigation action on October 17, 2026, at 07:00 UTC, and said it first identified the issue on October 14 through advanced cybersecurity monitoring and diligence.

The disabled identities cover ConnectWise Cloud Backup and Cloud Management connections for Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center and SharePoint Online. ConnectWise also temporarily took SaaS Security and Cloud Management offline while it investigates the incident.

Backup operations interrupted while the investigation continues

ConnectWise revoked certificates used for affected application connections across all users, invalidating the shared Cloud Backup credentials. The company said the step prevents new authentication through those connections, but it does not reverse changes that may already have been made within a customer tenant.

Scheduled backups are not running, and affected backup archives and restoration capabilities remain unavailable. ConnectWise said existing archives are encrypted, isolated and preserved, and that it has no evidence the attackers breached or accessed them.

Previously issued access tokens may remain usable until they expire or are otherwise invalidated. ConnectWise also warned that unauthorized credentials, permissions or other access created through separate identities need their own review and remediation. The company said it had not observed successful threat activity in the environments it monitors after its mitigations, while stressing that it cannot directly observe downstream customer environments by design.

Application permissions create a broad tenant risk

The exact mechanism through which the application identities were exposed remains under analysis, and ConnectWise said it is not yet clear whether a product vulnerability contributed. The incident demonstrates why application credentials warrant the same scrutiny as privileged user credentials: an attacker using an application identity can request Microsoft Entra ID access tokens within that application's existing permissions.

Depending on those permissions, this could expose Microsoft services including mailboxes, SharePoint documents, Teams messages and directory information. Applications used for backup and management may hold extensive access. A threat actor could seek persistence by adding the application to the Global Administrator role, adding client secrets to trusted applications, or creating new applications and granting them permissions.

Huntress reports sign-ins and a targeted second wave

Huntress said it last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted manual activity continuing until about 14:20 UTC. It reported high confidence that the Cloud Management applications for Exchange Online, Teams and SharePoint were targeted, and confirmed abuse of the Teams application in one tenant.

The managed security provider identified nearly 1,000 Entra tenants with sign-in activity from IP address 144.172.64[.]128, including 300 successful sign-ins. In some tenants, the absence of a service principal prevented further access. Huntress also identified an unsuccessful second targeted wave against 16 tenants in policy, national security, trade and critical mineral sectors on October 15.

Partners should preserve available sign-in and audit records before containment, review their own and managed customer tenants, and keep affected applications disabled until further notice. Reviewing authentication activity from October 13 onward, application credentials, federation trusts, directory roles, consent grants, policy changes, mailbox forwarding and inbox rules is a practical step to identify persistence before affected integrations return to service.