ConnectWise’s former SkyKick backup app was used to sign in to Microsoft 365 tenants. What IT providers and their clients should check

Someone has used the Microsoft 365 connections of a backup service that many IT providers install for their clients to sign in to those clients’ tenants, according to the security firm that first reported it.

The service is ConnectWise Cloud Backup, formerly SkyKick, which ConnectWise bought in 2024. It backs up Microsoft 365 data for managed service providers (MSPs), the IT firms that look after email and files for many small businesses. To do that, its apps are given broad access inside every tenant they’re connected to.

ConnectWise’s Trust Center advisory says it found “unauthorized access to application identities associated with ConnectWise Cloud Backup”. How the credential was exposed is still under investigation, and no one has publicly said who is behind the activity.

If an IT provider runs your Microsoft 365, this is worth a call to them today. Neither ConnectWise nor Huntress, the security firm that first reported the activity, has said whether Australian organisations were affected.

What happened

ConnectWise says it discovered the activity on 15 October 2026 (all times here are UTC, as ConnectWise and Huntress give them). Huntress says that on that day the app’s identity signed in to customer tenants from a hosting provider’s address and received Microsoft Graph access tokens. Normal traffic, it says, comes from Azure’s private address space. Huntress says the credential lived in the vendor’s own tenant: “Nothing a customer did in their environment could have produced it.”

Huntress reports that one of the related apps, Cloud Management for Microsoft Teams, gave itself the Global Administrator role in one customer tenant, then added new client secrets to two other apps there, an MSP management tool and Huntress’s own app. Huntress advises checking every app for secrets or certificates added since 13 October that you didn’t create. By 19:00 UTC on 16 October, it said it had confirmed unauthorised sign-ins in 162 tenants. In an update on 17 October, it said it had found almost 1,000 Microsoft Entra tenants with sign-in activity from the attacker’s address, more than 300 of them successful. Those figures are Huntress’s own; ConnectWise hasn’t published a count. ConnectWise says it has “not identified confirmed downstream customer compromise”, while adding that this is no assurance nothing happened.

What ConnectWise has done

ConnectWise first posted its advisory on 16 October. At 07:00 UTC on 17 October it disabled seven app identities and revoked the certificates they used, so the shared Cloud Backup credentials no longer work. It warns that “previously issued access tokens may remain usable until they expire”, and that disabling the apps doesn’t reverse changes already made inside a tenant.

Cloud Backup is suspended. ConnectWise says scheduled backups aren’t running, and archives and restores are unavailable. It has also taken SaaS Security and Cloud Management offline as a precaution. It has engaged outside forensic specialists and says it doesn’t yet have a restoration time.

ConnectWise says existing backup archives “remain encrypted and isolated” and it has no evidence they were accessed. That finding covers the stored archives only. ConnectWise says it can’t determine on its own whether a particular partner’s or customer’s live Microsoft 365 tenant saw unauthorised activity, which is why it is asking every tenant to be reviewed.

Who needs to act

The review falls to whoever administers each tenant: usually the MSP, sometimes an in-house IT person. ConnectWise’s technical guide says MSPs must check their own tenant and every customer tenant, including ones where a SkyKick connection is dormant, and that reviewing the MSP’s tenant “does not review the customer’s tenant”. Providers who resell the service are asked to pass the guide to each customer tenant’s administrator.

Older tenants may show the apps as “SkyKick Cloud Manager”, so the guide says to match them by Application ID rather than name. The main Cloud Backup app is 506e08f9-6e9a-4da4-942b-a099a03644ae; the guide lists all seven.

Huntress says to disable the apps and not delete them, and ConnectWise says not to delete them “as the first response”. Deleting loses the app’s configuration and evidence, and its consent. ConnectWise asks partners to keep the connections disabled until it gives reconnection instructions.

The logs won’t keep for long

ConnectWise’s guide notes that Entra normally keeps audit and sign-in records for seven days on its free tier and 30 days on P1 and P2 licences, and that “a license upgrade does not recover expired history”. Activity from 13 October onwards could start dropping out of free-tier logs from this week, on our reading of those retention periods. So exporting the logs now matters.

The guide says to review activity from 13 October 2026 onwards, and lists three addresses to search for: 144.172.64[.]128, 144.172.64[.]60 and 144.172.64[.]99. Neither a match nor a clean search settles the question on its own. Huntress says “a clean result does not rule out access”, and ConnectWise says a successful sign-in alone doesn’t show data was copied.

If your business relies on this service for Microsoft 365 backups, there is no backup running at the moment. ConnectWise suggests checking the last successful backup recovery point and assessing the gap while services are down. Our guide to backing up Microsoft 365 and Google Workspace data explains what Microsoft does and doesn’t keep for you.

Checklist

• Ask your IT provider whether your Microsoft 365 uses ConnectWise Cloud Backup, Cloud Management or SkyKick. Include connections nobody uses any more, since ConnectWise says dormant ones need checking too.
• Disable the apps in Microsoft Entra, but don’t delete them. In Enterprise applications, find each Application ID in ConnectWise’s guide, starting with 506e08f9-6e9a-4da4-942b-a099a03644ae, and set sign-in to No.
• Export the Entra audit and sign-in logs now. Free-tier records are normally kept for seven days, and a licence upgrade won’t bring back older history.
• Search the sign-in logs for 144.172.64.128, 144.172.64.60 and 144.172.64.99. Check service principal sign-ins as well as user sign-ins, from 13 October 2026.
• Remove admin roles and app credentials you didn’t grant, after recording them. Look especially for Global Administrator held by a ConnectWise or SkyKick app, and for app secrets or certificates added since 13 October.
• Check mailboxes for forwarding and inbox rules you didn’t set. ConnectWise also lists transport rules and delegated mailbox access.
• Confirm in writing who is reviewing each tenant. If a reseller supplied the service, make sure the guide reached the person who administers your tenant.
• Leave the apps disabled until ConnectWise publishes reconnection instructions. Meanwhile, check the date of your last successful backup so you know what isn’t protected.