What happened

A trusted application identity became the concern

ConnectWise says it found unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. It disabled seven affected application connections on 17 October and suspended Cloud Backup. SaaS Security and Cloud Management also remain offline as a precaution. Scheduled backups, archive access and restores are unavailable while the company works through remediation and validation.

The vendor says existing backup archives remain encrypted and preserved, with no indication that those archives were compromised. That finding is about stored backups. It is not a finding that connected Microsoft 365 tenants were untouched. ConnectWise explicitly says each potentially affected partner and customer tenant needs its own review.

Do not confuse the two findings

A disabled vendor connection can prevent new authentication through that connection. It cannot undo a permission change, a new credential, or another access path that may have been established earlier inside a tenant.

Defender workflow

Start with the application IDs, then follow the changes

  1. 1

    Identify the right applications. Use the application IDs in ConnectWise's technical guide, not display names alone. Check the local enterprise-application state in the MSP tenant and each managed customer tenant; a vendor-side disablement is not proof of a local setting.

  2. 2

    Preserve and review identity evidence. Export available Entra service-principal sign-ins and audit logs promptly. Review activity from 13 October onward, extending earlier where records permit. Look beyond the published IP addresses: investigate unusual source networks, resources and successful operations.

  3. 3

    Trace possible persistence. Review new application credentials, consent grants, role assignments, policy changes and mailbox forwarding or delegation. If a listed application changed another identity, follow that second identity too.

Defender note

Containment and confidence are separate workstreams

Record what was checked, which logs were actually available and which tenants could not be fully assessed. A clean search is only as strong as its coverage. Likewise, a successful sign-in is a lead for investigation, not proof that data was copied. Keep the affected applications disabled until ConnectWise provides formal restoration instructions, and plan around the temporary loss of backup and security-service functions.