--- title: The Key Your IT Provider Holds: One Compromised App Credential, 173 Microsoft 365 Tenants - Capstone Technologies Group description: A compromised backup app credential was used to sign in to 173 Microsoft 365 tenants with no password or MFA. Five questions for the IT provider running yours. canonical_url: https://captechgroup.com/resources/blog/the-key-your-it-provider-holds-microsoft-365-app-credential language: en-GB date: 2026-10-22T01:09:51Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/the-key-your-it-provider-holds-microsoft-365-app-credential. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2419 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/the-key-your-it-provider-holds-microsoft-365-app-credential. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. On the morning of October 15, something signed in to 173 Microsoft 365 tenants in just over two hours. It never typed a password or answered a multi-factor prompt. It held the credential for ConnectWise Cloud Backup, formerly sold as SkyKick, a backup app IT providers install into their clients' Microsoft 365 to copy mail and files around the clock. Whoever holds that credential inherits the app's access in every tenant where it is installed. Huntress, which confirmed the sign-ins, saw them come from one address, a few seconds apart in sorted order, the pattern of a script working down a list. Nobody has publicly named who did it. Huntress calls the operators unknown, ConnectWise has confirmed unauthorized access to its application identities, and Microsoft is treating it as an active supply chain attack. For a firm whose Microsoft 365 is run by an IT provider, the useful question is what kind of access made this possible, because managed tenants commonly carry the same kind for backup, security and management tools. ## Why multi-factor never came up Most of the security a small firm pays for watches people signing in: multi-factor authentication, password rules, conditional access, sign-in alerts. A backup app is a different kind of identity. An administrator approved it once, and Microsoft gave it standing permissions. From then on it signs itself in, machine to machine, and those sign-ins land on a separate tab, service principal sign-ins, that the default view in the Microsoft Entra admin center does not show. So the usual reflexes do not reach it. A password reset means nothing to an app that never used one, and revoking user sessions means nothing when no user session exists. Even disabling the app leaves the tokens it already holds working for up to 90 minutes. The same address had tried password spraying against four law firm tenants on October 13 and 14, with no successful sign-ins that Huntress could see. The next day, holding the app's credential, it signed in to 173 tenants. ## What that access reached A backup app needs broad consent because its job is to copy everything. Todyl's analysis says the token carried read and write access to mail and attachments, OneDrive and SharePoint files, and Teams chats, plus the ability to restore data into the tenant. Microsoft says the abused permissions likely included Directory.ReadWrite.All, which lets the holder change users and groups. The attacker also tried to add new credentials to the app, a way back in. In at least one IT provider's own tenant, Huntress found a second ConnectWise app making itself a Global Administrator, then planting secrets in a management tool and a security platform that providers install across their client base. For a medical or dental practice, a law office or an accounting firm, that covers most of the practice: patient and client correspondence, shared files, tax records, payroll, and the chat threads staff assume nobody reads. Write access matters as much as read access. Someone who can drop a message into a thread your bookkeeper already trusts is one step from a fraudulent change of bank details. Firms using the app also lost that backup while ConnectWise investigates. The harder problem for a regulated firm is proof. Directory reads through Microsoft Graph leave no entry in the standard audit trail, so a quiet log does not show that nothing was read, and Huntress advises treating exposure as likely. Notification duties typically stay with you even when the breach started at a vendor. Under HIPAA, an IT provider that can access patient information is commonly a business associate, and the business associate agreement is where breach notification between you belongs. The FTC's Safeguards Rule, which reaches tax preparers and many accounting firms, expects you to oversee service providers through contract terms and periodic review. Lawyers' conduct rules, in Ohio and most states, are commonly read to require reasonable supervision of vendors who handle client information. And Ohio's Data Protection Act may offer an affirmative defense in some breach lawsuits to a business with a written cybersecurity program that reasonably conforms to a recognized framework. Those frameworks typically cover vendor risk. ## Five questions for whoever manages your tenant Capstone is a managed provider too, so treat these as questions any client should be able to put to any provider, us included. A good answer is a document, not a reassurance. 1. Which third-party apps have standing consent in our Microsoft 365, what can each one read or change, and who approved it? Get the list in writing, and require an administrator's sign-off for new consents. 2. Which of your staff and tools hold administrative access to our tenant? Delegated admin relationships and app credentials should each be cut to the narrowest role that still works. 3. Are service principal sign-ins and Microsoft Graph activity logs captured and kept long enough to investigate? Without Graph activity logging there is no record of what an app read, only that it signed in. 4. Who would notice? An app signing in from somewhere it never does, a new secret added to an app, or an app granting itself an admin role should alert someone, the same as a suspicious user sign-in. 5. What does our contract say when the breach starts at one of your vendors? Look for who notifies your clients or patients, who pays for forensics, whether a business associate agreement is signed where HIPAA applies, and whether you can see which apps are consented into your tenant. Many IT agreements were written around uptime and say little about this. The technical breakdown, including the logs and filters an IT team should be checking back to October 13, is in our [Threat Intelligence Center write-up](https://captechgroup.com/threat-intelligence-center/unc7017-uses-compromised-connectwise-credential-to-e90117). If the first question does not get a straight answer, a [security assessment](https://captechgroup.com/security-assessment) will produce that inventory, with the evidence behind it. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-10-22T01:09:51Z", "datePublished": "2026-10-22T01:09:51Z", "description": "A compromised backup app credential was used to sign in to 173 Microsoft 365 tenants with no password or MFA. Five questions for the IT provider running yours.", "headline": "The Key Your IT Provider Holds: One Compromised App Credential, 173 Microsoft 365 Tenants", "image": [ { "@type": "ImageObject", "url": "https:\/\/images.captechgroup.com\/Blog\/vendor-app-credential-key-cabinet-server-closet.webp", "caption": "", "description": "Open steel key cabinet with rows of brass keys in a dim server closet, a rack's green status lights out of focus behind it", "width": 1200, "height": 628 } ], "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/the-key-your-it-provider-holds-microsoft-365-app-credential" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/the-key-your-it-provider-holds-microsoft-365-app-credential" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```