SkyKick / ConnectWise Incident: What We Found and Why Your App Access Deserves a Regular Look

ConnectWise has reported unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. These identities are the connections a vendor’s service uses to reach a customer’s Microsoft 365 environment. ConnectWise disabled the affected connections and published investigation guidance for customer administrators.

After the incident, our Guardian 365 team completed a targeted review to assess potential impact across our customers’ environments. We found no evidence of compromise related to this incident in the customer environments reviewed.

That’s good news. It’s also a useful moment to ask a question most IT teams don’t get time to ask: which applications still have access to our Microsoft 365 environment, and do they still need it?

The bottom line: Integrations set up for a migration, a trial, or a tool you’ve since replaced can quietly keep their access for years. A regular review keeps that access tied to a real business need.

ConnectWise official advisory

What We Reviewed on Your Behalf

Our team checked for the application identities named in the advisory, reviewed related SkyKick and ConnectWise integrations, and examined available sign-in activity. We also looked at relevant application credential and privileged access changes for signs of unauthorized activity.

For the integrations we identified, we reviewed their permissions and connection status to understand what access was in place. That lets us give customers specific information about the applications in their environment and flag what warrants a closer look.

A few things to keep in mind. Our findings reflect the activity and logs available for the period we examined. And confirming whether an integration is still needed takes input from the people who use and manage it — your team knows which services support current operations and which have been replaced.

Make Integration Reviews Part of Your Routine

Education and government IT teams often inherit integrations from past projects, vendor transitions, and staffing changes. The access granted to those tools can remain long after the original need has passed.

We recommend regularly reviewing the integrations in your environment and removing access that no longer has a legitimate business purpose. For each application, confirm who owns it, whether it’s still in use, and whether its permissions match what it actually needs to do.

• Unused integrations: Confirm that no current workflow depends on them, then remove their permissions or delete the applications.
• Overly privileged integrations: Reduce permissions to what the service actually requires. If the access can’t be justified or safely reduced, plan to retire or replace the integration.
• Unrecognized integrations: Identify who authorized them and what they support. If there’s no approved business purpose, remove their access. Bring suspicious applications to your Guardian 365 team so we can help investigate and preserve relevant evidence before anything is deleted.

Some integrations do support critical services, so coordinate changes with the service owner and confirm dependencies before removing access.

Microsoft: Review and revoke application permissions in Entra ID

If you still need an affected SkyKick / ConnectWise integration, follow ConnectWise’s guidance on when and how to safely restore functionality.

We’re Here to Help

If you’d like help reviewing the applications in your environment or working through these recommendations, reach out to your Guardian 365 team. We can help you understand the access currently in place, review proposed changes, and assess application usage patterns for potential risk.

Not a Guardian 365 Customer Yet?

You don’t have to sort through every advisory on your own. A free security assessment gives you a clear picture of where your Microsoft 365 environment stands today and what to prioritize first.

Guardian 365 provides 24×7×365 managed security operations built around the Microsoft security ecosystem you already own, so your team gets expert eyes on threats without building a full security operation in-house.

We make security easy.