As reported by SecurityAffairs, ConnectWise disclosed that attackers stole credentials for seven of its application identities, granting them the ability to impersonate ConnectWise applications and request access tokens from Microsoft Entra ID for customer Microsoft 365 tenants. This is not a password spraying attack or a customer-side misconfiguration — it is a supply chain compromise exploiting the inherent trust that SaaS-to-SaaS integrations require to function.

Cloud Security Alert: As reported by SecurityAffairs, ConnectWise disclosed that attackers stole credentials for seven of its application identities, granting them the ability to impersonate ConnectWise applications and request access tokens from Microsoft Entra ID for customer Microsoft 365 tenants.

Why This Matters More Than a Typical Breach

The critical distinction here is that ConnectWise's applications held delegated permissions across potentially thousands of Microsoft 365 tenants. These apps were designed to access mailboxes, SharePoint sites, Teams data, and directory information to perform backup and management functions. When the application credentials were stolen, the attackers didn't need to compromise any individual customer — they simply authenticated as the ConnectWise app itself and rode the existing trust relationship straight into customer environments.

This is the OAuth application model working exactly as designed — and that's the problem. The model assumes the application identity holder is trustworthy. When that assumption breaks, the blast radius is enormous and largely invisible to the affected organizations until the vendor notifies them.

The Hidden Blast Radius Problem

ConnectWise noted that disabling the compromised connections stops new access but does not undo changes attackers may have already made inside customer tenants. This is the most concerning aspect of the incident from a defender's perspective:

Why This Matters More Than a Typical Breach
Attackers may have established persistence through additional OAuth apps, service principals, or mailbox forwarding rules
Directory data exfiltration may have already occurred, potentially exposing user enumeration for follow-on attacks
Mailbox rules or delegation changes could redirect emails without triggering conventional alerting
SharePoint and Teams access may have enabled data staging for future extortion or espionage

Who Is at Risk

Any organization using ConnectWise Cloud Backup (formerly Skykick), SaaS Security, or Cloud Management — particularly those managed through MSPs — should assume potential exposure. The risk profile scales with the permissions granted to these applications. Organizations that granted broad directory or mailbox access are at higher risk than those with minimal, scoped permissions.

MSPs themselves face compounded risk: their downstream customers may demand transparency, and the reputational impact of a third-party compromise flowing through their managed estate is significant.

What You Should Do

Organizations should not wait for formal notifications. Immediate defensive actions include:

Audit Entra ID Application Activity

  • Search Microsoft Entra ID audit logs for all sign-in and app activity events associated with ConnectWise-related service principals between October 1–17, 2026
  • Export and review the ServicePrincipalSignInLogs and AuditLogs in Microsoft Sentinel or the Azure portal for any anomalies — unusual IP ranges, off-hours access, or access to tenants the app shouldn't be touching
  • Check for any new OAuth applications or service principals created in your tenant during this window

Hunt for Persistence

  • Review all mailbox forwarding rules and delegation changes made in the past two weeks
  • Audit for new app registrations and consent grants using Get-AzureADApplication and reviewing Enterprise Applications in the Entra portal
  • Check Microsoft 365 audit logs for any suspicious SharePoint file downloads or Teams message reads

Reassess SaaS-to-SaaS Trust

  • Inventory all third-party OAuth applications with access to your Microsoft 365 tenant — you likely have far more than you realize
  • For each app, document: what permissions it holds, who approved it, whether those permissions are still required, and what the vendor's security posture looks like
  • Revoke permissions for any app that cannot justify its current access scope
  • Consider implementing Conditional Access policies that restrict third-party app access where feasible
The fundamental issue is not that ConnectWise was breached — it's that the SaaS integration model treats vendor application identities as trusted intermediaries with minimal downstream visibility. Until organizations gain real-time observability into what their integrated applications are doing inside their tenants, this attack pattern will repeat.

Broader Implications

This incident reinforces a painful truth about modern cloud security: your perimeter is now defined by the trust relationships your SaaS applications maintain with other SaaS platforms. Every OAuth grant is a potential ingress path. Every integrated vendor is a potential supply chain attack vector.

Security teams should treat application identity governance with the same rigor as user identity governance. That means regular permission reviews, least-privilege enforcement, continuous monitoring of app activity, and explicit incident response runbooks for third-party application compromise scenarios.

The era of trusting SaaS integrations by default needs to end. Assume breach, verify behavior, and revoke aggressively.