The App You Approved Still Has the Keys: A Microsoft 365 Permissions Checklist for October 2026

MFA stops a person from signing in. It does not stop an app you already approved. In mid-October 2026, that difference stopped being a diagram in a security talk and became a weekend problem for Microsoft 365 tenants that had consented to ConnectWise Cloud Backup, the product formerly sold as SkyKick.

Someone used that application's own credential to sign in as the app. No employee typed a password. No one approved a phone prompt. The app already had permission to reach mail, files, and, in many tenants, directory settings. ConnectWise has since disabled the related application identities on its side and suspended the service. As of the company's Trust Center update at 00:45 UTC on October 20, 2026, Cloud Backup, SaaS Security, and Cloud Management are still suspended. Scheduled backups, archive access, and restores through that product are unavailable, and ConnectWise has not published a restoration time.

The same update says stored backup archives remain encrypted and preserved, with no indication those archives were compromised. It also says that finding does not establish whether a live Microsoft 365 tenant was affected. Each tenant still needs its own review.

If you own a business in West Monroe, Monroe, Ruston, or anywhere else your email lives in Microsoft 365, you do not need a war room. You need a straight answer to one question: which applications can still sign in, and what can they do when they do?

Why an approved app is a different kind of login

Owners have spent the last two years turning on multifactor authentication, and that work still matters. Phishing was the way in for 23% of the intrusions Microsoft's incident responders investigated for the 2026 Digital Defense Report, up from 7% the year before. A stolen password is still the ordinary door.

This incident used a different door. A backup product, a marketing tool, an e-signature platform, or the scanner software the copier vendor installed last year can be registered in Microsoft Entra ID as its own identity. Once an administrator clicks Accept, that app can act within whatever permissions it was granted. Conditional Access policies aimed at employees do not automatically question it. If the vendor's credential is stolen, the attacker inherits the consent you already gave.

Microsoft has said the actors in this case likely abused permissions customers had already granted, including highly elevated directory write access. Security firms watching small-business tenants, including Huntress, reported the backup app signing in across many of those tenants. Early public confirmation covered unauthorized sign-ins in 162 tenants. Later reporting, while the investigation was still moving, described a larger set of attempts and more than 300 successful sign-ins in the environments Huntress monitors. In a subset of tenants, related ConnectWise apps assigned themselves directory roles, mostly Exchange Administrator. In at least one tenant, an app took Global Administrator and added new application secrets.

Those details come from the public investigation, not from a fear statistic. The counts were still being revised as of October 19. Use ConnectWise's Trust Center and your own sign-in logs as the record for your tenant, not a headline number.

What to do this week if Cloud Backup or SkyKick was ever in the tenant

You may not remember approving it. A previous IT provider may have installed it. You may have moved to a different backup and left the old app in place. Search the name anyway.

Hand this list to whoever administers Microsoft 365. If that person is NewRockIT, this is already the review we run with managed tenants. If it is someone else, these are fair questions.

1. Look in the Entra admin center under Enterprise applications for ConnectWise Cloud Backup and for SkyKick. ConnectWise published the Cloud Backup application client ID as 506e08f9-6e9a-4da4-942b-a099a03644ae. A filter on that screen can hide an app that is still there. Clear the filter and search again.
2. If the app is present, disable sign-in for it inside your tenant. ConnectWise disabled seven application identities on its side on October 17. The company has been explicit that a vendor-side change does not change the enterprise application setting in a customer tenant. Previously issued tokens can also remain usable until they expire. Disabling the app locally is the control you actually own.
3. Do not delete the app as a first move. Disabling it cuts off sign-in and leaves a path to turn it back on later without a fresh consent. Deleting it in a hurry can also make the investigation harder.
4. Ask for a review of sign-in logs and directory audit logs from October 13, 2026, through today. Extend the search back to October 1 if the logs are still there. The questions that matter: did this app sign in, did any app assign itself Exchange Administrator or Global Administrator, and did anyone add a new secret or certificate to an application? Write the times down in UTC, or write down the time zone the portal is showing.
5. Leave the app disabled until ConnectWise publishes restoration guidance. A salesperson saying the service is fine again is not that guidance.
6. Know how you would restore a mailbox or a SharePoint file this week without that product. While the service is suspended, scheduled backups and restores through Cloud Backup are unavailable. Archives being preserved is not the same thing as a restore button you can press on a Tuesday. If the only copy of your Microsoft 365 data was that product, say so out loud and pick an interim plan. The August article on this blog, Microsoft 365 Is Not a Backup, is the longer version of that conversation.

If the app was never in the tenant, you still have the rest of this article to do. The incident is the example. The inventory is the control.

