Vendor App Breaches: Where Privileged Access Management Limits the Damage

What the October Microsoft 365 backup-app breach did to client tenants, what PAM would and wouldn't have changed, and what to check this week.

By Levi Rose, Senior Marketing Director, CyberQP. 19 October 2026.

An attacker who holds a vendor app's secret doesn't need a password, an MFA prompt or a user. Between 13 and 15 October, someone used the Microsoft 365 credential for ConnectWise Cloud Backup (formerly SkyKick) to sign in as the app itself, and that app already had broad access to mail, files and the directory in every client tenant that had installed it.

What One App Secret Reached

Huntress confirmed unauthorized sign-ins in more than 160 tenants by 16 October. In about 50 tenants it watches, the vendor's Cloud Management apps gave themselves admin roles, mostly Exchange Administrator. In one, the Teams app made itself Global Administrator, then added secrets to an MSP management app and to Huntress's own app, all within five minutes. Microsoft called it an active supply-chain attack, as BleepingComputer reported. ConnectWise disabled the apps, reports no evidence that backup data was taken, and, as of 18 October, had kept Cloud Backup suspended while it remediated.

What PAM Would Not Have Stopped

The first step was a stolen app secret used from a script. No technician signed in, so nothing a PAM platform does to human admin accounts would have blocked it. Panthera also doesn't discover or rotate API keys and client secrets, so the secret review below stays a job for Entra's own tools. A vendor who says their product would have prevented this should name the step it would have stopped.

Where Standing Privilege Made It Worse

The damage came from what the app already held and what it could grant itself. A backup job reads mail and files on a schedule, yet Microsoft assessed that the attacker abused directory write permissions that were live around the clock. It's the same pattern as a technician account that is Global Administrator in every client tenant just in case: access nobody is using, waiting for whoever gets the credential.

Zero standing privilege applies to non-human identities too. Know which apps hold admin rights in each tenant, cut what they don't need, and treat a new admin role on any identity as an incident.

Where Panthera Helps

• Answering "which clients have it?": Panthera discovers the human and non-human identities in every connected client's Entra ID tenant, including enterprise apps and service accounts, next to the admin accounts. When the advice was to disable the vendor's apps, an MSP with that inventory knew which tenants to open first.
• Leaving less to take over: An app with Global Administrator can reset any admin's password. With just-in-time access, techs use accounts that stay disabled until a task, or single-use accounts deleted after it, so few standing admin accounts sit in the tenant to hijack.
• Spotting what changed: Discovery runs continuously and Panthera alerts on privileged account changes, so an admin account created during the incident shows up now, not at the next audit.
• Recovering in an afternoon: Once an attacker holds Global Administrator, treat every admin and break-glass password in that tenant as exposed. Panthera rotates them across affected tenants from one workflow, or from the Prompt Terminal™ by describing the job, and logs every rotation for the client's insurer.

What to Do This Week

1. Disable, don't delete, the Cloud Backup app (ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the other ConnectWise or SkyKick Cloud Management apps in every client tenant. Deleting removes consent. Keep them off until ConnectWise sends restore instructions.
2. Remove admin roles you didn't grant, especially Global Administrator and Privileged Authentication Administrator, from those apps.
3. Review secrets and certificates on every enterprise app and app registration for anything added since 13 October, starting with management and security tools. Disabling the vendor app doesn't remove secrets it added elsewhere.
4. Check service principal sign-ins for the app ID from 144.172.64[.]128 or any address outside Microsoft's ranges. Huntress notes that a clean result doesn't rule out access.
5. Rotate admin and break-glass credentials in any tenant where an app gained an admin role.
6. Review Conditional Access exclusions for the apps.

The Part That Stays With the MSP

ConnectWise will reset its own credentials. What stays with the MSP is knowing which identities, human or not, hold admin rights in each client tenant, and being able to rotate everything exposed in an afternoon rather than a week. Zero standing privilege is the goal that covers both.

To see what's in one of your tenants, start a free trial and connect a single client's Entra ID. Discovery lists the identities it finds, apps included.

Sources: Huntress, "Vendor credential enables unauthorized access," 16–17 Oct 2026; BleepingComputer, "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack," 17 Oct 2026 (Microsoft statement); ConnectWise status page, Cloud Backup incident, update of 18 Oct 2026.