Industry NewsOctober 23, 202611 min read

My MSP Tech

Microsoft 365 Security Lessons From the ConnectWise Cloud Backup Incident

Quick Answers for Property & Facility Managers

What happened in the ConnectWise Cloud Backup Microsoft 365 incident?

ConnectWise suspended Cloud Backup after a suspected supply-chain attack involving a compromised credential and trusted Microsoft 365 application access. Huntress reported unauthorized sign-ups in 162 customer tenants and identified attempted sign-ins to nearly 1,000 Entra tenants, with more than 300 appearing successful. ConnectWise Cloud Backup was formerly known as SkyKick.

What should an SMB do after the ConnectWise Cloud Backup incident?

Organizations using ConnectWise Cloud Backup should follow current vendor and security-provider guidance, review Entra ID sign-in and audit logs, disable affected applications when instructed, rotate exposed credentials, inspect privileged-role changes, and validate Microsoft 365 backup and restore coverage. An MSP or MDR provider can help determine whether access, data, or administrative controls were changed.

Why does this incident matter to property and facility management companies?

Property and facility management companies often rely on Microsoft 365 for leases, work orders, financial records, vendor communications, and building documentation. A compromised trusted application could expose business data or administrative access across multiple sites. Leaders should evaluate third-party OAuth permissions, conditional access, backup independence, and incident response before a service interruption affects operations.

What the ConnectWise Cloud Backup incident means for Microsoft 365 security

ConnectWise suspended access to its Cloud Backup service after a suspected supply-chain attack targeting Microsoft 365 users. Huntress reported that a compromised ConnectWise Cloud Backup credential was used for unauthorized activity and confirmed unauthorized sign-ins in 162 customer tenants. Huntress also identified sign-in activity from related infrastructure across nearly 1,000 Entra tenants, with more than 300 attempts appearing successful.[1][5]

For IT directors, operations leaders, and business owners at SMB and mid-market companies, the central lesson is not simply that one backup service was interrupted. The incident demonstrates how a trusted vendor identity, OAuth application, API secret, or delegated permission can become a pathway into Microsoft 365. A company can maintain strong passwords and endpoint protection yet still face material risk when an approved third-party application has excessive permissions or weak monitoring.

Why trusted Microsoft 365 applications create supply-chain risk

Cloud backup and SaaS management platforms commonly require access to Microsoft Graph, Exchange Online, SharePoint Online, Teams, Partner Center, or other Microsoft 365 services. Those integrations support automation, but they also create a high-value trust relationship. If a vendor credential or application secret is compromised, attackers may be able to authenticate through a legitimate-looking service rather than an obviously malicious account.[5][7]

This is especially relevant to commercial property portfolios, facilities organizations, manufacturers, professional-services firms, and healthcare practices that use Microsoft 365 across multiple departments or locations. An attacker who obtains privileged access may target email, shared documents, Teams conversations, administrator roles, or business applications. The exact impact depends on the permissions granted, tenant configuration, logging, and the attacker’s actions; it should not be assumed that a sign-in automatically means data theft.

Immediate Microsoft 365 security actions for affected organizations

Organizations using ConnectWise Cloud Backup, formerly SkyKick, should coordinate with ConnectWise and their managed service provider before making changes that could disrupt recovery or evidence collection. Huntress advised impacted organizations to disable the ConnectWise Cloud Backup application and ConnectWise Cloud Management - MS Teams application in Microsoft 365, using the application identities identified in its advisory.[5]

Confirm whether the organization uses ConnectWise Cloud Backup or related ConnectWise cloud applications.
Review Entra ID sign-in logs, audit logs, application consent, service-principal activity, mailbox rules, forwarding settings, and privileged-role changes.
Investigate sign-ins from suspicious infrastructure and compare them with known administrators, service accounts, locations, and maintenance windows.
Rotate affected vendor credentials, secrets, certificates, and administrator credentials according to the incident-response plan.
Review whether any new global administrator, application administrator, or equivalent privileged assignment was created.
Preserve relevant logs and timestamps before retention limits remove evidence.
Confirm the status of scheduled backups, existing backup archives, and restoration capabilities with the provider.

