ConnectWise: Response and recovery
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 15
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Start with the incident-specific sequence
Restrict suspect application access promptly through the incident plan. Preserve application configuration and available evidence before deleting enterprise applications; user password resets alone do not invalidate every app-only credential.
Use the current primary guidance and the accountable incident lead to resolve sequencing conflicts. Coordinate parallel teams before changing shared identities or destroying evidence. Urgent containment may need to proceed before every record is collected, but the decision and evidence lost should be documented.
Restore a trusted operating path
Review application credentials, owners, consent and role assignments. Re-establish only approved integrations according to current vendor and tenant-specific guidance, with separately controlled recovery identities.
- Review app-only activity and relevant data access, then test that revoked paths fail.
- Test the restored integration with minimum required permissions and verify denied operations.
- Identify critical records and the temporary recovery method for each.
Verify before resuming
Inspect relevant service-principal and data-access evidence, test revoked authorization and validate restored backup coverage. Document gaps in logs and unresolved tenant scope rather than turning them into clearance.
Ask the operational owner to exercise the essential workflow, including background tasks and customer exceptions. Keep a short record of what passed, what failed and what remains untested. Define who may accept an exception and when it must be revisited; an exception should not disappear into a general restoration announcement.
A scenario to rehearse
Illustrative exercise, not an observed customer incident: Every user changes their password, but a malicious application credential still authorizes access to business files. The exercise requires the identity team to find and invalidate the separate application path.
Keep customers informed
Route account-specific information questions to the designated data and incident owners.
An approved explanation separating service availability, access evidence and unresolved scope.
Restart decision
Re-enable the integration only after identity ownership, required permissions, account-specific findings and the independent recovery plan have been approved.
After stabilization, review which shared dependency allowed the exposure to spread or slowed recovery. Choose a measurable improvement and an accountable owner. A new platform is useful only when its responsibilities, evidence and recovery path fit the business requirement.