ConnectWise has said it disabled seven application identities while investigating a security incident in which unknown attackers obtained unauthorised access to those identities and compromised Microsoft 365 tenants. One of the affected identities is linked to ConnectWise Cloud Backup, a detail that raises immediate concerns for managed service providers and businesses using third-party tools to access Microsoft 365 data and services.

What happened

According to ConnectWise, attackers gained access to several ConnectWise application identities and used that access in activity affecting Microsoft 365 tenants. The company said it disabled seven identities as part of its response. Based on the available information, ConnectWise has publicly confirmed the unauthorised access and the suspension of affected identities, but the full scope, attack path and customer impact have not yet been publicly detailed.

Application identities are typically used by software services to authenticate to cloud platforms and perform automated actions without a human user signing in each time. In practice, they can have broad permissions across customer environments if not tightly restricted. When compromised, they may allow attackers to access data, change settings or interfere with backup and administrative operations.

Why it matters for European businesses

This incident is relevant beyond ConnectWise customers because it highlights a recurring risk in cloud and SaaS environments: trusted third-party integrations can become high-value attack paths into Microsoft 365. Many European businesses, especially SMEs, rely on managed service providers, backup tools and automation platforms that use application identities with persistent access to email, files, user accounts and security settings.

If a third-party application identity is compromised, the impact can extend across multiple customer tenants at once. That creates operational, security and compliance concerns, particularly for organisations that depend on Microsoft 365 for email, document storage, collaboration and identity-linked business processes.

For regulated businesses, the issue may also affect incident response, auditability and reporting obligations. The exact legal implications depend on what data or systems were accessed and on the organisation's sector and jurisdiction. Companies should avoid assuming that a vendor-side incident has no compliance consequences for the customer environment.

Who may be affected

• ConnectWise customers, especially those using Cloud Backup or other affected integrations
• Managed service providers and IT partners administering Microsoft 365 environments for clients
• SMEs using Microsoft 365 for email, collaboration, file storage and identity-based workflows
• Organisations with multiple SaaS integrations that rely on app-to-app permissions rather than direct user access
• Regulated organisations that need to document third-party access to business data and cloud infrastructure

What companies should consider

• Review enterprise application access in Microsoft 365 and Entra ID. Check which third-party apps have tenant-wide permissions, especially for mailboxes, SharePoint, OneDrive, backup and admin functions.
• Identify whether any affected ConnectWise application identities are present in your environment. If yes, verify current status, review vendor guidance and assess whether any temporary service disruption affects backup or recovery operations.
• Audit privileged app permissions. Reduce unnecessary scopes and remove integrations that are no longer needed. App identities often accumulate broad access over time.
• Review sign-in and audit logs. Look for unusual consent grants, unexpected application activity, suspicious mailbox access or changes to backup and retention settings.
• Validate backup resilience. If cloud backup services were interrupted, confirm that recovery points remain intact and that alternative backup or continuity measures are available.
• Confirm your third-party incident process. Ensure internal teams know how to respond when a supplier disables integrations that support core business systems such as email or data protection.
• Ask vendors about containment and monitoring. Businesses and service providers should seek clear information on what was affected, what indicators of compromise are available and what customer-side checks are recommended.

For European businesses, the broader lesson is that identity security is no longer limited to employee accounts. Service principals, application identities and SaaS-to-SaaS connections can carry extensive privileges and should be monitored with the same seriousness as administrator credentials.