SkyKick breach: how to check your Microsoft 365 for ConnectWise apps

If you use Microsoft 365 for your business, check today whether any ConnectWise or SkyKick apps are connected to your account. A stolen credential for the ConnectWise Cloud Backup app (formerly SkyKick) was used to get into customer Microsoft 365 tenants this week. If you find these apps, set them so they can’t sign in, check their sign-in history, and remove any passwords (secrets) or admin roles added since October 13 that you didn’t create. This guide shows where to look in the Microsoft Entra admin center, what each finding means, and what to do if your IT provider manages Microsoft 365 for you.

What happened in the SkyKick breach

ConnectWise Cloud Backup, the Microsoft 365 backup service that used to be called SkyKick, connects to customer tenants through Microsoft “enterprise apps”. Each app gets permissions when someone consents to it, such as reading mailboxes for backups. According to Huntress, an attacker obtained a credential belonging to the Cloud Backup app and used it to request Microsoft Graph access tokens in customer tenants. Because the credential lives in the vendor’s own tenant, it works against every tenant that consented to the app. Multi-factor authentication on your own users doesn’t stop this kind of access.

Huntress reports token sign-ins from an attacker-controlled hosting IP on October 15, 2026, and unauthorized sign-ins confirmed in 162 tenants by October 16. In at least one tenant, a related ConnectWise Cloud Management app gave itself the Global Administrator role and added new secrets to other apps, which is a way to keep access later. Huntress says it saw sign-ins from the same IP in nearly 1,000 Microsoft Entra tenants, more than 300 of them successful.

ConnectWise says it disabled the affected application identities and, as of October 18, had suspended Cloud Backup, SaaS Security and Cloud Management while it investigates, The Register reported. ConnectWise also says existing backup archives remain encrypted and preserved, with no evidence they were accessed. It has asked customers and their IT providers to check their own Microsoft 365 environments, because it can’t see inside them.

Status, October 27: SecurityWeek reported that ConnectWise hadn’t given an estimated restoration timeline, and we found no later announcement that the services are back. Check ConnectWise’s own status page before you re-enable anything.

Does the SkyKick breach affect you?

You’re potentially exposed if any ConnectWise or SkyKick app appears in your tenant’s enterprise apps. Many small businesses don’t buy SkyKick directly: an IT provider (MSP) may have added it for backups or migrations years ago. So don’t rely on memory. Check.

• No ConnectWise or SkyKick apps listed: this incident’s stolen credential had nothing to use in your tenant. Huntress saw a second wave of attempts against tenants without the app, and those failed.
• Apps listed, and you use the backup service: follow all the steps below. Expect backups to stay paused until ConnectWise restores the service.
• Apps listed, but you don’t use them anymore: follow the steps, then remove the old consent (step 5).

Step 1: Find ConnectWise and SkyKick apps in Microsoft Entra

1. Sign in to the Microsoft Entra admin center with your admin account.
2. Go to Entra ID > Enterprise apps > All applications.
3. Search for ConnectWise, then for SkyKick. Older tenants may show names such as “SkyKick Cloud Manager”.
4. Make a note of every result. SpecterOps lists seven app names to look for, including ConnectWise Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the ConnectWise Cloud Management apps for Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online. You can paste an application ID into the search box.

Step 2: Stop the apps from signing in (disable, don’t delete)

Both Huntress and SpecterOps recommend disabling the apps rather than deleting them. Deleting removes the consent, so you’d have to set everything up again when the service returns. Disabling blocks new sign-ins in your tenant. Microsoft documents the steps in Disable user sign-in for an application:

1. Open the app from the search results.
2. Select Properties.
3. Set Enabled for users to sign-in? to No.
4. Select Save, and repeat for each ConnectWise or SkyKick app you can’t positively vouch for.

Two things to know: access tokens already issued can stay valid for up to 90 minutes after you disable the app, according to SpecterOps, and disabling the backup app pauses automated backups. Keep the apps disabled until ConnectWise confirms all its credentials have been reset.

