ConnectWise Revokes Seven M365 App Identities After October 14 Detection of Credential Theft

The listed identities carried broad Graph, Exchange, SharePoint and Teams permissions that allow token requests and role elevation to Global Administrator. ConnectWise stated it detected the activity through internal monitoring on October 14 yet provided no timeline on initial credential exposure or whether a product flaw enabled the theft. Existing backup archives remain encrypted with no observed exfiltration but scheduled jobs and restore access are offline while SaaS Security and Cloud Management stay suspended.

OAuth application credentials create persistent supply-chain risk because a single stolen secret grants the attacker the same delegated rights as the original integration without per-tenant password theft. The pattern matches prior incidents where MSP tools were abused to add client secrets and new applications for long-term access. ConnectWise cannot observe downstream tenant changes so customer-side persistence via added secrets or directory roles must be hunted independently.

Official statements emphasize isolation of archives and absence of further observed activity while remaining silent on root-cause details or exploit method. Independent verification of the seven disabled IDs and their permission sets is limited to the public disclosure; no CVE or third-party technical report has yet appeared. Customers must audit every tenant for unauthorized applications, elevated roles and lingering tokens issued before revocation.

Next steps include certificate re-issuance, tenant-by-tenant permission reviews and potential migration away from shared MSP credentials. Regulators and insurers will likely require evidence of customer notification and remediation timelines within 30 days.