ConnectWise disclosed on Saturday that it has disabled seven of its application identities after discovering that unknown threat actors obtained unauthorized access to them and used that access to compromise customer Microsoft 365 tenants.

The company said the investigation into the incident is ongoing. Among the disabled identities is ConnectWise Cloud Backup, identified by the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. ConnectWise has not yet disclosed the identities of the remaining six application identities that were disabled as part of the response.

What We Know

ConnectWise application identities are used to authenticate and authorize ConnectWise products and integrations against customer cloud environments, including Microsoft 365 tenants managed by managed service providers (MSPs) and their downstream clients. Unauthorized access to these identities could allow an attacker to impersonate legitimate ConnectWise services and reach into connected tenants.

By disabling the affected identities, ConnectWise has effectively suspended functionality tied to those applications, including Cloud Backup, while the scope of the compromise is assessed. Organizations relying on ConnectWise Cloud Backup or the other disabled services should expect service interruptions until the issue is resolved.

Why It Matters

ConnectWise products are widely used by MSPs to manage IT infrastructure for numerous downstream customers. A compromise of application identities at this level has the potential for broad, multi-tenant impact, since a single point of failure can cascade into unauthorized access across many organizations that rely on ConnectWise-integrated tooling for Microsoft 365 management.

What Security Teams Should Do

  • Review Microsoft 365 tenant audit logs for signs of unauthorized access tied to ConnectWise application identities, particularly the disclosed Cloud Backup application ID.
  • Monitor for unusual sign-in activity, consent grants, or mailbox access associated with ConnectWise-linked service principals.
  • Stay alert for further guidance from ConnectWise as the investigation progresses and additional affected identities may be disclosed.
  • MSPs should assess downstream client exposure and communicate proactively with affected customers.

ZeroDayWire will update this story as more details become available from ConnectWise.