ConnectWise and Microsoft 365: review application access too

An application can sign in without an interactive user login

Microsoft reports that Storm-0940 used compromised ConnectWise application credentials to access Microsoft 365 environments that had already granted those applications permissions. No interactive user sign-in was needed. The bulletin also describes application credential and privilege changes that could preserve access after the original application has been dealt with.

Microsoft attributes faster activity to the ARTEX AI framework. The administrator’s task is still to examine what access the applications held and how it was used. The report does not describe this campaign as exploitation of a Microsoft 365 vulnerability.

Include integrations you no longer use

Ask your administrator to search by application ID, not just display name, in every tenant where the applications are or were authorized. Service-principal sign-ins, the local identities representing those applications, need to be examined alongside audit records.

Microsoft recommends reviewing activity from at least October 15, 2026, extending sign-in review to October 1 where records are available. Look for added credentials, owners, permissions and privileged roles, as well as unusual mail or file access. An application’s presence, or even a successful authentication, does not establish that data was stolen.

The expanded bulletin also describes bulk secret reads across multiple Azure Key Vaults, key enumeration and a key-unwrapping operation. It adds hunting queries for this activity and for Azure Storage and ARM. If the application had access to your Azure resources, check that scope before limiting the investigation to Microsoft 365 mailboxes. Microsoft’s observation does not establish that your own secrets were read.

Contain access without destroying evidence

The bulletin says to keep affected ConnectWise connections disabled until the vendor provides formal restoration instructions. It advises against deleting enterprise applications as the first response: preserve configuration and evidence, without postponing urgent containment while waiting for log exports.

An authorized responder should then remove confirmed unauthorized access, including added credentials and permissions. Resetting only a user’s password does not remove those additions. Before restoring the connection, also check the effect on backup and recovery workflows.

• Read Microsoft’s recommendations and hunting queries↗

What this brief cannot establish

SecuFocus read Microsoft’s bulletin. We did not inspect your tenant or execute its queries. The observations and campaign attribution are Microsoft’s. We did not independently consult the ConnectWise advisory, which is outside our news-source list.

Sample queries do not replace an inventory of your applications. If you do not administer Microsoft 365, ask your provider to confirm exposure, checks performed and the conditions for restoring service. Do not delete production access yourself based on this brief alone.

• Cloud or self-hosting: who maintains the service?↗