ConnectWise Just Cut Off Cloud Backup After a Microsoft 365 Breach

Emily Davis · 2026-10-18

ConnectWise made a move over the weekend that got a lot of IT folks paying attention. The company disabled seven of its application identities after unknown attackers got unauthorized access to them, and in the process, compromised Microsoft 365 tenants. If you run a managed service provider or lean on ConnectWise tools day to day, this one's worth a closer look. ### What Actually Happened Here's the short version. Threat actors somehow got their hands on ConnectWise application identities, and those identities became a doorway into customer Microsoft 365 environments. ConnectWise is still investigating, but it didn't wait around. It shut down the affected identities, and that includes the one tied to ConnectWise Cloud Backup. The disabled identity for Cloud Backup is: - ConnectWise Cloud Backup — 506e08f9-6e9a-4da4-942b-a099a03644ae There are six others in the mix, but that Cloud Backup one is the headline for a lot of admins. Cloud backup is the safety net. When the safety net gets pulled, people notice. ### Why Application Identities Are Such a Big Deal Think of an application identity like a spare key you give a trusted contractor. It lets a service talk to Microsoft 365 without a human logging in every time. Convenient, right? Absolutely. But if that key ends up in the wrong hands, the attacker doesn't need your password. They just walk in through the front door like they belong there. That's the uncomfortable part of this story. These identities often carry broad permissions, and they're easy to overlook during a security review. Nobody forgets their own login. Plenty of teams forget the service accounts humming along in the background. ### What This Means for MSPs and Their Clients If you're an MSP, your clients trust you with their email, files, and backups. A compromise that touches Microsoft 365 tenants isn't abstract. It's someone potentially reading mail or poking around files that should be locked down. A few practical takeaways: - Audit every application identity tied to Microsoft 365 and ask whether each one still needs the access it has. - Rotate credentials and secrets for anything that touches cloud backup. - Check logs for unusual sign-ins or permission grants around the time of the incident. - Talk to clients early. Silence breeds panic later. > "The quietest accounts in your tenant are often the most powerful. Treat them that way." ### The Bigger Lesson This isn't really a ConnectWise-only story. It's a reminder that the supply chain around Microsoft 365 is wide and full of trust. Every integration, every backup tool, every app identity is a relationship. And relationships need boundaries. ConnectWise says it's continuing to investigate, and more details will likely surface. For now, the smart move is to assume nothing and verify everything in your own environment. Check those service identities. Tighten permissions. Make sure your backup path is actually secure, not just present. Because when attackers go after the tools that protect your data, the question isn't whether you have a backup. It's whether you know who else can reach it.