ConnectWise has suspended Cloud Backup, formerly SkyKick, following unauthorized access to application identities and compromised Microsoft 365 tenants. SaaS Security and Cloud Management have also been suspended as a precaution. MSPs must independently review their own Microsoft 365 tenants and those of their customers. It is still unclear when the services will resume.
This is a major blow for MSPs. Scheduled backups aren’t running, archives are inaccessible, and restores are impossible. Monitoring and alerting via SaaS Security have also been suspended, as has user and license management through Cloud Management.
ConnectWise acquired SkyKick in September 2024, along with BCDR provider Axcient. SkyKick primarily contributed Microsoft 365 backup and cloud management capabilities.
Seven applications disabled
On October 17, ConnectWise disabled seven application identities. These include Cloud Backup and various Cloud Management integrations for Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. In addition, the company revoked certificates, invalidating the shared Cloud Backup credentials.
This does not resolve all issues. Previously issued access tokens may remain usable until they expire. Deactivation will not reverse changes already implemented within a tenant.
The company states that existing backup archives are encrypted and isolated, and that no evidence shows they were accessed. However, this says nothing about live Microsoft 365 environments. According to ConnectWise, Cloud Backup “does not provide the downstream security visibility needed to independently determine” whether a partner’s or customer’s tenant has been affected.
MSPs must take action themselves
As a result, partners must do much of the investigation. MSPs must check their own tenant and those of every customer, including environments with dormant SkyKick integrations. They must secure sign-in and audit logs and review credentials, federation trusts, roles, and consent grants. Suspicious mailbox forwarding and inbox or transport rules also warrant attention. ConnectWise has now published three suspicious IP addresses in the 144.172.64.x range.
Meanwhile, the clock is ticking. By default, Entra retains audit and sign-in data for seven days with the free plan and 30 days with P1/P2. ConnectWise warns that a license upgrade will not restore expired history.
Partners who deliver services through a reseller, distributor, or marketplace must ensure that the administrator of each customer tenant receives the guidelines. ConnectWise is working with an external forensic firm and reports that it has not observed any further successful attack activity since the mitigations were implemented.