ConnectWise: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 15
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
Microsoft describes abuse of trusted application credentials and app-only access in the ConnectWise-related campaign. That access can operate without an interactive user login. Investigation therefore needs application identity and data-access evidence, alongside the vendor’s service-specific recovery guidance.
Research reviewed 22 October 2026: Microsoft research on the ConnectWise compromise. Vendor advisory and Microsoft threat research revisited.
Where the evidence stops
An application’s presence or a sign-in record is not by itself proof of data exfiltration. Do not generalize this event to all Microsoft tenants or declare a tenant clear from supplier uptime.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Map enterprise applications, service principals, owners, credentials, consent grants and roles. Relate app-only activity to the mailboxes, files and other resources that the granted permissions could reach.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Inspect relevant service-principal and data-access evidence, test revoked authorization and validate restored backup coverage. Document gaps in logs and unresolved tenant scope rather than turning them into clearance.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Re-enable the integration only after identity ownership, required permissions, account-specific findings and the independent recovery plan have been approved.