A backup application identity owned by the vendor puts two jobs under one identity: running your backups and, once its credential is exposed, signing an attacker into your Microsoft 365 tenant. ConnectWise Cloud Backup shows what that costs when the vendor contains the identity: the service was suspended with it. Every fact below is frozen as of the ConnectWise advisory update of Friday, October 23, 2026 at 01:00 UTC, and that advisory now updates daily.

The claim is narrow. ConnectWise has not published the permissions Cloud Backup holds, says the original credential-exposure mechanism is under investigation, and has not established whether a product vulnerability contributed. The argument depends on none of that. It depends on two documented facts and one inference. The facts: the attacker authenticated through application identities associated with Cloud Backup, and ConnectWise's own containment suspended the service.…