contact@trustinfinitech.com (573) 234-6540

The Apps You Already Trusted: Who Has Standing Access to Your Microsoft 365 Tenant?

Home/News/The Apps You Already Trusted: Who Has Standing Access to Your Microsoft 365 Tenant?

October 26, 2026  ·  Austin Hindery  ·  Latest News Managed Services Security Newsletter

A glowing glass cube on a pedestal in a dark hall, fed by many slender conduits from the shadows, one of them carrying a faint red glow inward, representing trusted app connections into a Microsoft 365 tenant and the risk when one supplier is compromised.

In mid-October, ConnectWise shut down its Cloud Backup service, along with its SaaS Security and Cloud Management platforms, after a compromised credential was used to reach customers’ Microsoft 365 environments. Microsoft said the attackers “likely abused permissions previously granted by customers” to the application, including the elevated Directory.ReadWrite.All permission, according to The Record’s October 19 report.

Nobody at those customer organizations had to click a bad link for this to happen. The access had been approved earlier, by an administrator, for a legitimate business reason. That is the question this incident puts in front of every Microsoft 365 customer: which apps already hold the keys to your tenant, and when did anyone last check?

Key takeaways

  • Third-party apps connected to Microsoft 365 can hold broad, organization-wide permissions that keep working long after the day someone approved them.
  • The ConnectWise incident follows the same pattern seen in the 2024 Midnight Blizzard attack on Microsoft and the 2025 Salesloft Drift token theft: attackers used trust that had already been granted.
  • A first review of your tenant’s app permissions takes an afternoon, and tightening consent settings prevents most of the problem from growing back.

What happened at ConnectWise

ConnectWise said on October 16 that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment” and confirmed the access the next day, The Record reported. Security firm Huntress said a Cloud Backup credential had been compromised and used to access customer Microsoft 365 environments, and it observed unauthorized sign-ins in 162 tenants.

By October 20, ConnectWise said it had reset accounts and credentials in the affected environment and was preparing a phased restoration, according to The Hacker News. Huntress, which reviewed application sign-ins across more than 10,000 tenants with ConnectWise apps, found post-compromise activity in two tenants. In those tenants, the application granted itself Global Administrator and added new secrets to other applications for persistence.

What remains uncertain:

  • Scope. Reported tenant counts differ by source and by what was measured, from sign-in attempts to confirmed post-compromise activity. The investigation was still developing at the time of writing.
  • Customer impact. ConnectWise told The Record it has no visibility into partner and customer environments, so it cannot say whether a given tenant was breached. A spokesperson said there was “no indication” that backup data was compromised.
  • Lingering changes. Security vendor CoreView noted that disabling the affected app registrations blocks new tokens but does not undo changes already made inside a tenant.

Standing access, defined

Throughout this article, “standing access” means permission granted to an application once that keeps working on its own, without anyone signing in again.

Microsoft’s identity platform supports two kinds of access, as its permissions overview explains. With delegated access, an app acts on behalf of a signed-in user and can reach only what that user can reach. With app-only access, “the application acts on its own with no user signed in,” and it can access any data the permission covers. Only an administrator can consent to these application permissions.

App-only access is what makes backup, archiving, and security tools work. A backup service has to read every mailbox at 2 a.m. without waiting for each employee to log in. The tradeoff is that no person signs in when the app connects, so the multifactor authentication (MFA) prompts that protect user accounts are not part of that flow. If an attacker obtains the app’s credential, they inherit everything the app was allowed to do.

A recurring pattern

ConnectWise is the latest example of a pattern that has hit large and small organizations alike.

  • Microsoft, 2024. In its January 2024 guidance, Microsoft said the Midnight Blizzard group password-sprayed a legacy test account without MFA, then compromised a legacy test OAuth application that had elevated access to Microsoft’s corporate environment and used it to reach corporate email.
  • Salesloft Drift, 2025. Google reported that attackers used stolen OAuth tokens tied to the Salesloft Drift integration to access Salesforce instances between August 8 and 18, 2025, The Hacker News reported. Google advised customers to treat every token connected to the Drift platform as potentially compromised.

Our analysis: the common thread is that consent is a one-time event while risk is ongoing. Integrations are approved quickly to solve a business problem. They often request broad scopes because broad scopes are easier to build against. They also tend to outlive the projects and contracts that justified them, and in many organizations nobody owns the list.

Why it matters for a 50 to 500 person organization

This section is our interpretation, based on the incidents above and on what we see in Microsoft 365 environments generally.

Mid-sized organizations tend to have many integrations and a small team approving them. Backup, e-signature, CRM, scheduling, phone systems, and reporting tools each ask for access, and each request arrives attached to a deadline.

Departed vendors are a particular blind spot. When you stop paying for a service, its app registration usually stays in your tenant with its permissions intact. CoreView’s guidance after the ConnectWise incident told administrators to look for the affected apps in every tenant, whether or not they were active customers.

The business question is simple: does the value of each integration justify the access it holds today? For most apps the answer is yes. For a few it will be no, and those are the ones worth finding before someone else does.

What to do next

This week: IT lead or MSP

  1. Pull the list. In the Microsoft Entra admin center, go to Entra ID, then Enterprise apps, then All applications. For each app, open Permissions and review the Admin consent tab, following Microsoft’s guide to reviewing app permissions. Start with apps that hold application permissions, since those work with no user present.
  2. Flag the high-privilege scopes. Give extra scrutiny to directory write permissions such as Directory.ReadWrite.All and to mailbox-wide access such as the Exchange full_access_as_app role. Microsoft’s Midnight Blizzard guidance specifically recommends reviewing apps that hold full_access_as_app and EWS.AccessAsUser.All and removing those no longer required.
  3. Check activity. Microsoft Entra sign-in logs include a separate category for service principal sign-ins. An app nobody recognizes, or one tied to a vendor you left, deserves a closer look.
  4. Remove what you no longer use. Revoke admin-consented permissions for retired integrations. Microsoft notes that revoking does not stop users from consenting again, so pair this step with the consent settings below.

This quarter: IT lead with executive sign-off

  1. Tighten consent. Microsoft recommends allowing user consent only for apps from verified publishers, limited to permissions you classify as low impact. Turn on the admin consent workflow so employees can request an app and designated reviewers decide, instead of requests stalling or being approved ad hoc.
  2. Ask vendors better questions. Before approving or renewing an integration, ask: Which permissions does it need, and why? Delegated or app-only? Can access be limited to specific mailboxes or sites? How do you protect the credentials your app uses in our tenant? How quickly will you notify us if those credentials are exposed?
  3. Give the list an owner. Assign one person to own the app inventory and review it on a set schedule. We suggest at least twice a year and at every contract renewal.

If you use ConnectWise Cloud Backup

Follow ConnectWise’s published guidance, and per The Hacker News, do not reconnect affected applications until ConnectWise provides formal restoration instructions. Review directory role assignments, newly added app secrets, and configuration changes made during the incident window.

Where InfiniTech can help

For organizations that want ongoing coverage, the InfiniCare Advanced Security Bundle includes Microsoft 365 hardening and Managed Detection and Response (MDR), with 24/7 monitoring, investigation, and response that covers Microsoft 365 alongside endpoints, servers, and firewalls. We can also help run the first permissions review with your team and set up a repeatable process.

The bottom line

Every integration in your Microsoft 365 tenant was approved for a good reason. Some of those reasons expired years ago, and the permissions did not. Treat app consent as a standing decision you revisit on a schedule, and the next vendor compromise becomes a short review instead of an open question.

Sources

← Back to News