These actions should be performed by qualified administrators or an incident-response provider. Blindly deleting applications or accounts can remove evidence and may interrupt legitimate recovery workflows.

Backup continuity matters when a cloud service is suspended

A backup product is not the same as a complete business-continuity program. When a cloud backup service is unavailable, leaders need to know whether scheduled backups continued, whether historical archives remain accessible, how long restoration may take, and whether an independent recovery copy exists. ConnectWise’s service interruption made these questions operationally urgent because reporting indicated that backup scheduling, archive access, or restoration capabilities could be unavailable while services remained suspended.[2][9]

Commercial organizations should require documented recovery objectives for Microsoft 365, including recovery point objectives and recovery time objectives for email, SharePoint, Teams, OneDrive, and business-critical files. The backup design should address tenant-wide deletion, ransomware, malicious administrators, accidental changes, vendor outage, and loss of access to the backup platform itself.

For multi-building property operations, restoration priorities might include lease records, rent and payment information, building access documentation, vendor contracts, compliance records, and communications supporting active incidents. A provider should test representative restores rather than relying solely on a dashboard showing that jobs completed.

Identity, OAuth, and managed detection controls buyers should expect

Third-party application governance belongs in the organization’s normal Microsoft 365 security program. An MSP or managed cybersecurity provider should maintain an application inventory, document permissions, review consent grants, remove unused integrations, and monitor service-principal behavior. Conditional access, phishing-resistant multifactor authentication for privileged users, least privilege, privileged identity management, and alerts for unusual application sign-ins can reduce exposure.

EDR alone will not necessarily detect abuse of a legitimate cloud application. Microsoft 365 audit monitoring, identity threat detection, SIEM correlation, and MDR or SOC review are valuable complements. Providers should explain which logs they ingest, how quickly alerts are triaged, whether after-hours response is included, and whether incident escalation is covered by a written SLA.

Buyers should also ask whether the provider can investigate OAuth consent abuse, revoke tokens, review mailbox persistence, remove malicious forwarding rules, and coordinate with Microsoft and the affected software vendor. These are practical capabilities, not merely checklist items.

Compliance implications for regulated and security-conscious businesses

The incident does not automatically establish a compliance violation for every customer. Compliance exposure depends on the organization, data involved, contractual obligations, control environment, and investigation findings. However, it reinforces the need to govern suppliers and cloud identities.

Healthcare organizations should connect Microsoft 365 access reviews, audit logging, backup testing, and incident response to HIPAA Security Rule safeguards and business associate responsibilities. Defense contractors and subcontractors should map identity, access control, incident response, and supply-chain practices to CMMC 2.0 and NIST SP 800-171. Organizations pursuing SOC 2 should maintain evidence for logical access, change management, vendor risk, monitoring, and recovery controls.

Financial institutions and covered businesses should evaluate relevant safeguards under the FTC Safeguards Rule. Payment environments should consider PCI DSS scope and whether Microsoft 365 accounts or connected applications can affect cardholder-data systems. NIST Cybersecurity Framework functions—Identify, Protect, Detect, Respond, and Recover—provide a useful structure for translating this event into an improvement plan.

How to evaluate an MSP after a third-party cloud incident

Property managers and other commercial buyers should assess providers on measurable capability rather than brand familiarity. Ask for the provider’s response SLA, escalation process, support hours, emergency coverage, Microsoft certifications, security certifications, and experience with organizations of comparable size and complexity.

Can the provider inventory and govern Microsoft 365 OAuth applications and service principals?
Does the provider deliver 24/7 SOC or MDR monitoring, and what events trigger human investigation?
Can the provider perform tenant-wide identity investigations and coordinate incident response?
How are Microsoft 365 backups isolated, retained, encrypted, and tested?
What happens if the backup vendor is unavailable, compromised, or unable to restore?
Which compliance frameworks does the provider support, including HIPAA, CMMC 2.0, NIST, SOC 2, FTC Safeguards Rule, or PCI DSS?
Are response times, restoration assistance, reporting, and executive communications defined in the contract?