A permissions checklist for every other app in the tenant

Set aside an hour. An owner does not have to click through Entra alone. An owner does have to hear the answers.

1. Name every app that can sign in

Export Enterprise applications. Next to each one, write what it is for in plain language: backup, email signatures, payroll, the CRM, the old newsletter tool, the previous MSP's remote-access app. If nobody in the company can say what an entry does, it is a candidate to disable.

2. Write down what each app is allowed to touch

Mail. OneDrive and SharePoint. Teams. User accounts. Directory roles. An app that only needs to read a calendar should not be able to rewrite the directory. High rights are sometimes required for a backup product. They are a reason to know the app is there, not a reason to stop asking.

3. Record who consented, and when

Consent is a decision a person made. If that person left in 2023, the app did not leave with them. The same is true of a vendor you stopped paying. Offboarding a person without reviewing the apps they approved leaves the door they opened.

4. Check the last sign-in

An app that has not signed in for a year is not automatically safe, and an app that signed in this week is not automatically malicious. The date tells you whether anyone would notice if it started behaving differently. Pair it with the log review above whenever a vendor announces an incident.

5. Separate the account that approves apps from everyday email

The mailbox that reads invoices should not be the account that can grant directory-wide consent. A separate admin account, MFA, and Conditional Access belong in the same conversation as the app list. The identity-first security article on this blog covers the user side of that work. App consent is the part that checklist did not spell out.

6. Decide what good looks like before the next install

Before the next tool is added, ask three questions. What data can it read? Can it change users or roles? Who do we call if the vendor has an incident, and who is allowed to disable the app on a Saturday? Write the answers where the owner can find them. That one page is an incident plan. It is more useful than a poster about strong passwords, and it is the piece most small firms skip.

7. Revisit the list twice a year

October is a fine month for the first pass. Put the second pass on the calendar for April, or fold it into the same quarterly restore test you already owe the backup. A list that was accurate the day a new MSP onboarded you will be wrong after two software purchases and one resignation.

Myths that keep old consents in place

• "We turned on MFA, so third-party apps are covered." MFA challenges a user. An application signing in with its own credential never sees that prompt.
• "The vendor disabled it, so our tenant is clean." Vendor-side containment and the switch inside your tenant are different controls. ConnectWise has said so in its own remediation guidance. Verify the local setting.
• "If the backup archives are safe, Microsoft 365 is safe." Preserved archives do not tell you whether the live mailbox was read or whether a new admin role was added. Review the tenant on its own.
• "We're too small to have risky apps." A 12-person office with a backup tool, an email plug-in, and a CRM has three extra identities. Attackers automate. They do not need you to be famous.
• "We would see it in someone's inbox." An app sign-in does not look like an employee logging in from a new city. It shows up in the sign-in and audit logs, which someone has to be assigned to open.
• "Deleting every app is the safe move." Disabling sign-in is the first control. Deleting an app you still depend on, in the middle of an investigation, can remove evidence and break a restore path you were about to need.

How NewRockIT handles app access

Microsoft 365 work at NewRockIT includes the tenant as it actually is: domains, MFA, shared mailboxes, guests, backup, and who still has Global Admin. Application consent belongs on that same list. When we manage the environment, we can tell you which apps are present, which ones can change the directory, and which ones nobody has been willing to name. When a vendor publishes an incident, the review is specific to your tenant, not a forwarded email with a shrug.

We do not sell a 24/7 security operations center we do not run. Human support is Monday through Friday, 8:00 AM to 5:00 PM Central. Monitoring of covered systems can run continuously. That distinction matters when someone asks for a midnight promise we will not put in a contract.

The same founder who administers the tenant is the person who will walk you through the list. That is the work, whether you are a clinic in Monroe, a contractor in Ruston, a shop in West Monroe, or a remote team on the same Microsoft 365 tenant.

The bottom line

October's useful security project is not another reminder to pick a longer password. It is a list of the applications already inside Microsoft 365, written in language an owner can challenge. The ConnectWise Cloud Backup incident showed what happens when one of those applications is trusted broadly and the vendor's credential is stolen. MFA still belongs on every user. A tested backup still belongs under the recycle bin. Neither one replaces a look at Enterprise applications.

The situation is still moving. Before you re-enable anything, read the current ConnectWise Trust Center advisory, not this article alone.

Ready to see which apps hold keys to your tenant? Call NewRockIT at (318) 532-5964, email hello@newrockit.com, or schedule a discovery call at newrockit.com/contact. We serve West Monroe, Monroe, Ruston, and Northeast Louisiana, and we support clients nationwide.