On October 15, attackers used a stolen credential from the ConnectWise Cloud Backup application, formerly SkyKick, to access customer tenants. Huntress observed sign-in activity from the attacker's IP across almost 1,000 Entra tenants, with more than 300 successful sign-ins.
The decisive access was app-only. No user interaction was required, so user MFA never entered the picture.
Most coverage frames this as a supply chain story. I see it as an architecture story.
A backup service needs broad read and write access across core Microsoft 365 data by design. That effectively makes it a tier-0 identity. Yet in many threat models I've reviewed, integrations like these still sit under "third-party integration," alongside far less privileged applications.
And permissions can survive long after the business need disappears. Todyl found successful application sign-ins even in tenants that no longer had an active backup subscription. Consent can outlive the service it was granted for.
There was also a second-order effect. Once Cloud Backup was shut down for containment, scheduled backups, archive access, and restores became unavailable too.
The same trusted integration that enabled backup and restore also became the path into the tenant.
Inventory application consents the way you inventory administrators. Remove dormant ones. Limit credential lifetimes where you control them. Apply workload identity controls where supported, and enforce least-privilege consent for third-party applications.
That's one of the first reviews I'd run in any environment I architect next.
Which application in your tenant can write to almost everything, and when was the last time anyone asked whether it still should?