ConnectWise cloud backup access: what should Microsoft 365 teams review?

TL;DR: ConnectWise is investigating unauthorized access tied to its Cloud Backup for Microsoft 365 service, with early community reports describing possible tenant access through the backup application's Microsoft Entra permissions, according to Coalition. The issue underscores how third-party backup access can create broad tenant-wide exposure when application credentials are abused.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “ConnectWise Investigating Unauthorized Access to Cloud Backup App”.

Key questions

Q: What should teams do first when a third-party backup app shows suspicious Microsoft Entra activity?

A: First, suspend the application if the activity matches known indicators, then preserve sign-in and audit logs before the retention window closes.

Q: Why do Microsoft 365 backup applications create elevated access risk?

A: They operate with tenant-wide application permissions and no human sign-in, which means the app itself becomes the trust boundary.

Q: What are the signs that backup application access may be abnormal?

A: Look for access outside the normal backup schedule, unusual source IPs, unfamiliar user agents, and bulk reads that do not match the provider's expected operating pattern.

Practitioner guidance

• Disable the backup application until remediation is confirmed In Microsoft Entra, suspend the enterprise application if suspicious activity matches the known indicators, then restore only after the provider confirms remediation and you have revalidated the tenant's access posture.
• Search for the published indicators across sign-in and audit logs Review Entra sign-in logs and the Microsoft 365 unified audit log for the listed app ID, source IP, and user agents, then preserve the evidence before retention expires.
• Validate unusual bulk access against the backup schedule Compare mailbox, SharePoint, and Teams access patterns with the service's normal backup windows so you can distinguish expected reads from out-of-pattern activity.

Bottom line: The incident shows how a cloud backup application can become a high-value non-human identity when it holds tenant-wide Microsoft 365 permissions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →