A recently reported security incident involving ConnectWise Cloud Backup has brought renewed attention to the importance of managing third-party application access within Microsoft 365 environments.
The incident involved unauthorized access associated with application identities used by ConnectWise Cloud Backup, formerly SkyKick Cloud Backup. As part of its response, ConnectWise temporarily disabled access to Cloud Backup and subsequently took its SaaS Security and Cloud Management services offline as additional precautionary measures.
As of October 20, 2026, service disruptions were continuing while investigation and remediation efforts remained underway. ConnectWise indicated that existing backup archives remained encrypted, isolated, and preserved. However, the company also emphasized that protecting stored backup data does not necessarily establish the security status of connected Microsoft 365 environments.
For managed service providers (MSPs), the incident offers an opportunity to review established security practices, strengthen oversight of cloud integrations, and ensure that client environments remain protected.
Here are seven security priorities MSPs should consider.
1. Review Third-Party Application Permissions
Third-party applications are essential to modern MSP operations, supporting everything from cloud backup and monitoring to security management and automation.
These integrations frequently require access to Microsoft 365 environments through application permissions. Over time, however, permissions may remain active even when operational requirements change.
The ConnectWise incident highlights the importance of understanding how these application relationships function and ensuring that access remains appropriate.
MSP Action: Conduct regular reviews of enterprise applications and service principals across managed Microsoft 365 tenants. Identify unnecessary permissions, confirm business requirements, and review inactive or legacy integrations, including dormant SkyKick connections, in accordance with current vendor guidance.
2. Strengthen Microsoft Entra ID Monitoring
Microsoft Entra ID provides identity and access management capabilities that help organizations control access to cloud resources.
The reported incident included suspicious application authentication activity, demonstrating why MSPs should monitor application identities alongside traditional user accounts.
Unlike conventional user sign-ins, application-based authentication can occur without direct user interaction, making visibility into these activities particularly important.
MSP Action: Review service principal sign-in logs, monitor unusual authentication patterns, and configure alerts for unexpected application activity or privileged role changes. Incorporate current ConnectWise and Microsoft security guidance into monitoring procedures, including relevant indicators of compromise.
3. Reinforce Least-Privilege Access
Least-privilege access remains a fundamental security principle for Microsoft 365 environments.
Applications sometimes require extensive permissions to deliver their intended functionality. However, reviewing those permissions regularly can help organizations maintain an appropriate balance between operational efficiency and security.
The incident reinforces the value of understanding which applications have administrative capabilities and whether those permissions remain necessary.
MSP Action: Evaluate third-party application permissions against actual operational needs. Limit unnecessary privileges, document approved access, and periodically reassess administrative permissions across client environments.
4. Review Application Credentials and Access Changes
Cloud applications frequently use credentials, certificates, and service principals to authenticate and communicate with connected systems.
Managing these credentials is an important component of maintaining secure Microsoft 365 integrations.
The reported activity associated with the incident included unauthorized application authentication and attempts to establish elevated access. Security researchers also identified activity involving the addition of credentials to other applications in certain affected environments.
Importantly, ConnectWise advised that disabling affected application connections prevents new connections but does not automatically reverse changes previously made within a Microsoft 365 tenant.
For MSPs, this distinction underscores the importance of examining both current access and historical activity.
MSP Action: Review application credentials, certificates, privileged role assignments, and recent permission changes. Investigate unexpected modifications and verify that unauthorized changes have been addressed. Follow current vendor guidance when disabling affected applications and determining when access can safely be restored.
5. Maintain Coordinated Incident Response Procedures
Security incidents involving technology providers can require coordination among vendors, MSPs, security teams, and affected customers.
During the ConnectWise incident, temporary restrictions on application access were part of the response while the situation was investigated.
For MSPs, having established procedures for evaluating vendor notifications and determining potential client impact can help maintain an organized response.
Clear communication is equally important, particularly when investigations are ongoing and information may change.
MSP Action: Maintain documented incident response procedures that address vendor notifications, client assessments, evidence preservation, internal escalation, remediation, and customer communication. Establish responsibilities in advance and update response plans as new guidance becomes available.
6. Verify Backup Continuity and Recovery Readiness
Cloud backup services play an important role in helping MSPs protect customer information and support business continuity.
ConnectWise indicated that existing backup archives remained encrypted, isolated, and preserved, although access to certain cloud services was temporarily restricted during its response.
The continuing service disruptions illustrate why MSPs should understand how interruptions may affect backup operations, even when previously stored backup data remains intact.
It is also important to distinguish the condition of stored backup archives from the security of connected Microsoft 365 environments, which may require separate investigation.
Regular recovery assessments can help MSPs maintain confidence in their ability to support customers during unexpected disruptions.
MSP Action: Review backup status, retention policies, recovery procedures, and service dependencies. Validate restoration capabilities where appropriate, assess the operational impact of temporary service restrictions, and communicate confirmed limitations to affected clients.
7. Make Third-Party Security Reviews an Ongoing Priority
MSPs rely on relationships with technology vendors to deliver reliable, efficient, and scalable services.
These partnerships remain central to the managed services business model, making ongoing security coordination and visibility increasingly important.
The ConnectWise incident serves as a reminder that cloud integrations, delegated permissions, and application identities should be included in regular security assessments.
A consistent review process can help MSPs identify opportunities to strengthen existing safeguards while maintaining productive vendor relationships.
MSP Action: Establish recurring third-party security reviews covering application permissions, credential management, vendor advisories, incident response coordination, and business continuity planning. Document findings and prioritize improvements based on client requirements and operational risk.
Strengthening MSP Security Through Proactive Oversight
The ConnectWise Cloud Backup incident highlights several important considerations for MSPs responsible for protecting Microsoft 365 environments.
It also demonstrates the importance of distinguishing between confirmed findings, potential exposure, and ongoing investigations when evaluating security events.
For MSPs, the most valuable response is to remain informed, follow applicable vendor guidance, and review existing security practices to identify areas for improvement.
By strengthening application oversight, maintaining effective identity monitoring, validating recovery readiness, and coordinating closely with technology partners, MSPs can continue building more resilient client environments.
Ultimately, the focus is on maintaining strong security practices, supporting trusted vendor relationships, and helping customers navigate an increasingly interconnected technology landscape.