ConnectWise Security Review: Supply-Chain Incident Impact on Microsoft 365 Tenants

ConnectWise Cloud Backup experienced a supply-chain incident in October 2026 that exposed customer Microsoft 365 tenants through a compromised vendor application credential. The attack affected between 162 and 173 confirmed tenants, with broader activity detected across nearly 1,000 Entra tenants. Service suspension began on October 17 after the company identified the unauthorized access.

Incident Timeline and Technical Details

Unauthorized sign-ins occurred primarily between October 13 and 15, 2026, with the most intense activity on October 15 from 06:13 to 08:34 UTC. Attackers used the compromised Microsoft Entra application (App ID 506e08f9-6e9a-4da4-942b-a099a03644ae) to perform app-only sign-ins that bypassed user MFA controls. The application held broad pre-consented permissions covering mail, OneDrive, SharePoint, Teams, and directory data.

ConnectWise issued an advisory on October 16 and disabled seven application identities, including the Cloud Backup app. A secondary application (App ID 24205314-2b89-4e07-a2a4-579e898a5640) was also abused in at least one tenant to attempt Global Admin role escalation and credential planting. The source IP 144.172.64.128 and Python-based user agents appeared in multiple tenant logs. No evidence indicates encrypted backup archives were accessed during the incident.

Microsoft Threat Intelligence classified the event as an active supply-chain attack that leveraged a trusted OAuth application. ConnectWise stated that certificates and shared credentials were revoked and that third-party investigators continue to support the response. Service restoration remains pending vendor confirmation of completed remediation steps.

Impact on Tenants and Immediate Actions

The incident highlights classic risks associated with third-party service principals that receive extensive tenant permissions for legitimate backup operations. Once the vendor credential was obtained, attackers inherited access across multiple Microsoft 365 environments without triggering per-user authentication checks. Partners using ConnectWise Cloud Backup for managed service provider workflows were the primary targets.

Administrators should review Entra sign-in logs for the listed application IDs and IP address starting from October 13. Any newly added credentials or role assignments in that window require immediate investigation. ConnectWise directed customers to disable rather than delete the affected service principals until further notice.

Practical steps include:

• Export sign-in and audit logs for the affected App IDs.
• Revoke any refresh tokens or added secrets created after October 13.
• Monitor for Global Admin role changes and unexpected mailbox or SharePoint access.
• Wait for vendor confirmation before re-enabling the backup service.

Broad scrutiny of all vendor service principals with directory permissions is advisable for organizations that rely on MSP or SaaS backup tools.

ConnectWise Alternatives Comparison

Organizations evaluating replacement solutions can compare several established Microsoft 365 backup platforms on security controls and incident history.

Selection should account for the scope of required permissions, logging transparency, and the vendor’s track record of credential management. Regular audits of Entra service principal activity remain a baseline control regardless of the chosen platform.