Overview ✨
Huntress has reported unauthorized access involving ConnectWise Cloud Backup and ConnectWise Cloud Management applications in certain Microsoft 365 tenants. According to Huntress, affected Cloud Management apps assigned themselves directory roles, primarily Exchange Administrator and, in one case, Global Administrator. Additional client secrets were also added to other applications.
Since these applications have been renamed, searching only for SkyKick may miss relevant apps. Liongard's metrics primarily identify them using Application IDs, with display-name matching as a fallback where needed.
⚠️ Important: Huntress recommends disabling affected applications rather than deleting them, because deleting removes consent. Do not re-enable them until ConnectWise confirms that credentials have been reset. Continue following the latest Huntress and ConnectWise guidance.
Liongard provides eight Microsoft 365 metrics to help identify these applications, review their assigned directory roles, and detect credentials added within the last 30 days.
ℹ️ These metrics are not enabled by default and must be added from the Metrics Library. For count-based metrics, configure alerts when the value is greater than 0. A match indicates that an application or assigned access requires review, not necessarily that the tenant has been compromised.
Metrics Available
All eight metrics are for the Microsoft 365 inspector and are published in the Liongard Metrics Library.
Metric Name | What it Returns | Primary Use |
Lists directory roles held by a ConnectWise Cloud or SkyKick service principal | Review affected roles | |
Count of those role assignments | Alert above 0 | |
Lists all service principals holding any directory role | Review non-human role assignments | |
Lists app registrations with a client secret or certificate added in the last 30 days | Review against change records | |
Count of those app registrations | Alert above 0 | |
Lists installed ConnectWise Cloud Backup (formerly SkyKick) and Cloud Management apps with enabled state | Review app presence and status | |
Count of those apps in any state | Alert above 0 to find every tenant with the apps | |
Count of those apps still enabled | Alert above 0 to find tenants that still need the apps disabled |
🗒️ Recommended starting point: Use the count metrics first to identify which tenants need attention, then open the matching list metrics to see the specific apps, roles, or credentials involved.
How to Add the Metrics to Your Liongard Instance
The queries and descriptions are published as three posts in the Liongard Metrics Library:
Microsoft 365: ConnectWise or SkyKick Apps Holding Directory Roles - metrics 1, 2, and 3
Microsoft 365: App Registrations With Recently Added Credentials - metrics 4 and 5
Microsoft 365: ConnectWise Cloud Backup and Cloud Management Apps Present - metrics 6, 7, and 8
To add a metric:
In Liongard, go to Admin > Metrics and select Add Metric.
Choose the Microsoft 365 inspector and enter the metric name.
Select a system and a recent timeline entry, then paste the query from the Metrics Library post into the Data Print Query field.
Review Query Results to confirm the query returns the expected data.
Turn on Metric Display so the metric appears in Liongard, then save the metric.
Repeat these steps for each metric you want to add.
ℹ️ Full metric creation instructions are available in How to write a metric.
How to Use the Above Metrics
The following workflow helps you identify Microsoft 365 tenants containing ConnectWise Cloud Backup (formerly SkyKick Backup) or ConnectWise Cloud Management applications, assess their permissions, investigate recently added credentials, and verify remediation.
Before you begin: Ensure the required metrics have been added to your Liongard instance under Admin → Metrics and enabled for display. Metrics from the community Metrics Library must be added in your instance before they can be used.
1. Identify tenants where ConnectWise Cloud applications are present
1. Identify tenants where ConnectWise Cloud applications are present
Start with Microsoft 365: Count of ConnectWise Cloud Apps Present to identify tenants containing matching ConnectWise Cloud Backup, ConnectWise Cloud Management, or formerly SkyKick applications.
Configure an Actionable Alert using the greater than (>) operator with a threshold of 0, or review the metric results manually.
A value above 0 indicates that at least one matching application exists, regardless of whether it is enabled or disabled.
For matching tenants, review Microsoft 365: ConnectWise Cloud Backup and Cloud Management Apps Present to identify the applications and their current enabled status.
This provides a broad inventory of potentially affected tenants, including those where the applications have already been disabled.
Reference: How to Write a Custom Actionable Alert Rule
2. Prioritize tenants with enabled applications
2. Prioritize tenants with enabled applications
Next, review Microsoft 365: Count of Enabled ConnectWise Cloud Apps.
A value above 0 indicates that one or more matching applications remain enabled.
Prioritize these tenants for review, as enabled applications may still be capable of authenticating, depending on their credentials and access configuration.
