ConnectWise Pulled the Plug on Cloud Backup — Here's What It Means for Your Microsoft 365 Tenants

Emily Davis · 2026-10-17

So here's something that should make you sit up straight if you manage Microsoft 365 tenants: ConnectWise just cut off customer access to its Cloud Backup service — that's the one formerly known as SkyKick Cloud Backup — after hackers got their hands on application identities and used them to compromise Microsoft 365 tenants. Let that sink in for a second. This isn't a case of someone guessing a weak password. The attackers went after the application identities themselves — the machine-to-machine credentials that a lot of us set up once and then basically forget about. ### Why application identities are the soft spot nobody watches Here's the thing about app identities: they don't have MFA prompts popping up. They don't get locked out after failed attempts. They just sit there, quietly holding the keys to your tenant, often with permissions far broader than anyone remembers granting. When a supply-chain provider like ConnectWise gets hit at that layer, the blast radius isn't one company. It's every customer downstream. That's the part that keeps people up at night. - One compromised app identity can reach across multiple tenants - Backup services typically hold elevated, persistent access - Few teams audit these credentials on any regular schedule - Revoking access mid-incident often means downtime you didn't plan for ### What this means for antidetect browser users and privacy pros If you're in the antidetect browser world — managing multiple accounts, keeping identities clean and separated — this story is a reminder that your browser fingerprint isn't the only identity that matters. Your cloud application identities are just as exposed, and honestly, most people never think about them. A few practical takeaways worth acting on this week: - Audit every app registration in your tenants and kill anything you don't recognize - Rotate credentials for backup and integration services on a schedule - Treat third-party SaaS access as a risk surface, not a convenience - Keep a manual export of critical data — don't let one provider be your only copy ### The bigger picture Supply-chain attacks like this one are becoming the default playbook. Attackers know it's easier to walk in through a trusted vendor than to break down your front door. ConnectWise shutting down access is the right call for containment, but it also leaves customers scrambling for backup coverage they thought was handled. > The lesson isn't that backups fail. It's that trust, once handed to a third party, needs a leash — and someone has to hold it. So take ten minutes today. Open your tenant's enterprise applications list. Look at what has permissions. You might be surprised — and that surprise is a whole lot better now than after an incident. Stay sharp out there.