ConnectWise and Microsoft 365: third-party application identity risk in Entra ID
News date: 2026-10-21 · Last source review: 2026-10-23
In October 2026 Microsoft reported malicious activity abusing ConnectWise application identities to access Microsoft 365 customer environments. The central issue was not a stolen everyday user password, but existing third-party application permissions and authentication material used to access customer tenants.
What did Microsoft confirm?
Microsoft attributes the activity to Storm-0940 and describes highly automated cross-tenant operations. Some environments showed suspicious Microsoft Graph access, app credential changes and attempted privilege changes. The presence of an affected application or even a successful service-principal authentication does not by itself establish data theft; investigators must correlate subsequent activity.
- Review service-principal as well as user sign-ins
- Inspect unexpected app credential and role changes
Why does OAuth application consent matter?
Backup and SaaS management integrations may hold permissions over Microsoft Graph, Exchange Online, SharePoint or Teams. If the vendor application identity is compromised, attackers can misuse permissions the tenant has already approved. User MFA remains important but does not eliminate app-only access risk.
- Inventory enterprise applications and consent grants
- Apply least privilege and repeat permission reviews
Immediate Microsoft 365 checks
Organizations using or previously using affected ConnectWise applications should follow current vendor and Microsoft advisories. Preserve audit evidence before irreversible changes. Review service-principal authentications, certificates/secrets, app-role and directory-role assignments, Graph calls and unusual consent grants, while accounting for log retention and coverage. Deleting the application is not necessarily the right first step.
- Audit application permissions and grants
- Investigate dormant integrations
- Correlate IP, timestamp, Graph actions and privileged changes
Long-term controls
Establish a lifecycle for non-human identities: ownership, least privilege, admin consent restrictions, credential rotation, logging and a tested process to revoke access. Third-party application identities should be governed as part of the organizational software supply chain.
VALUE360 supports Entra enterprise application reviews, Conditional Access and Microsoft 365 audit readiness.
Explore the related VALUE360 service →
Technical references
Microsoft 365 environment review
Inventory Entra ID policies, user and application permissions, audit logs and exceptions. Pilot changes with a limited group, validate access impact and define a rollback path.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.