Use the related application list metric to identify the specific applications before taking action in Microsoft Entra.
⚠️ Important: An enabled application does not confirm unauthorized access. However, given the reported activity, its presence warrants prompt investigation.
3. Review Microsoft Entra directory role assignments
3. Review Microsoft Entra directory role assignments
Use Microsoft 365: Count of ConnectWise or SkyKick Apps Holding Directory Roles to identify matching applications with assigned directory roles.
Configure an alert when the count is greater than 0.
Review Microsoft 365: ConnectWise or SkyKick Apps Holding Directory Roles to identify the service principal and assigned roles.
Pay particular attention to privileged roles such as Exchange Administrator and Global Administrator.
Validate these assignments in Microsoft Entra and determine whether they are expected and authorized.
For a broader security review, use Microsoft 365: Service Principals Holding Directory Roles to identify other non-human identities with directory role assignments.
‼️ Any unexpected or unauthorized assignments should be investigated and remediated according to your organization's incident response procedures.
4. Investigate recently added application credentials
4. Investigate recently added application credentials
Review Microsoft 365: Count of App Registrations With Recently Added Credentials to identify app registrations where client secrets or certificates were added within the last 30 days.
Configure an alert when the count is greater than 0.
Open Microsoft 365: App Registrations With Recently Added Credentials to identify the matching registrations and available credential details.
Compare the results against approved changes, application maintenance, and credential rotation activities.
Investigate credentials that cannot be linked to an authorized change.
‼️ Note: This metric is not limited to ConnectWise applications. It identifies recently added credentials across the collected app registrations, so legitimate credential updates may also appear.
5. Validate findings before taking action
5. Validate findings before taking action
For every tenant flagged by these metrics, review the corresponding list metrics and the latest Microsoft 365 inspection data.
Confirm the following:
Which application or service principal triggered the result.
Whether the application is currently enabled.
Whether it holds any privileged directory roles.
Whether recently added credentials are expected or authorized.
Whether the finding has already been investigated or remediated.
Use the Microsoft 365 Inspector's Data Print to review the underlying collected information where additional context is required.
Document the findings and classify each result as expected, already remediated, or requiring further investigation.
6. Remediate in Microsoft Entra and verify the results in Liongard
6. Remediate in Microsoft Entra and verify the results in Liongard
If an application, role assignment, or credential is determined to be unauthorized, follow your organization's incident response procedures and the latest Huntress and ConnectWise guidance.
⚠️ Important: Huntress recommends disabling affected applications rather than deleting them initially, to preserve consent history. Do not re-enable them until ConnectWise confirms that the relevant credentials have been reset.
After remediation:
Confirm that the required changes have been applied in Microsoft Entra.
Trigger a new Microsoft 365 inspection or wait for the next scheduled inspection.
Verify that the inspection completes successfully.
Review the relevant count and list metrics again.
Confirm that the updated results reflect the changes made in Microsoft Entra.
Liongard metrics are read-only and reflect the data collected during the most recent successful inspection. They do not disable applications, remove role assignments, or delete credentials automatically.
ℹ️ These metrics read from the latest Microsoft 365 inspection. Results reflect the state of the tenant at the time of the last successful inspection. The metrics do not make any changes in the customer tenant.
What the Metrics Can & Cannot Do
✅ What they can show
| ❌ What they cannot show
|
Additional Limitations and Considerations
Directory Role Matching: The role metrics identify service principals by display name, rather than Application ID, because directory role membership data does not include Application IDs.
Legitimate Credential Changes: The recently added credentials metric may also detect expected activities, such as routine certificate rotations for Microsoft Entra Connect Sync.
Further Investigation: Use Microsoft Entra audit logs and sign-in logs to verify who made changes, when they occurred, and whether any related sign-in activity took place.
What If a Metric Returns a Match
A matching result indicates that an application is present or has assigned access that requires further investigation. It does not necessarily indicate unauthorized access or compromise.
In the affected customer's Microsoft Entra admin center, follow these steps:
Disable affected applications: Navigate to Enterprise applications, select the relevant application, open Properties, and set Enabled for users to sign-in? to No.
Do not delete the applications: Deleting an application removes consent. Disable it instead.
Keep applications disabled: Do not re-enable them until ConnectWise confirms that the relevant credentials have been reset.
Review directory role assignments: Check Microsoft Entra audit logs for Add member to role events. Investigate and remove any unauthorized or unexpected role assignments.
Investigate application credentials: Review client secrets, certificates, application owners, and permissions. Validate recent changes against approved activities and remove any unauthorized credentials.