Step 3: Check the apps’ sign-in logs

1. In the Entra admin center, go to Monitoring & health > Sign-in logs (shown as Monitoring > Sign-in logs in some layouts).
2. Open the Service principal sign-ins tab. App sign-ins don’t appear on the default user sign-ins tab.
3. Set the date range to include October 13, 2026 onward, and filter by the app’s name or application ID.
4. Look for sign-ins from IP addresses that aren’t Microsoft or Azure ranges. Huntress and SpecterOps both name the IP address 144.172.64.128, with the main token activity on October 15 between 06:13 and 08:34 UTC.

A clean result is reassuring but not proof. Huntress points out that reading directory data through Microsoft Graph doesn’t leave an audit trail, so some access can’t be ruled out either way.

Step 4: Look for new secrets and admin roles you didn’t add

This is the step most likely to be missed. In the tenant where a ConnectWise app made itself Global Administrator, it then added new client secrets to other apps. Those secrets keep working even after you disable the ConnectWise apps.

1. Go to Entra ID > App registrations > All applications and open each app, especially security, backup and management tools. Under Certificates & secrets, check for anything added since October 13 that you didn’t create. Delete unknown secrets.
2. Go to Entra ID > Roles & admins and open Global Administrator, Exchange Administrator and Privileged Authentication Administrator. If a ConnectWise or SkyKick app holds a role you didn’t grant on purpose, remove it after disabling the app.
3. In Monitoring & health > Audit logs, filter for activity such as “Add member to role” and “Update application – Certificates and secrets management” since October 13.

If you find unexplained changes, treat the tenant as compromised: bring in your IT provider or a security firm, and keep the logs.

Step 5: Remove apps you don’t need

If you no longer use SkyKick or ConnectWise Cloud Backup, SpecterOps recommends removing their consent from your tenant. Only do this once you’re sure no backups or migrations depend on them. It’s also a good moment to review every third-party app in Enterprise apps: a one-person business often collects connections from trials and old tools, and each one is a door into your mail and files.

If an IT provider manages your Microsoft 365

Send them a short message today asking three questions: Do you use ConnectWise Cloud Backup, SkyKick or ConnectWise Cloud Management for our tenant? Have you disabled those apps and checked the sign-in and audit logs? Did you find any secrets or roles added since October 13? Ask for a written answer. If they don’t use ConnectWise, you can stop there.

What you find	What it means	What to do
No ConnectWise or SkyKick apps	This incident had no app to abuse in your tenant	Nothing urgent; review third-party apps anyway
Apps present, sign-ins only from Microsoft IPs	No sign of this attack in the logs	Keep apps disabled until ConnectWise confirms the reset
Sign-ins from unknown IPs, or new secrets/roles	Possible compromise	Remove added secrets and roles, reset admin passwords, get expert help

FAQ

Is Microsoft 365 itself hacked?

No. Based on current reports, the problem is a stolen credential for a third-party vendor’s app. Microsoft 365 accepted it because customers had approved that app.

Are my existing ConnectWise backups safe?

ConnectWise says existing archives remain encrypted, isolated and preserved, with no evidence of unauthorized access. While the service is suspended you can’t back up, browse or restore, so check with ConnectWise or your IT provider about retention.

Will multi-factor authentication protect me?

Not against this route. The attacker used an app credential, not a user sign-in, so MFA on your account wasn’t involved. Keep MFA on anyway, since it blocks the far more common password attacks.

Next step

Set a reminder to review your enterprise apps every few months, the same way you’d review who has a key to your office. If you also use AI tools that connect to your Microsoft or Google account, our guide to keeping client data out of AI training covers the privacy side. And if you’re tightening up email security at the same time, see how SPF, DKIM and DMARC protect your domain.

Related guides

• Exchange OWA Not Working After October 2026 Update: Fix
• Two-Step Verification for Google and Microsoft Accounts
• Quest Diagnostics Data Breach: What Patients Should Do Now

Sources

• Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks (October 16, updated October 17, 2026)
• SpecterOps: ConnectWise SkyKick breach, how to check your Microsoft 365 tenant (October 17, 2026)
• The Register: ConnectWise turns off its backup, security and management services to probe security incident (October 19, 2026)
• Microsoft Learn: Disable user sign-in for an application