Is Your Microsoft 365 Tenant Really Safe? Here's the Truth After the ConnectWise Breach

If your business uses Microsoft 365, a recent supply-chain incident involving ConnectWise is a useful reminder: having Microsoft 365-and enabling multifactor authentication (MFA), does not automatically mean every route into your tenant is protected.

That does not mean every Microsoft 365 customer was affected, or that every successful sign-in led to data theft. It does mean that a tenant’s security depends on more than employee passwords. Third-party applications can also have permission to access business data and services.

Here is what has been reported, what it means for small businesses, and what to do next.

What happened in the ConnectWise incident?

In October 2026, security researchers at Huntress reported unauthorized sign-ins to Microsoft 365 tenants using credentials associated with ConnectWise Cloud Backup and related ConnectWise applications. Microsoft later attributed the activity to a threat actor it tracks as Storm-0940 and reported that the actor used an AI-enabled framework to accelerate parts of the campaign.

The reported access was through application identities, sometimes called service principals, not an employee signing in with a password. Applications use these identities to perform tasks they have been authorized to do, such as backing up cloud data. If an application’s credentials are compromised, an attacker may be able to use the application’s existing permissions.

Microsoft reported that activity in some affected environments included Microsoft Graph reconnaissance and attempts to change application credentials or privileges. Importantly, Microsoft said that the presence of an affected application or a successful authentication does not, by itself, establish that customer data was accessed or removed. The impact must be assessed tenant by tenant.

For background, see Microsoft’s incident analysis and Huntress’s incident reporting. These reports describe evolving investigations. Follow the vendors’ current advisories for incident-specific updates.

Why MFA is important, but not the whole answer

MFA remains a key safeguard for user accounts. It can make it harder for an attacker to sign in with a stolen or guessed password.

But application-only access is different. A service principal can authenticate as an application using its credentials and permissions, without an employee entering a password or responding to an MFA prompt. That is why MFA alone cannot establish that every form of access to a Microsoft 365 tenant is safe.

This is not a reason to turn MFA off or assume it is ineffective. It is a reason to secure both user identities and application identities. That includes reviewing which third-party applications have access, what permissions they hold, and whether that access is still needed.

Teams voice phishing is a separate risk

The ConnectWise incident involved reported abuse of application credentials. It should not be confused with voice phishing, or vishing, which targets people through phone or voice calls.

The Center for Internet Security (CIS) reported that U.S. state, local, tribal and territorial organizations encountered campaigns in 2026 in which callers impersonated help-desk or IT staff. In reported scenarios, attackers used voice calls, including through Microsoft Teams, to try to obtain one-time codes, prompt MFA approvals, or persuade help-desk staff to reset passwords or change MFA enrollment. CIS also noted that AI can reduce the effort required to prepare and adapt these attacks.

This reporting is not evidence that a particular Yellowhead-region business has been targeted. It does highlight a practical risk for any organization where staff rely on trust and urgency during IT support requests.

A familiar voice or a Teams call is not sufficient proof of identity. Staff should not read out verification codes or approve unexpected sign-in prompts. Requests to reset credentials, add a device, or change MFA should be verified through a known, separate contact method.

What should a small business do now?

If your organization uses ConnectWise Cloud Backup or related ConnectWise applications, do not make changes based on a headline alone. Disabling an integration can affect a business process such as backups. At the same time, leaving a potentially affected connection untouched without checking its status is not a safe substitute for investigation.

Work through these steps with your IT provider or an appropriately authorized administrator:

1. Confirm whether the relevant applications are present. Check your Microsoft Entra enterprise applications and app registrations for ConnectWise or SkyKick applications. Use the current vendor guidance to identify affected application IDs; a display name alone may not be reliable.
2. Review application sign-ins and changes. Check service-principal sign-in records and Entra audit records for unfamiliar activity, unexpected application credential additions, permission or consent changes, and new privileged role assignments. A user sign-in review by itself may miss application-based activity.
3. Assess the full sequence, not one event. A sign-in is a clue, not a complete impact assessment. Review what happened afterward, including Microsoft Graph activity where the necessary records are available, changes to users and groups, and access to mail, files, and other resources.
4. Contain carefully and preserve evidence. Follow current vendor and Microsoft instructions for affected integrations. Preserve relevant records before making changes where possible, and avoid deleting an application as an improvised first response. If an application needs to be disabled, first consider the operational impact, for example, whether a backup workflow will pause.
5. Check for persistence. If unauthorized credentials or permission changes are confirmed, removing or disabling the original application may not remove changes made elsewhere in the tenant. Have a qualified responder review related applications, credentials, permissions, roles, and user accounts.
6. Reassess third-party access. Remove permissions that are no longer required, limit application access to the least privilege needed, and ensure every connected service has an accountable owner and a current business purpose.

If your team does not have access to the required logs or is unsure how to interpret them, avoid guessing. Ask a qualified Microsoft 365 administrator or cybersecurity provider to assess the tenant.

Reduce the risk of Teams vishing

A short, written process can help staff respond consistently under pressure:

• Verify requests to reset passwords, enroll a device, approve MFA, or share a code through a known contact method, not by calling back a number supplied by the caller.
• Establish who can authorize sensitive account changes, and document how help-desk or external IT requests are confirmed.
• Train staff to report unexpected sign-in prompts and urgent requests, even if the caller claims to be a senior employee or support technician.
• Where available and suitable, consider phishing-resistant sign-in methods such as passkeys, while also protecting the enrollment and recovery process.

These controls complement technical protections; they do not replace them.

What “managed” Microsoft 365 security should cover

A Microsoft 365 subscription gives your organization access to cloud services. It does not automatically mean someone has configured every security setting, reviewed third-party application permissions, or defined how an incident will be handled.

When assessing managed Microsoft 365, ask who is responsible for identity settings, application consent, privileged accounts, backup arrangements, security updates, incident response, and staff guidance. Ask what is included, what is not, and how responsibilities are divided between your business, Microsoft, and any service provider.

This is also where managed cybersecurity services and network security for small business fit into a wider plan. They should support a practical security baseline across cloud accounts, business devices, and the network, not leave the business guessing about who acts when a concern arises. Our managed cybersecurity services article outlines common gaps to consider.

For businesses comparing providers, managed IT services for small business should make responsibilities clear and provide a straightforward path to local support when something needs attention. Learn more about Yellowhead IT Services.

The bottom line

The ConnectWise reports show why a clean employee sign-in history is not enough to confirm that a Microsoft 365 tenant is safe. Third-party application access needs its own review, and MFA, while essential, does not address every application-based authentication path.

The right response is a measured assessment: confirm which applications are connected, check the relevant sign-in and audit records, follow current vendor guidance, and investigate before concluding that data was or was not affected. Separately, set clear verification procedures for Teams and phone-based support requests.

We provide hands-on IT and cybersecurity support for businesses in the Yellowhead region. If you are unsure what applications have access to your Microsoft 365 tenant or how to assess a recent security concern, feel free to reach out.