ConnectWise Disables Seven Application Identities After Microsoft 365 Compromise via Cloud Backup Product

What happened

ConnectWise disclosed on Saturday that it disabled seven ConnectWise application identities, including one tied to ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae), after unknown threat actors gained unauthorized access to those identities. ConnectWise says the access was used to compromise Microsoft 365 tenants. The investigation is ongoing, and ConnectWise has not yet attributed the activity to a specific actor or detailed the full scope of affected customers.

Why it matters

ConnectWise's tools are widely deployed by MSPs and IT service providers, giving them privileged, multi-tenant access across many downstream customer environments. Compromise of an application identity tied to a backup/integration product is significant because such identities often hold broad delegated or app-level permissions into Microsoft 365 (mail, files, directory data) without requiring interactive user credentials. If an MSP's ConnectWise integration was abused, the blast radius could extend to every Microsoft 365 tenant that MSP manages, not just ConnectWise's own infrastructure.

Who's affected

• Organizations using ConnectWise Cloud Backup or the other six disabled application identities
• MSPs and their downstream customers whose Microsoft 365 tenants were connected through these integrations

What defenders should watch for now

• Review Microsoft 365 / Entra ID enterprise app registrations and service principals for ConnectWise-related app IDs, especially 506e08f9-6e9a-4da4-942b-a099a03644ae, and confirm whether any remain active or were recently re-consented
• Audit sign-in and audit logs for anomalous activity from ConnectWise application identities: unusual Graph API calls, mailbox access, large data exports, or new OAuth grants
• Check for newly created or modified mail forwarding rules, inbox rules, OAuth app consents, or federation/trust changes in affected tenants
• Rotate or revoke credentials/certificates associated with ConnectWise integrations where feasible, and re-validate least-privilege scoping on any reinstated identities
• Monitor ConnectWise's own advisories for indicators of compromise, affected identity lists, or remediation guidance as the investigation progresses

Developing story

Details are still emerging and ConnectWise's investigation is ongoing — the full scope of affected tenants, root cause, and actor attribution have not been confirmed at this time. This post will not speculate beyond what has been reported. For the original reporting, see The Hacker News.