ConnectWise Disables Application Identities Following Targeted Exploitation of Microsoft 365 Environments

ConnectWise, a leading provider of software for managed service providers (MSPs), has taken the significant step of disabling several application identities and suspending key services following an investigation into a sophisticated cyberattack. The incident, which involved unknown threat actors obtaining unauthorized access to application identities, has resulted in the compromise of multiple Microsoft 365 tenants belonging to ConnectWise customers.

The company announced on Saturday that it had disabled seven specific ConnectWise application identities as part of its ongoing mitigation strategy. This move, executed on October 17, 2026, at 07:00 UTC, was accompanied by the suspension of the ConnectWise Cloud Backup service. To ensure the security of its ecosystem, the company revoked certificates used for affected application connections across its entire user base.

According to the company’s security advisory, disabling these connections prevents new authentication attempts through the compromised identities. However, the company was careful to note that this action does not automatically reverse any malicious changes previously made within a customer’s tenant. The credentials associated with the shared Cloud Backup service are no longer valid, though previously issued access tokens may remain functional until they naturally expire or are manually invalidated by administrators.

The fallout of these defensive measures is significant for daily operations. ConnectWise confirmed that scheduled backups are currently not running, and access to backup archives and restoration capabilities is temporarily unavailable for affected users. Despite this disruption, the company emphasized that existing archives remain encrypted, isolated, and preserved. There is currently no evidence to suggest that the archives themselves were breached or that the attackers gained access to the stored data.

As a further precaution, ConnectWise has temporarily taken its SaaS Security and Cloud Management platforms offline. This "abundance of caution" approach allows the firm to complete a comprehensive review of the incident and ensure that no lingering vulnerabilities remain before restoring service.

The issue was first identified on October 14, 2026, through what ConnectWise described as advanced cybersecurity monitoring and internal diligence. The discovery prompted the immediate activation of both internal and external incident response teams. While the company stated that it has not observed further successful threat activity in the environments it directly monitors since implementing these mitigations, it acknowledged a blind spot regarding downstream customer environments, which are designed to be isolated from ConnectWise’s direct observation.

The Mechanics of Application Identity Compromise

The nature of this attack highlights a growing trend in the threat landscape where attackers move away from targeting individual user passwords and instead focus on the "identities" of the applications themselves. This method is particularly dangerous because it bypasses many traditional security hurdles.

In a typical environment, a management application like ConnectWise requires extensive permissions to perform its duties, such as backing up mailboxes, managing SharePoint documents, or overseeing Microsoft Teams communications. These permissions are granted through application identities—essentially non-human accounts—registered within Microsoft Entra ID (formerly Azure Active Directory).