ConnectWise: Technical exposure and controls
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 15
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Trace the exposure path
Map enterprise applications, service principals, owners, credentials, consent grants and roles. Relate app-only activity to the mailboxes, files and other resources that the granted permissions could reach.
Build a small evidence map from the initiating dependency to the identities, business data and operations it can reach. Include indirect consumers and scheduled work. An inventory entry describes a possible path; activity logs and other account evidence are needed to establish what happened on that path.
Collect the right evidence
- Inventory service principals, application credentials, owners, consent grants and assigned roles.
- Capture approved application configuration and audit evidence before destructive changes.
- Record asset identifiers, artifact or configuration versions, permission scope, evidence dates and the owner of each unresolved question. Do not include secret values.
Control and repair
Restrict suspect application access promptly through the incident plan. Preserve application configuration and available evidence before deleting enterprise applications; user password resets alone do not invalidate every app-only credential.
Review application credentials, owners, consent and role assignments. Re-establish only approved integrations according to current vendor and tenant-specific guidance, with separately controlled recovery identities.
Prove the boundary
Inspect relevant service-principal and data-access evidence, test revoked authorization and validate restored backup coverage. Document gaps in logs and unresolved tenant scope rather than turning them into clearance.
Use positive tests for the business function and negative tests for the access that should now be denied. Record which environment was tested and whether it represents production. Do not treat a successful login, clean homepage or healthy infrastructure graph as a substitute for an authorization or integrity test.
Engineering handoff
An authorization test record and reproducible evidence of the restored application identity.
A tenant-specific identity timeline and a signed integration restoration decision.
Acceptance gate
Re-enable the integration only after identity ownership, required permissions, account-specific findings and the independent recovery plan have been approved.