The Canvas Breach Reached Further Than You Think.

If your institution uses Canvas and Microsoft 365, the risk didn’t stop at Instructure. It’s sitting in your Entra ID tenant right now — and most teams don’t know it’s there.

Is Your Microsoft 365 Environment Protected?

On May 1, 2026, Instructure disclosed a major security breach affecting Canvas LMS. ShinyHunters claimed responsibility. Within hours, Guardian 365 was already running threat hunts, elevating SOC monitoring, and evaluating custom detections across every customer environment we protect.

We’ve seen no confirmed compromise in our customer community. We intend to keep it that way.

But if you’re an education institution running Canvas alongside Microsoft 365 — and you haven’t audited your Entra ID integrations — now is the time. Canvas establishes deep connections in your tenant through LTI tools, SAML-based single sign-on, service principals, and app registrations. Those connections don’t disappear when a vendor has a bad day.

What you’ll get when you connect with our team:

• A plain-language breakdown of what the Canvas breach means for your Microsoft 365 environment
• Guidance on the specific Entra ID entities to review right now
• An honest assessment of your risk posture — no sales pressure
• Answers to whatever questions your leadership is already asking

Knowing what’s there and acting decisively is what separates a contained risk from a larger problem. Our team is ready to help you navigate that — on your timeline, at your pace.

Talk to a Guardian 365 Expert