ConnectWise Cloud Backup Incident Exposes Microsoft 365 Tenants to Unauthorized Access

ConnectWise’s response to a compromised Cloud Backup credential has left several services offline while the company investigates access to customer Microsoft 365 environments. The concern reaches beyond one account: a credential held by a vendor application can provide a route into multiple customer tenants without a user password or an MFA prompt. That makes the incident a test of both ConnectWise’s containment and customers’ ability to see what happened inside their own environments.

Huntress reported suspicious sign-ins across 162 organizations by 19:00 UTC on October 16. Its investigation found the Cloud Backup application requesting Microsoft Graph access tokens with a credential associated with ConnectWise’s tenant. On October 15, the application authenticated from 144.172.64[.]128, a hosting provider address that differed from the Azure private IP space where it normally communicated, and Microsoft sign-in logs captured the events. The change in source address is a reason to investigate; by itself, it doesn’t establish what the operator did after authentication.

Vendor credentials opened a path into customer tenants

Cloud Backup requires broad permissions to back up and restore data across Exchange Online, OneDrive, SharePoint and Teams. That breadth is tied to the product’s purpose: a backup service needs access to the data it is expected to preserve and restore. But it also means a compromised application credential can have consequences across several kinds of customer information. Because the credential belonged to ConnectWise’s environment, customers could not have generated it through activity in their own tenants.

Application authentication also bypasses the user login flow, so it doesn’t call for a password or trigger the usual MFA prompt. That distinction matters when administrators review the incident: a lack of suspicious user logins or MFA challenges wouldn’t, on its own, rule out access through an application identity. Similar systems typically rely on permissions and credentials assigned to the application, which makes monitoring those identities part of tenant security.

Huntress found a separate sequence involving ConnectWise’s Cloud Management for Microsoft Teams application in one partner tenant. The application assigned itself the Global Administrator role, then added credentials to two other applications, including a Huntress application dedicated to that partner. The sequence took about five minutes. Huntress hasn’t determined whether the same operator carried out both parts of the activity, so the relationship between the Cloud Backup sign-ins and this sequence remains unresolved.

That second sequence matters because application credentials and directory roles can create access that persists beyond a single sign-in. Adding credentials to other applications may give an operator another way to authenticate, while a Global Administrator role carries broad authority within a tenant. (And this is the part most people overlook.) Reviewing the original connection alone may miss changes made to other identities or roles.

ConnectWise disabled seven application identities on October 17 and revoked certificates tied to affected application connections. It also suspended Cloud Backup, SaaS Security and Cloud Management. The company’s October 19 advisory added two more addresses identified through downstream monitoring: 144.172.64[.]99 and 144.172.64[.]60. Those actions describe the vendor’s containment steps; customers still need to establish whether any tenant-specific changes occurred.

Containment leaves customer checks in focus

Disabling the connections blocks new authentication through those identities, but it doesn’t undo changes already made in customer tenants. Previously issued tokens may also remain usable until they expire or are invalidated. ConnectWise said it had seen no successful threat activity in environments it monitors since containment began, though it had not set a date for restoring the services. That statement is useful, but it covers the environments ConnectWise monitors and doesn’t replace a review of each customer tenant.

The outages affect day-to-day operations as well as security monitoring. With Cloud Backup suspended, scheduled backups, archive access and restores are unavailable. SaaS Security monitoring and alerts are offline, as are Cloud Management’s user and license management features. For customers, the interruption means some routine work and safeguards have to be handled without those services while the investigation continues.

Huntress hasn’t confirmed data theft. In the one tenant whose audit logs it reviewed in detail, it found no recorded access to mail or files. That is a limited finding: some Microsoft Graph directory reads leave no audit trail, so the available records can’t establish that no data was accessed. Absence of a recorded event in those logs should therefore be read as an evidence limit, not proof that every possible form of access has been ruled out.

ConnectWise said existing backup archives remain encrypted and isolated, with no indication that they were compromised. It and Huntress urged partners and administrators to inspect application sign-ins, credentials, directory roles, consent grants and policy changes, as well as mailbox forwarding and other signs of persistent access. These checks address different parts of the possible access path: authentication records can show sign-ins, while role and credential changes can reveal attempts to retain access.

What the incident means for customers

ConnectWise advised partners to keep the affected applications disabled until it issues restoration instructions. The practical takeaway is that service containment and tenant review must proceed together: disabling a vendor connection stops new access, while administrators still need to check what may have changed inside their own Microsoft 365 environments. If you’re working in this space, treat vendor application identities as part of your tenant’s security review, even when users didn’t sign in directly.

This is more significant than it looks. A vendor credential can cross the boundary customers usually associate with their own accounts, and the resulting activity may not resemble a conventional password compromise. The outage also shows the operational cost of broad access: suspending a service can reduce exposure while removing backup, monitoring or management functions customers rely on. The unresolved questions are straightforward, but consequential: what activity occurred in each tenant, whether any access persisted, and when ConnectWise can safely restore the affected services.

Until those questions are answered, customers are left with a split task: preserve their own visibility into Microsoft 365 while waiting for the vendor’s restoration guidance. No easy shortcut.