ConnectWise Cloud Backup Suspended After M365 Tenant Compromise: What DoD STIG Teams Must Do Now
A live supply-chain identity incident highlights exactly why ACAS / SCAP audit alignment and third-party application identity governance belong in every STIG checklist.
Published 2026-10-18
# ConnectWise Cloud Backup Suspended After M365 Tenant Compromise: What DoD STIG Teams Must Do Now
ConnectWise has suspended its Cloud Backup service and disabled seven OAuth application identities after unknown threat actors gained unauthorized access to those identities and used them to compromise Microsoft 365 tenants — a textbook supply-chain identity attack that carries immediate implications for any organization operating under DoD STIG controls.
What Happened
On a Saturday in late October 2025, ConnectWise confirmed that adversaries obtained unauthorized access to a set of ConnectWise-owned application identities — service principals that carry delegated or application-level permissions inside customer Microsoft 365 tenants. Because OAuth application identities can read mail, access SharePoint, download files, and exfiltrate data without triggering standard user-login alerts, the blast radius of a compromised service principal is significant. ConnectWise moved quickly to disable the affected identities and open an investigation, but tenants that had already granted those identities broad M365 permissions may have been exposed before the revocation took effect.
Why This Matters for DoD STIG Environments
DoD STIG guidance — particularly the Microsoft 365 and Azure Active Directory STIGs, reinforced by ACAS / SCAP scanning requirements — places explicit controls around third-party application consent, OAuth scope minimization, and privileged-identity audit trails. Specifically:
- Application consent governance (CAT I / CAT II findings): STIGs require that only authorized, administrator-consented OAuth apps can access tenant resources. An unreviewed or over-permissioned service principal is a STIG finding waiting to be written.
- Continuous monitoring via ACAS: Assured Compliance Assessment Solution (ACAS) scans are designed to surface configuration drift. A third-party app holding tenant-wide `Mail.Read` or `Files.ReadWrite.All` permissions that was not in the last authorized baseline is exactly the kind of delta ACAS is meant to catch.
- Audit log retention (STIG CM-6): STIG-aligned environments must retain audit logs long enough to reconstruct what a compromised application identity accessed. If Cloud Backup had tenant permissions at the time of compromise, those logs must be preserved immediately — do not let automated retention policies purge them.
What to Do in the Next 7–30 Days
Days 1–7 — Immediate triage:
1. Navigate to Microsoft Entra ID → Enterprise Applications and audit every ConnectWise entry. Remove any application identity that maps to the seven disabled GUIDs disclosed by ConnectWise, and revoke all associated OAuth tokens. 2. Pull Microsoft 365 Unified Audit Log entries for each affected application identity for the past 90 days and preserve them before any retention window closes. 3. Validate that your ACAS / SCAP baseline includes a check for non-baseline OAuth application registrations. If it does not, add a manual compensating control immediately and document it in your Plan of Action and Milestones (POA&M).
Days 8–30 — STIG hardening and documentation:
4. Review and tighten your Azure AD application consent policy: enforce admin-consent-only for all apps requesting permissions beyond `User.Read`. 5. Map every third-party SaaS integration to your authorized software list (required by STIG CM-7) and remove or re-authorize anything that lacks a current Authorization to Operate (ATO) entry. 6. Run a full SCAP benchmark against your M365 and Azure AD configurations to confirm no additional drift was introduced during the incident window. 7. Update your Incident Response Plan to include supply-chain identity compromise as an explicit scenario, referencing this event as a real-world precedent.
Start Your STIG Audit Before the Next Incident
RDS GoSOC AI maps continuous telemetry against DoD STIG requirements — including Microsoft 365 and Azure AD controls — alongside 26 other frameworks such as NIS2 and the EU AI Act, all in a single multi-tenant dashboard. You can launch a 14-day free trial with every paid feature unlocked — no credit card required at https://platform.reremrdsgosoc.com/register. Once inside, open the User Guide tab for a step-by-step walkthrough, or ask Sage, the in-app AI assistant, how to map your OAuth application inventory to open STIG findings — Sage handles setup questions in plain language, so your team can get productive in minutes, not days.
---
#MSP #ManagedServices #CMMC #FedRamp #CyberSecurity #SOC #SecurityOperations #MSSP #ThreatDetection #Compliance #CloudSecurity #IdentitySecurity #SecurityMonitoring #ITServices #CyberResilience #ManagedSecurity #BusinessGrowth