⚠️ Important: Disabling an application does not automatically remove its existing directory role assignments or credentials added to other applications. These must be investigated and remediated separately in each affected tenant, following your organization's incident response procedures.
Application IDs Covered by the Metrics
The Liongard metrics identify the following ConnectWise Cloud Backup and ConnectWise Cloud Management applications primarily by their Application IDs. Where applicable, additional matching is performed using display names containing SkyKick or ConnectWise Cloud, or the publisher name ConnectWise S-K.
Application Name | Application ID |
ConnectWise Cloud Backup |
|
Cloud Management |
|
Cloud Management – MS Teams |
|
Cloud Management – Exchange Online |
|
Cloud Management – MS Graph |
|
Cloud Management – Partner Center |
|
Cloud Management – SharePoint Online |
|
⚠️ Note: Application ID matching helps identify these applications even if their display names have changed. However, metrics that evaluate directory role membership rely on display-name matching, since the collected role membership data does not include Application IDs.
When to Contact Liongard Support 🦁
Contact Liongard Support if you have followed the steps in this article but are unable to add, configure, or retrieve the Microsoft 365 security metrics used to identify ConnectWise Cloud Backup, ConnectWise Cloud Management, or SkyKick applications.
Liongard Support can assist with metric configuration, inspection data collection, and interpreting metric results. For questions involving confirmed unauthorized access, application remediation, or incident containment, consult your security team and the latest guidance from Huntress and ConnectWise.
ℹ️ Partner guidance: A metric match does not necessarily indicate that a tenant has been compromised. Similarly, a metric returning no results does not guarantee that a tenant is unaffected. Always validate findings against Microsoft Entra application data, audit logs, and the latest vendor security advisories.
Reach out to Support when:
1. The security metrics are missing or cannot be added
1. The security metrics are missing or cannot be added
You cannot locate or successfully create the ConnectWise/SkyKick metrics using the queries provided in the Metrics Library.
Support can help verify the metric configuration, query structure, and any errors encountered while creating the metrics.
2. A metric returns unexpected or incomplete results
2. A metric returns unexpected or incomplete results
You can confirm that a ConnectWise Cloud Backup, Cloud Management, or SkyKick application exists in Microsoft Entra, but the corresponding Liongard metric does not identify it.
Support can help review the Application ID, display-name matching criteria, and available Microsoft 365 Inspector data.
3. Directory role assignments are not appearing as expected
3. Directory role assignments are not appearing as expected
Microsoft Entra shows directory roles assigned to an application, but the corresponding Liongard role metric does not return the expected results.
Keep in mind that the directory role metrics rely on display-name matching rather than Application IDs, which may affect detection when application names differ.
4. Recently added credentials are missing or appear incorrect
4. Recently added credentials are missing or appear incorrect
You have identified recently added application credentials in Microsoft Entra, but the Liongard metric does not reflect them as expected.
Support can help validate the metric's 30-day lookback period, query logic, and underlying inspection data.
5. Microsoft 365 inspection data is missing or outdated
5. Microsoft 365 inspection data is missing or outdated
The Microsoft 365 Inspector has failed, has not completed successfully, or is not collecting the data required by these metrics.
Support can help troubleshoot inspection failures and determine whether the available data is sufficient for metric evaluation.
6. Metric results do not update after remediation
6. Metric results do not update after remediation
You have disabled the affected applications or removed unauthorized access in Microsoft Entra, but the Liongard metrics continue to display the previous results.
Verify that a new Microsoft 365 inspection has completed successfully. If the results remain unchanged, contact Support for assistance.
What to Include in Your Support Request
To help Liongard Support investigate efficiently, provide:
Liongard instance name or URL and the affected customer environment(s).
Microsoft 365 Inspector name and the approximate time of the most recent successful inspection.
Metric name(s) experiencing the issue, including any relevant Metrics Library links.
Expected versus actual results, such as an application visible in Microsoft Entra but missing from the corresponding metric.
Screenshots of the metric results, relevant Microsoft Entra application details, and any error messages.
Application ID and display name of the affected application, where applicable.
Troubleshooting steps already completed, including whether the metric was added successfully and whether a new inspection was performed.
Frequently Asked Questions
How can I identify customers with ConnectWise Cloud or SkyKick applications?
How can I identify customers with ConnectWise Cloud or SkyKick applications?
Use Microsoft 365: Count of ConnectWise Cloud Apps Present. A value greater than 0 indicates that at least one matching application exists in the tenant, whether enabled or disabled. Review Microsoft 365: ConnectWise Cloud Backup and Cloud Management Apps Present to identify the specific applications.
