ConnectWise Backup: What Should Tenants Check?
By Chuck Lerch, Founder and CEO, Cyberuptive ·
Keep affected ConnectWise application connections disabled pending vendor restoration instructions and review each connected Microsoft 365 tenant. ConnectWise’s October 18 update says disabling its applications does not reverse earlier tenant changes, and issued tokens may remain usable until invalidated or expired (ConnectWise October 18 update). Preserve records, inspect other identities, and assess the backup interruption.
ConnectWise disclosed unauthorized access to Cloud Backup application identities on October 17, 2026, following Huntress reporting of abused vendor credentials and unauthorized Microsoft 365 authentication (ConnectWise October 18 update) (Huntress investigation). This article reflects information available by October 18. Findings about stored backup archives must be distinguished from possible activity inside live customer tenants.
What are the key takeaways?
- The legitimate application’s credential was abused; this is not simply an employee password-reset problem (Huntress investigation).
- ConnectWise’s containment does not automatically remove separate access established inside a tenant (ConnectWise October 18 update).
- Review dormant SkyKick connections as well as current ConnectWise deployments (ConnectWise October 18 update).
- Cloud Backup service interruption affects recovery planning separately from compromise assessment (ConnectWise October 18 update).
What did ConnectWise confirm by October 18?
ConnectWise reported that it disabled affected application identities and revoked certificates used for their connections (ConnectWise October 18 update). Its October 18 update says Cloud Backup remained suspended, with scheduled backups, affected archive access, and restoration unavailable (ConnectWise October 18 update).
The vendor said existing archives remained encrypted, isolated, and preserved, with no evidence that those archives had been accessed (ConnectWise October 18 update). It also said its own visibility could not independently determine whether an individual downstream Microsoft 365 tenant experienced unauthorized activity (ConnectWise October 18 update). Do not turn an archive statement into a tenant-wide assurance.
Which identity should tenant owners look for?
Start by matching the application identifier rather than its display name. Huntress identifies ConnectWise Cloud Backup, formerly SkyKick, with application ID 506e08f9-6e9a-4da4-942b-a099a03644ae (Huntress investigation). ConnectWise’s advisory lists additional affected application identities and warns that older installations may use SkyKick names (ConnectWise October 18 update).
Use the full vendor list to scope the review. Record each local object identifier and connection state; do not assume that two similarly named enterprise applications are the same identity. Preserve configuration before taking cleanup actions that could remove useful investigation context (ConnectWise October 18 update).
| Review area | Question to answer |
|---|---|
| Application authentication | Were successful or failed sign-ins expected? |
| Credentials and permissions | Were secrets, certificates, owners, grants, or roles changed? |
| Mailbox and resource activity | Were forwarding, delegation, rules, or data-access patterns altered? |
| Recovery protection | What is the last successful backup and current protection gap? |
What should the response team do first?
Follow the vendor’s containment guidance while preserving available evidence. ConnectWise advises reviewing each managed customer tenant, including dormant connections, and keeping affected applications disabled until restoration instructions are provided (ConnectWise October 18 update).
- Preserve sign-in and audit records. ConnectWise recommends promptly collecting available Microsoft Entra and other relevant Microsoft 365 audit evidence while taking urgent containment action (ConnectWise October 18 update).
- Review authentication history. The October 18 workflow starts at October 13 and extends back to October 1 where records exist (ConnectWise October 18 update). Document actual log coverage rather than assuming it is complete.
- Inspect identity changes. Review application credentials, owners, permission grants, directory roles, federation trusts, and changes to other identities (ConnectWise October 18 update).
- Check resource-level changes. Review mailbox forwarding, inbox and transport rules, delegation, and other relevant workload audit activity (ConnectWise October 18 update).
- Track recovery constraints. Record the last successful backup, unavailable restoration paths, and approved interim protection arrangements. Do not reconnect through an improvised workaround.
Why is disabling the original application not enough?
The October 18 advisory says issued tokens may remain usable until expiry or invalidation and that separate unauthorized credentials or permissions require additional remediation (ConnectWise October 18 update). Huntress also reported tenant audit evidence involving changes to other application identities (Huntress investigation).
This makes the investigation broader than one service-principal sign-in query. A service principal is the local identity representing an application in the tenant. Review what that identity changed and whether any newly established access remains, while distinguishing confirmed changes from incomplete or ambiguous logs.
ConnectWise cautions that a successful sign-in does not prove data was copied and that a clean search cannot exclude activity outside available logs (ConnectWise October 18 update). Record both findings and uncertainty in the case notes. Avoid declaring a tenant clean solely because the original connection is now disabled.
How would our SOC handle the tenant review?
Our U.S.-based security operations center (SOC) would coordinate the application inventory, evidence preservation, and investigation with the tenant owner. We would separately track the backup protection gap so restoration planning does not get lost inside the identity incident.
Use Microsoft 365 security support, the emergency administrator access guide, and the SOC pricing guide to clarify who investigates changes and who authorizes tenant remediation.
What else should buyers and operators know?
Does preserved backup data mean a tenant is unaffected?
No. ConnectWise distinguishes stored archives from live Microsoft 365 tenant activity and says its downstream visibility is limited (ConnectWise October 18 update).
Should dormant SkyKick connections be checked?
Yes. The October 18 advisory specifically includes dormant connections in the recommended tenant review (ConnectWise October 18 update).
Does revoking the vendor certificate undo tenant changes?
No. ConnectWise says earlier changes and separate access paths require review, and issued tokens may remain usable until expiry or invalidation (ConnectWise October 18 update).
Should affected applications be reconnected immediately?
The October 18 guidance says to keep them disabled until ConnectWise provides restoration instructions (ConnectWise October 18 update). This article does not incorporate later restoration updates.
What is the next step for your organization?
Bring your scope, current evidence, and unresolved responsibilities to a focused discussion. Schedule a security review or Call 833-92-CYBER to clarify the next practical actions.