PENTESTY · EDITORIAL ANALYSIS · · 4 min read
ConnectWise and Microsoft 365: response continues after disabling the app
Suspending an integration can contain new sign-ins and interrupt recovery at the same time. Response needs to examine remaining access and business continuity.
By Pentesty
What was confirmed by October 20
Cyber Security Brazil's reports on unauthorized sign-ins and service suspension, published October 19, prompted this combined analysis. That is the reports' publication date, not the beginning of the incident.
In its October 20 advisory, updated at 12:45 UTC, ConnectWise confirmed that Cloud Backup, SaaS Security and Cloud Management remained suspended. The company identified unauthorized access to application identities; how the credentials were exposed remained under investigation. A precautionary service suspension does not establish that every customer was compromised.
Authentication, changes and data copying are different outcomes
The Huntress update reports sign-in activity across almost 1,000 tenants and more than 300 successful authentications. It notes that missing service principals prevented resource access in some environments. These counts do not establish how many organizations had data copied.
Pentesty proposes separating attempts, accepted authentication, configuration changes and demonstrated data access in the response record. Each classification needs evidence and an observation period. Combining those stages can exaggerate impact or close an investigation before the relevant access paths have been examined.
Investigate the identity that acts without a person
Microsoft's service principal sign-in documentation explains that these sign-ins use the application's own credentials and do not involve a user. Reviewing only a person's session leaves this activity outside the investigation.
In its security operations guidance for applications, Microsoft recommends monitoring added credentials and privileged permissions. The operational objective is to connect who changed an identity, what authority it received and which resources it can reach. Our OAuth service acceptance analysis examines checking both permitted and denied operations.
Build a verifiable record for each tenant
The October 18 ConnectWise technical guide distinguishes vendor containment from local configuration. Use the official identifiers and keep affected applications disabled pending formal instructions. To organize the work, Pentesty proposes a record that closes on evidence, with decisions another reviewer can check:
- Scope: reviewed tenant, accountable owner, integration and the reason it is present.
- Inputs: records examined, covered period and gaps that prevent a conclusion.
- Decision: who approved containment, the risk considered and the state requiring confirmation.
- Remediation: proposed change, before and after evidence, accountable owner and independent validation.
- Open issues: each unanswered question with an owner and the next verifiable condition for reassessment.
A preserved copy also needs to be accessible
On its official status page, ConnectWise says existing archives remain preserved with no indication of compromise, while backups, archive access and restores remain unavailable. The state of stored archives and the ability to use them are separate questions.
Record the last confirmed recovery point, subsequent changes and business functions that depend on that copy. Assess approved alternatives and their limitations before assuming equivalent coverage exists. Connect that assessment with your Microsoft 365 continuity plan and the permissions supporting recovery.
Define the evidence needed to resume
Pentesty proposes preparing acceptance criteria while the investigation continues: an identified owner, approved configuration, justified permissions and a representative recovery test. In an authorized environment using fictional data, record what an identity can do and which operations should be denied.
Resuming the affected service depends on the vendor's formal instructions. After authorization, verify connections, a new backup job and recovery of the test data. Keep the outcome, timestamp and responsible owner's confirmation. A completed test covers that scenario; investigation gaps and untested dependencies must remain visible rather than being silently treated as resolved.
Frequently asked questions
Does October 19 mark the start of the attack?
No. It is the Brazilian reports' publication date. Primary sources describe activity on October 15 and subsequent containment.
Do more than 300 authentications mean 300 data breaches?
No. Successful authentication, resource access and copying data require different evidence.
Does disabling the application remove additional access?
No. Previously added credentials, permissions or identities need their own investigation and remediation.
Can we reconnect after completing the review?
A local review does not authorize reconnection. Wait for formal ConnectWise instructions and verify outcomes after authorized restoration.
Sources and references
- Cyber Security Brazil: editorial news reference
- Cyber Security Brazil: editorial news reference
- ConnectWise: October 20, 2026 advisory, updated at 12:45 UTC
- ConnectWise: service and recovery availability
- Huntress: investigation updated October 19, 2026
- ConnectWise: October 18, 2026 technical investigation guide
- Microsoft: service principal sign-ins
- Microsoft: security operations for applications
Original Pentesty analysis, published October 20, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.