For a small office, the work may involve a focused tenant review and application cleanup. For a regional property manager, manufacturer, healthcare group, or multi-site operator, it may require a phased identity assessment, backup redesign, tabletop exercise, and ongoing MDR coverage. The right project scope depends on tenant size, data sensitivity, building or site count, regulatory obligations, and recovery requirements.

Practical next steps for SMB and mid-market leaders

Start by identifying every Microsoft 365-connected backup, security, collaboration, and management application. Confirm its owner, permissions, business purpose, vendor contact, renewal status, and removal procedure. Next, validate that Microsoft 365 data can be restored independently of the primary production tenant and that recovery responsibilities are clear.

Finally, document a third-party access standard covering approval, least privilege, MFA, credential rotation, monitoring, offboarding, breach notification, and evidence preservation. Review the standard with the MSP, cybersecurity provider, legal team, cyber insurer, and relevant business owners. Manufacturer warranties and software support agreements should also be reviewed separately; security warranties rarely replace operational controls, tested backups, or a contractual incident-response commitment.

Frequently Asked Questions

How much does it cost to improve Microsoft 365 security after a cloud backup incident?

Cost depends on tenant size, number of applications, compliance requirements, logging coverage, backup architecture, and whether 24/7 MDR is needed. A provider may begin with a fixed-scope identity and application review, then recommend recurring monitoring, backup testing, or incident-response retainers. Buyers should request pricing tied to users, tenants, sites, response coverage, retention, and measurable SLAs rather than selecting solely by per-user cost.

Can Microsoft 365 backup prevent a supply-chain attack?

Backup cannot prevent compromise of a trusted application, but it can improve recovery after deletion, corruption, ransomware, or unauthorized changes. Protection depends on independent credentials, immutable or protected retention, separation from the production tenant, restricted administrative access, and tested restoration. A backup provider should explain how it limits vendor-side access and what happens if its management platform is unavailable.

What Microsoft 365 logs should an MSP monitor?

Monitoring should include Entra ID sign-ins, risky users and sign-ins, audit activity, application consent and service-principal changes, privileged-role assignments, mailbox forwarding and inbox rules, administrative actions, and relevant Microsoft 365 workload events. The MSP should define retention, alert severity, triage times, escalation contacts, and whether investigation is performed by a 24/7 SOC or an on-call team.

How does this incident relate to HIPAA, CMMC, NIST, and SOC 2?

The event highlights common control areas across these frameworks: vendor risk management, least privilege, identity protection, audit logging, incident response, backup and recovery, and evidence retention. It does not automatically prove a violation. Organizations should determine whether unauthorized access occurred, what data was exposed, what contracts apply, and whether their controls and documented response met applicable obligations.

What should be included in an MSP contract for Microsoft 365 incident response?

The contract should define monitoring scope, support hours, response and escalation SLAs, emergency contacts, log access, evidence preservation, containment authority, vendor coordination, user and credential remediation, executive reporting, and post-incident review. It should also clarify whether forensic services, legal coordination, cyber-insurance support, restoration assistance, and regulatory notification guidance are included or billed separately.

Should a business replace its Microsoft 365 backup provider after this incident?

Replacement should follow a documented risk assessment, not a headline alone. Evaluate the provider’s incident transparency, access controls, application permissions, security monitoring, backup isolation, restore testing, recovery commitments, and contractual liability. If risk remains unacceptable, migrate through a controlled project that preserves retention, validates restored data, maintains coverage during transition, and documents the final removal of legacy access.

Find a Qualified Managed IT & Cybersecurity Contractor

Need help acting on this? Browse managed IT & cybersecurity providers in your area, or explore managed IT services like preventative maintenance, inspections, and emergency response. Are you a contractor? List your business on My MSP Tech to reach IT and operations leaders actively searching for help.

Sources

Originally sourced from Cybersecurity Dive

Microsoft 365 securitymanaged cybersecuritycloud backupOAuth securitysupply chain riskMSP services