The recently disclosed ConnectWise supply chain attack affecting Microsoft 365 environments highlights a serious cybersecurity challenge: attackers no longer need to compromise individual user accounts when they can exploit the identity and permissions of a trusted third-party application.

Security researchers have reported unauthorized access to 173 Microsoft 365 partner and customer tenants through compromised credentials associated with ConnectWise Cloud Backup, formerly SkyKick.

The affected application was legitimately integrated with customer Microsoft 365 environments to provide backup and recovery services.

To perform these functions, it had been granted permissions to access resources such as Exchange mailboxes, OneDrive, SharePoint, Teams and directory information.

Attackers exploited this existing trust relationship.

By authenticating as the approved application, they were able to obtain Microsoft Graph access tokens without needing individual user passwords or interactive MFA approval.

This is what makes the incident particularly concerning.

Organizations may enforce strong password policies, multifactor authentication and conditional access for their employees, yet still expose sensitive information through application identities that operate independently of user authentication.

The attack demonstrates that third-party application permissions can become a powerful access mechanism when the credentials behind those applications are compromised.

Researchers also identified more serious activity in at least one partner environment, where a related ConnectWise application assigned itself Global Administrator privileges and added credentials to other trusted applications.

This creates the possibility of persistence and further access beyond the initially compromised application.

The incident highlights several important security requirements.

First, organizations must maintain visibility into all third-party applications authorized to access their cloud environments.

Second, application permissions should follow the principle of least privilege. A backup application should receive only the permissions genuinely necessary for its operation.

Third, service principal authentication and Microsoft Graph activity must be continuously monitored for unusual source addresses, unexpected access patterns and unauthorized permission changes.

Fourth, organizations should regularly review application credentials, OAuth consent grants and privileged role assignments.

Importantly, traditional user-focused security monitoring may not detect these attacks because the malicious activity occurs through application identities rather than user accounts.

ConnectWise has suspended Cloud Backup application access while investigating the incident. Although it has reported no evidence of compromise to stored backup archives, organizations must separately assess whether their live Microsoft 365 environments were accessed.

The broader lesson is that trust granted to an application can become a security vulnerability when that trust is excessive, permanent or insufficiently monitored.

Zero Trust must extend beyond users and devices to applications, service principals and machine identities.

A trusted integration should never mean unlimited or unquestioned access.

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]

Source: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack via Bleeping Computer — published 17 Oct 2026.