A recent security breach involving ConnectWise Cloud Backup has put Microsoft 365 tenants at risk through a supply-chain attack. If you use ConnectWise Cloud Backup in your organization, you need to stop what you are doing and verify your Microsoft 365 environment for unauthorized access.
This is not a wait-and-see situation. Supply-chain attacks bypass your direct security measures by compromising a trusted third-party tool. The threat is already inside if you use the affected product.
What You Need to Do Right Now
If you currently use ConnectWise Cloud Backup, treat your Microsoft 365 tenant as potentially compromised until you can verify otherwise.
Start by reviewing your Microsoft 365 audit logs. Look for unusual sign-in activity, especially from unfamiliar locations or IP addresses. Check for newly created administrative accounts or changes to existing admin permissions that you did not authorize.
Review mailbox forwarding rules across all user accounts. Attackers often create hidden forwarding rules to copy emails to external addresses. This lets them monitor your communications without your knowledge.
Check for new application registrations or service principals in your Azure Active Directory. Unauthorized apps with high-level permissions are a common way attackers maintain access even after initial entry points are closed.
Look for changes to multi-factor authentication settings. Attackers may disable MFA for certain accounts or add their own authentication methods to accounts they want to control.
Understanding Supply-Chain Attacks
Supply-chain attacks target the software and services you trust. Instead of attacking your network directly, threat actors compromise a vendor's product that already has legitimate access to your systems.
ConnectWise Cloud Backup needs access to your Microsoft 365 data to perform its backup function. That legitimate access becomes an attack vector when the backup service itself is compromised.
This is why vendor security matters as much as your own. You can have perfect internal security practices, but if a trusted third-party tool is breached, attackers get a free pass through your defenses.
Steps for Recovery and Protection
If you find evidence of unauthorized access, isolate affected accounts immediately. Reset passwords for all administrative accounts and any compromised user accounts. Remove any unauthorized applications, service principals, or forwarding rules you discover.
Consider temporarily disabling the ConnectWise Cloud Backup connection until you can verify the security of the service and apply any available patches or updates from ConnectWise.
Review who has administrative access to your Microsoft 365 tenant. The principle of least privilege matters. Users should have only the permissions they need to do their work. Administrative accounts should be separate from daily-use accounts.
Enable comprehensive logging in Microsoft 365 if you have not already done so. You cannot investigate what you cannot see. Audit logs should be retained and monitored regularly, not just reviewed after an incident.
Implement conditional access policies that restrict administrative actions to specific locations or require additional verification steps. This makes it harder for attackers to use compromised credentials from unexpected locations.
The Backup Problem
This incident highlights a difficult reality about cloud backups. The service that protects your data from loss can also become a pathway for data theft or system compromise.
Backup services need broad permissions to access and copy your data. Those same permissions make them attractive targets for attackers. One compromised backup vendor can expose many customers at once.
This does not mean you should skip backups. It means you need to vet your backup providers carefully and monitor the access they have to your systems.
What This Means for Your Business
If you do not use ConnectWise Cloud Backup, this specific incident does not directly affect you. But the lesson applies to every third-party service you use.
Any software or service with access to your Microsoft 365 environment, email, or other critical systems represents potential risk. That risk must be weighed against the value the service provides.
Make a list of all third-party applications and services that have access to your Microsoft 365 tenant. Review their permissions. Remove any that are no longer needed or that have more access than their function requires.
Have a plan for responding to vendor security incidents before they happen. Know how to quickly audit your environment, revoke access, and verify whether a breach has affected your organization.
Practical Takeaway
Check your Microsoft 365 application permissions today, whether or not you use ConnectWise. Sign in to the Azure portal, review registered applications, and remove anything you do not recognize or no longer need. Security starts with knowing what has access to your systems.
Not sure your IT is as solid as it should be? Take 10 minutes and tell us about your setup. No pressure, no obligation.
Book a 10-Minute Discovery Call →Last updated: November 4, 2026
