Summary
- ConnectWise disabled seven Cloud Backup application identities and revoked connection certificates.
- Backup and restore services were interrupted, although ConnectWise reports no indication that backup archives were compromised.
- Partners must distinguish revoked access from any changes made in Microsoft 365 tenants before revocation.
ConnectWise has disabled seven application identities associated with its Cloud Backup service after identifying unauthorised access, forcing an interruption of backup and restoration functions while it investigates possible activity in customers’ Microsoft 365 environments. The product was formerly known as SkyKick. In an advisory updated on 18 October, the company described the protective changes and outlined checks partners should make inside their tenants.
The company says it disabled the seven identities at 07:00 UTC on 17 October and revoked certificates used for the affected application connections across users. Those actions prevent new authentication through the affected connections, but do not reverse any actions that might already have occurred inside a customer environment. ConnectWise says it has not observed successful threat activity in the environments it monitors since implementing its mitigations.
Cloud backup software is routinely granted access to the customer tenants it protects, and those permissions can outlive individual staff sessions. Rather than authenticating as an ordinary employee each time it operates, a service can use application identities and delegated or application-level permissions to reach mailboxes and other information. Such access can continue independently of an individual user’s password and may not be constrained by controls designed chiefly for interactive sign-ins.
ConnectWise says its existing cloud backup archives have not been impacted by the interruption and that it has no indicators to date that partner backup data was compromised. This is a statement about the backup environment, not a blanket finding about what did or did not happen in every Microsoft 365 tenant. The company’s investigation is ongoing, and the full scope of potential customer-side access has not been established publicly.
Authentication is only one part of the investigation
In its technical guidance, ConnectWise directs partners to examine application sign-ins, tenant audit information, and other relevant evidence. Disabling an identity or removing its certificate closes an authentication path going forward; earlier changes to permissions, mailbox settings, credentials, or administrative roles would require separate investigation and, where appropriate, remediation. The company references Microsoft Entra logs and service principal checks among the available resources.
The incident creates a difficult operational trade-off. Suspended application access reduces a possible route into customer tenants, while interrupting the very service intended to support recovery from data loss and disruption. Customers with a single recovery arrangement may face uncertainty about restoration capacity until Cloud Backup returns, even where existing archives remain intact. ConnectWise has not publicly provided a universal restoration time.
Partners also have a communication problem that cannot be resolved by treating every alert as confirmation of an intrusion. A suspicious application sign-in may merit examination, but whether it resulted in data access or changes depends on the activity recorded and the permissions available. Equally, the absence of a known indicator in one logging source does not conclusively rule out activity elsewhere. Log retention, delegated responsibilities, and the completeness of tenant audit records will affect what investigators can establish.
One technical complication is that a service principal can be represented in several sets of records, including authentication logs, permission grants, application registrations, and mailbox audit events. An investigation must match the correct application identity across those records and account for log-retention differences between customers. ConnectWise has identified the affected identities in its technical material, but a partner’s result still depends on its own tenancy, the permissions granted, and the period for which activity can be reconstructed. That is why the advisory describes concrete tenant checks rather than declaring a uniform customer outcome.
An application designed to protect customer information may hold powerful permissions across many organisations, making its own application identities a material dependency for customer security. Central identity revocation is an important containment measure, but it is different from validating tenant integrity. ConnectWise says it will continue to update its advisory as the investigation and restoration work proceed.
