Topic starter
24/10/2026 9:48 pm
TL;DR: Cloud backup access tied to ConnectWise’s Microsoft 365 service may have allowed tenant-level reach through Microsoft Entra permissions, according to Coalition. Third-party backup apps can become privileged non-human identities, so approval, monitoring, and revocation need tight customer control.
Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “ConnectWise Investigating Unauthorized Access to Cloud Backup App”.
Key questions
Q: Why do Microsoft 365 backup applications create elevated access risk?
A: They operate with tenant-wide application permissions and no human sign-in, which means the app itself becomes the trust boundary.
Q: What are the signs that backup application access may be abnormal?
A: Look for access outside the normal backup schedule, unusual source IPs, unfamiliar user agents, and bulk reads that do not match the provider's expected operating pattern.
Q: What should teams do first when a third-party backup app shows suspicious Microsoft Entra activity?
A: First, suspend the application if the activity matches known indicators, then preserve sign-in and audit logs before the retention window closes.
Practitioner guidance
- Disable the backup application until remediation is confirmed In Microsoft Entra, suspend the enterprise application if suspicious activity matches the known indicators, then restore only after the provider confirms remediation and you have revalidated the tenant's access posture.
- Search for the published indicators across sign-in and audit logs Review Entra sign-in logs and the Microsoft 365 unified audit log for the listed app ID, source IP, and user agents, then preserve the evidence before retention expires.
- Validate unusual bulk access against the backup schedule Compare mailbox, SharePoint, and Teams access patterns with the service's normal backup windows so you can distinguish expected reads from out-of-pattern activity.
Bottom line: The incident shows how a cloud backup application can become a high-value non-human identity when it holds tenant-wide Microsoft 365 permissions.
Glossary terms: Third-Party NHI, Application Identity, Identity Blast Radius, Tenant-Wide Application Permission
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Third-party backup applications are privileged non-human identities, not routine SaaS add-ons. The important governance fact is that they authenticate at the application layer and often hold tenant-wide read scope by design. That means their security posture belongs in NHI governance, not in a general procurement checklist. Practitioners should treat them as privileged identities with explicit ownership, review, and revocation paths.
A question worth separating out:
Q: Who is accountable for third-party application access in Microsoft 365 tenants?
A: The customer remains accountable for what external applications can reach its tenant, even when an MSP or vendor operates the service. That means approval, review, suspension, and revocation need an explicit owner and a documented lifecycle. Shared operation does not remove the need for clear governance over the application identity.
👉 Read our full editorial: ConnectWise cloud backup access exposes Microsoft 365 tenant risk
This post was modified 6 days ago by NHI Mgmt Group