How One Stolen App Credential Opened 173+ Microsoft 365 Tenants

Summary

On October 15, an attacker used a stolen certificate belonging to ConnectWise Cloud Backup—formerly SkyKick Backup—to sign in to more than 170 Microsoft 365 tenants. The video describes the incident as an evolving supply-chain attack; Microsoft called it active.

How the access worked

• ConnectWise’s multitenant application could be consented to by customers. Consent creates a service principal, or enterprise application, in each customer’s tenant.
• The backup service had broad application permissions, including access to mailboxes, OneDrive, SharePoint, Teams, and reportedly Directory.ReadWrite.All.
• Unlike delegated permissions, application permissions act as the app itself, not as a signed-in user. The attacker used the client credentials flow with a stolen certificate, so there was no user password or MFA prompt. The video says Conditional Access was not applied because this was not a user sign-in; workload Conditional Access does not cover third-party multitenant apps in the same way it covers single-tenant apps.
• The same provider credential could therefore reach many tenants where the app had been consented to. Huntress reportedly observed logins from one IP across many customers, consistent with an automated, sequential scan.

The video also describes persistence attempts. In one customer tenant, a ConnectWise Cloud Management app reportedly made itself a Global Administrator. The attacker also added client secrets to other applications, including MSP-management and Huntress apps. Revoking the provider’s certificate alone would not remove credentials or changes already made in customer tenants.

What tenants were advised to check

1. Find the ConnectWise application in Enterprise applications by its application ID, not just its display name.
2. Disable rather than delete it, preserving the consent record while stopping new sign-ins. The same precaution was advised for other ConnectWise apps until confirmed safe.
3. Review service-principal sign-in logs, rather than only user sign-in logs.
4. Check audit logs for newly added app secrets or certificates since October 13, and for applications that added themselves to directory roles.
5. Export logs promptly: the video notes that Entra ID Free retains only seven days of logs.

Broader security lessons

• The speakers frame this as a risk in the common multitenant-app design pattern, not just a problem with one vendor: a single powerful app and credential can create a large blast radius across customers and MSP-managed tenants.
• Vendors should avoid deploying one all-powerful app across every customer. Creating and managing a separate app per customer takes more work, but can limit a compromise to one tenant.
• Apps should request only the permissions they need, use certificates or federated credentials rather than client secrets where appropriate, and enable application instance locking to prevent credentials from being added to customer-side instances.
• Customers evaluating third-party apps are encouraged to ask:
  • Is this one app shared by everyone?
  • What can it do in my tenant?
  • Who controls its credential?
• The video notes that AI agents can use a similar multitenant blueprint model, potentially scaling the same kind of exposure.

Main speakers and sources

The video’s narrator is attributed to Merill Fernando; it features comments from Calvin Tegelaar and Fabian Bader. Sources discussed include Microsoft, Huntress, an r/msp post, and the ConnectWise status page.