ConnectWise's Silent Shutdown: What the Cloud Backup Suspension Means for Your Microsoft 365 Tenants

Michael Miller · 2026-10-18

Imagine waking up to find that a trusted tool in your security stack suddenly went dark. That's exactly what happened over the weekend when ConnectWise quietly disabled seven application identities—including ConnectWise Cloud Backup—after attackers compromised Microsoft 365 tenants. If you're an MSP or IT pro relying on ConnectWise, this one hits close to home. ### The Incident: What We Know So Far ConnectWise announced on Saturday that it had disabled seven application identities as part of an ongoing investigation. Unknown threat actors gained unauthorized access to these identities and used them to compromise Microsoft 365 tenants. The disabled identities include: - ConnectWise Cloud Backup – 506e08f9-6e9a-4da4-942b-a099a03644ae - Six other ConnectWise application identities (names not disclosed) The company hasn't released further details yet, but the move suggests a serious security gap that could have far-reaching implications. ### Why This Matters to You If you're managing Microsoft 365 environments, this isn't just another headline. Application identities are the backbone of automated services—they authenticate and authorize access to tenant data. When they're compromised, attackers can potentially exfiltrate emails, files, and other sensitive information. And because these identities often have broad permissions, the blast radius can be huge. > "The compromise of application identities is a stealthy attack vector that many organizations overlook," says Michael Miller, Lead Antidetect Browser Strategist & Architect. "It's like leaving the back door unlocked while you focus on the front." ### What Should You Do Right Now? First, don't panic. But do take action. Here's a quick checklist: - Review your Microsoft 365 audit logs for any unusual activity related to application identities. - Check if you're using any of the affected ConnectWise identities and rotate credentials if necessary. - Enable multi-factor authentication (MFA) for all application identities where possible. - Monitor ConnectWise's official channels for updates—they're likely to release more information soon. ### The Bigger Picture: Antidetect Browsers and Identity Security This incident underscores a broader issue: identity is the new perimeter. As more services move to the cloud, attackers are shifting their focus to identities—both human and machine. That's where antidetect browsers come into play. These tools help security teams simulate multiple identities and test their defenses against credential-based attacks. While they're often used for legitimate purposes like ad verification and privacy, they also serve as a reminder that identity management is complex and requires constant vigilance. ### What's Next for ConnectWise Users? ConnectWise has promised to share more details as the investigation unfolds. In the meantime, if you're a ConnectWise partner, expect some disruption to cloud backup services. The company hasn't announced a timeline for restoration, so it's wise to have a contingency plan in place. ### Final Thoughts Security is a journey, not a destination. This incident is a stark reminder that even trusted vendors can become attack vectors. Stay informed, stay proactive, and keep your guard up. We'll update this story as more information becomes available.