Here’s a question we’ve been asking a lot lately: who actually has access to your Microsoft 365 environment?
Most people answer with a list of employees. That’s normally the part you can see easily.
But it’s rarely the whole story.
There’s the backup tool you signed up for three years ago. The security platform. The IT provider that set up your tenant. The supplier that needed administrator access for “just one project”.
Any of them could still have a way in. And plenty of them may be working quietly in the background, where nobody is really looking.
When organisations think about Microsoft 365 security, they naturally focus on user accounts, employee logins and administrator access. But understanding who can enter your environment means looking beyond the people using it every day.
ConnectWise is currently investigating unauthorised access involving application identities linked to its Cloud Backup service. Cloud Backup, SaaS Security and Cloud Management have been suspended while it investigates and works to restore services safely.
It’s a serious story. If you use the affected services, or your IT provider manages them on your behalf, you should check that the latest ConnectWise guidance is being followed.
But for everyone else, “Are we affected by ConnectWise?” isn’t the most useful question.
A better one is:
Do we actually know who and what can authenticate into our environment?
Every application, integration, service account and third-party platform connected to Microsoft 365 becomes part of your wider security picture. If you don’t know what is connected or what permissions it has, it’s difficult to understand the risk.
When we think about identity security, we usually think about people.
Who has an account? Who is an administrator? Did someone leave and keep their login?
But applications have identities, permissions and authentication methods too. And they don’t hand in their notice. They don’t get flagged by HR, and they don’t appear in your joiners-and-leavers process.
Many organisations are diligent about reviewing employee accounts and administrator roles but spend far less time reviewing application permissions, service accounts and consent grants.
That’s where things can get complicated.
Most IT teams can quickly tell you who their employees are. Far fewer can confidently list every application, API integration, third-party service and Microsoft Entra enterprise application with access to their tenant.
That’s often where hidden risk lives.
ConnectWise’s guidance is worth paying attention to here. It asks partners to check application credentials, directory roles, owners, consent grants and recent policy changes.
It also makes an important point: disabling an affected application connection can prevent new authentication through it, but it doesn’t reverse changes that may already have been made within a tenant or remove access established through separate identities.
Read that again.
Turning something off isn’t the same as knowing you’re in the clear.
And that isn’t just a ConnectWise lesson. It applies to every third party you’ve ever trusted with access to your Microsoft 365 environment.
We’re not here to scare anyone.
ConnectWise says existing backup archives remain encrypted and isolated, and it has no indication that they have been compromised. It has also made clear that suspending a service does not, by itself, mean a particular partner or customer has been compromised.
If you use the affected services, follow the investigation and remediation guidance in the ConnectWise Trust Center.
If you don’t, treat this as a nudge. It’s a good reason to lift the bonnet and have a proper look.
Many Microsoft 365 security issues aren’t discovered because of a headline-making incident. They’re uncovered through unexpected permission changes, suspicious authentication activity, unauthorised consent grants or a simple question about who should still have access.
Third-party access is one part of a much bigger picture.
Understanding your Microsoft 365 security posture means knowing:
That’s what our Microsoft security specialists can help you uncover.
We’ll help you see what’s connected, identify who has privileged access and review how your Microsoft Entra permissions are configured. We’ll also highlight unnecessary access, gaps in visibility and the risks that should be addressed first.
Because the real question isn’t:
“Have we been hit by the latest incident?”
It’s:
“Do we know our environment well enough to tell?”