How do I find tenants where the ConnectWise or SkyKick apps are still enabled?
How do I find tenants where the ConnectWise or SkyKick apps are still enabled?
Use Microsoft 365: Count of Enabled ConnectWise Cloud Apps. A value greater than 0 indicates that at least one matching application remains enabled and should be prioritized for review.
Does a metric match confirm that a tenant was compromised?
Does a metric match confirm that a tenant was compromised?
No. A match indicates that an application is present or has assigned access requiring investigation. It does not confirm unauthorized access, compromise, or data exposure.
Why doesn't searching for SkyKick always find the apps?
Why doesn't searching for SkyKick always find the apps?
The apps have been renamed to ConnectWise Cloud Backup and ConnectWise Cloud Management. The “apps present” metrics (6, 7 and 8) match on Application ID first, with a name fallback, so they find the apps even after the rename. The directory role metrics (1, 2 and 3) match by display name because role membership does not include the Application ID.
Should I delete the affected applications?
Should I delete the affected applications?
No. Huntress recommends disabling the applications rather than deleting them, because deleting removes consent. Do not re-enable them until ConnectWise confirms that credentials have been reset.
Is disabling the applications sufficient?
Is disabling the applications sufficient?
No. Disabling an application does not remove existing directory role assignments or credentials added to other applications. Review and remediate these separately in each affected tenant.
Why does the recently added credentials metric include Microsoft Entra Connect Sync?
Why does the recently added credentials metric include Microsoft Entra Connect Sync?
The metric may identify legitimate activities, such as routine certificate rotations performed by Microsoft Entra Connect Sync. Review each finding against authorized changes before treating it as suspicious.
Why do the directory role metrics use display names instead of Application IDs?
Why do the directory role metrics use display names instead of Application IDs?
The collected directory role membership data does not include Application IDs for role members. Therefore, these metrics use display-name matching, such as SkyKick or ConnectWise Cloud. The broader Microsoft 365: Service Principals Holding Directory Roles metric can help identify additional applications.
Can I modify the 30-day credential lookback period?
Can I modify the 30-day credential lookback period?
Yes. When creating a custom metric using the provided query, adjust the value 30 wherever the lookback period is referenced to increase or decrease the timeframe.
Are these metrics available in Liongard by default?
Are these metrics available in Liongard by default?
No. You must add the required metrics from the Metrics Library by navigating to Admin → Metrics → Add Metric and using the corresponding metric queries.
Do these metrics support tenants monitored through CIPP?
Do these metrics support tenants monitored through CIPP?
Not currently. Tenants monitored exclusively through the CIPP Inspector are not covered because it does not collect the enterprise application data required by these metrics.
Can the metrics identify who changed a role or credential, or when someone signed in?
Can the metrics identify who changed a role or credential, or when someone signed in?
No. These metrics do not provide audit events, sign-in activity, or source IP addresses. Use Microsoft Entra audit logs and sign-in logs to investigate those details.
Can the metrics detect applications that have already been deleted?
Can the metrics detect applications that have already been deleted?
No. The metrics evaluate applications present in the latest successfully collected Microsoft 365 inspection data. Applications deleted before the inspection are not detected.
References ⭐️
1. Huntress: Security Investigation and Remediation
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks – Huntress
Detailed security investigation covering unauthorized Microsoft 365 access, affected ConnectWise/SkyKick applications, directory role assignments, newly added application credentials, indicators of compromise, and recommended remediation steps.
2. ConnectWise: Official Security Advisories and Updates
ConnectWise Trust Center – Security Advisories
Official incident updates, affected Application IDs, technical investigation and remediation guidance, and recommendations for reviewing Microsoft Entra applications, credentials, permissions, and audit logs.ConnectWise – Cloud Backup Service Status
Ongoing updates regarding the Cloud Backup security incident, containment measures, service availability, and restoration progress.ConnectWise – Cloud Backup Technical Investigation and Remediation Webinars
Technical walkthroughs covering Microsoft Entra sign-in logs, audit logs, application registrations, credentials, and permissions.
3. Liongard: Microsoft 365 Security Metrics
4. Liongard: Metric Configuration Documentation
🚨 Note : We may occasionally provide links to third-party tools or resources for additional reference. These resources are offered for convenience only, and Liongard does not control, maintain, or guarantee their functionality, accuracy, or availability. Please review and use any third-party resources at your own discretion.