Third-Party Apps Are the New Front Door to Microsoft 365

Admins spend a lot of effort protecting user passwords. The ConnectWise Cloud Backup incident of October 2026 is a reminder that an approved app can be the weaker link. Between 13 and 15 October, a stolen credential for the app, formerly called SkyKick, was used to obtain access tokens in customer tenants. ConnectWise has shut the app off and reports no evidence that stored backup data was accessed.

What makes this kind of incident different

• A backup app needs broad access to mail and files, so a vendor credential reaches every tenant that approved it.
• Huntress confirmed unauthorised sign-ins in 162 tenants as of 16 October and saw the attacker's address in about 1,000.
• In one partner tenant, a second ConnectWise app reportedly made itself Global Administrator and added secrets to two other apps.

A short review list

• Disable (not delete) ConnectWise and SkyKick apps in Entra.
• Check secrets, certificates and admin roles added since 13 October.
• Review sign-in and audit logs for 15 and 16 October.
• Arrange interim backup cover while the app is paused.
• Audit every other third-party app connected to your tenant too.

Full guide: https://affixcenter.com/blog/connectwise-cloud-backup-microsoft-365-breach-october-2026

Written by the team at Affix Center, a Mumbai-based IT services company. https://affixcenter.com/cloud