The Vendor's Secret Is Your Breach

The most dangerous credential in your Microsoft 365 tenant may belong to a vendor instead of a user.

173 tenants and no user passwords

Huntress confirmed unauthorized sign-ins to 173 Microsoft 365 tenants after a credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised, as iTnews reported. MSPs install this kind of app to protect their clients' Microsoft 365 data, and to do its job it gets broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Because the attacker signed in as the app, there was no user to challenge, so MFA and risky sign-in detection had nothing to evaluate. Nothing in those tenants was misconfigured by the customer.

The pattern matters more than the vendor

A backup, migration, or management app gets consented once, often years ago, with permissions broad enough to read and write nearly everything. Nobody reviews that consent again, because the app works and the vendor is trusted. Then the vendor's credential is compromised, and every tenant that consented inherits the exposure. Huntress also observed a second ConnectWise app assign itself the Global Administrator role in at least one tenant and add secrets to other trusted apps, and ConnectWise has said that disabling its apps does not reverse changes already made inside a tenant. So "revoke and move on" is not a plan.

Do the inventory

List every enterprise application in your Entra tenant, who consented to it, what permissions it holds, and when anyone last reviewed it. Pay particular attention to anything with directory-wide write access. Then check service principal sign-ins for unrecognized IP addresses, and look for credentials added or roles assigned since mid October. The investigation is ongoing and sources differ slightly on timing, so check the current Microsoft and Huntress advisories before acting on specifics.

What to do

How many third-party apps in your Entra tenant have permissions you could not justify in a sentence today?