Does Your IT Company Use ConnectWise or SkyKick Backup? 6 Questions to Ask About Your Microsoft 365 This Week

A backup app connected to Microsoft 365 is a normal way to keep mail and files recoverable. ConnectWise Cloud Backup, formerly SkyKick, is one of those apps. ConnectWise reported that the app's own key was used without permission, and it turned that app's access off.

This page is for an owner or office manager at a business of about 5 to 50 people. An outside IT company handles Microsoft 365. The job this week is a written answer from that company.

The short answer

Is my business affected by the ConnectWise (SkyKick) backup breach? Only if your Microsoft 365 was connected to ConnectWise Cloud Backup (formerly SkyKick) or ConnectWise Cloud Management, now or in the past. Most owners would not know, because the IT provider set it up. Ask whether those apps are in your account, whether they are disabled (not deleted), and whether anyone checked for new admin roles or app keys since October 13, 2026 (both ConnectWise and Huntress use that start date). Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16. A tenant here means one company's Microsoft 365 account. ConnectWise says each potentially affected tenant still needs its own review.

What happened (briefly)

ConnectWise's Trust Center advisory was first published October 16, 2026 at 17:47 UTC and updated October 21 at 12:45 UTC. The quote is from ConnectWise's October 17 update: it found "unauthorized access to application identities within the ConnectWise Cloud Backup environment." The FAQ dates discovery with the line "Upon discovery on October 14, 2026." At 05:01 UTC on October 17, ConnectWise said it was shutting off Cloud Backup application access.

Huntress says that credential was used to sign in to customer tenants on October 15. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. CyberScoop repeated that figure on October 20.

Huntress's October 17 update also gives a separate sign-in review: "almost 1,000 Entra tenants with sign-in activity," and "Over 300 of those succeeded." Entra is Microsoft's sign-in directory. Those figures are separate from the 162 confirmed tenants. ConnectWise has not published a single total of affected accounts.

In one tenant, Huntress says ConnectWise Cloud Management – MS Teams "gave itself Global Administrator" and added keys to two other apps. ConnectWise also paused SaaS Security and Cloud Management, along with Cloud Backup. BleepingComputer and CyberScoop reported that Microsoft Threat Intelligence called the activity an active supply-chain attack.

On October 21 at 12:45 UTC, ConnectWise said it had begun "restoring services in controlled phases," and "We expect restoration to take several days."

Why MFA didn't stop it

MFA (multi-factor authentication) is a password plus a second step, such as an authenticator app or a security key.

A connected app signs in with its own key. Huntress says: "App-only sign-ins involve no user, no device, and no MFA prompt." BleepingComputer, citing Todyl, reported the same limit: no user login, so MFA did not apply.

Keep MFA on every person, including break-glass accounts (emergency admin logins). The MFA setup guide for Microsoft 365 has the steps. Microsoft's multifactor authentication guide says organizations can use security defaults or Conditional Access policies, but not both at the same time. ConnectWise's guidance adds that user policies do not automatically protect application-only sign-ins. The app check is separate: who holds keys, and what those keys can do.

Are we affected? How to tell in 2 minutes

Does an outside IT company manage our Microsoft 365?
Did they ever mention SkyKick or ConnectWise backup?
Did we get a "service interruption" email this week?

Any yes means send the questions below. A past connection still counts. ConnectWise tells providers to review dormant SkyKick connections, so "we stopped using it" is still a reason to ask.

The 6 questions to send your IT provider today

Copy this into an email and ask for the answer in writing, with the date checked. The questions for your IT host card is the same habit before you renew.

Was our Microsoft 365 connected to ConnectWise Cloud Backup, SkyKick, or ConnectWise Cloud Management, now or in the past?
Are those apps switched off ("disabled, not deleted") in our account, as ConnectWise and Huntress advise? Huntress says: "Disable application IDs, do not delete them."
Did any of them, or anything else, get a new admin role (such as Global Administrator or Exchange Administrator) since October 13?
Were new keys (secrets or certificates) added to any app in our account since October 13? Huntress says: "Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added."
Any new mail forwarding, inbox rules, or mailbox access changes? The Microsoft 365 admin hygiene checklist is the quarterly version of that review.
When was our last good backup, and what covers us until the service is back? Use a 15-minute restore test and an offline backup spot-check on the copies you still control.

Date sent: YYYY-MM-DD · Answer received: · Checked by:

Your provider can trace app sign-ins in Microsoft's service principal sign-in logs, using the compromised and malicious applications investigation playbook.

Were our backups stolen?

ConnectWise says existing archives "remain encrypted, isolated, and preserved, with no indication of compromise," and that this does not establish whether live Microsoft 365 accounts were affected. Huntress found no mailbox or file changes in the tenants it reviewed, and says directory reads leave no audit record. Your account still needs the check above.

Don't turn it back on yet

Huntress says to keep the apps disabled until ConnectWise confirms all credentials have been reset, and not to delete them.

The evergreen habit: once a quarter, ask which apps can get into Microsoft 365

Ask your IT provider for the list of connected apps (Enterprise applications) and what each one can do. Remove any app nobody can explain. Microsoft's disable user sign-in page says an admin can "disable user sign-in for the application, which prevents all tokens from being issued for that application." That switch is per company and leaves the app in place. Put the ask on the admin hygiene checklist and the month-end security hub.

If your provider finds something

Follow the first 60 minutes after a cyber incident. Write down what was found. Call from a device you still trust. Ask whether they have reported it to ConnectWise, and whether outside incident response is needed.

FAQ

Why didn't multi-factor authentication stop it? MFA protects people signing in. The attacker used the backup app's own credential, and app-only sign-ins involve no user and no MFA prompt, according to Huntress. MFA still matters for every person and admin account. Connected apps need a separate check: which apps hold keys to your Microsoft 365 and what they are allowed to do.

Were our backups stolen, and are we backed up right now? ConnectWise says existing archives remain encrypted, isolated, and preserved with no indication of compromise. Scheduled backups and restores were paused during the outage, though. On October 21, ConnectWise said restoration will take several days. Ask your IT provider when your last good recovery point was and what protects new data until service returns.

Related guides

Educational content only — not legal, insurance, or compliance advice.