Consented applications are the software supply chain nobody audits

Consented applications are the software supply chain nobody audits. Supply chain risk in software usually means a build system, a package registry or an update channel. The ConnectWise Cloud Backup incident shows a different link in the same chain: the credential a SaaS provider holds on your behalf after you click approve on a consent screen.

On 15 October 2026 a compromised credential belonging to that application was used to sign in to 173 partner and customer tenants of managed service providers. Huntress traced the activity to 144.172.64[.]128 between 06:13 and 08:34 UTC.

The applications were installing correctly, updating correctly and behaving exactly as designed. The trust relationship itself was the attack surface.

Why consent behaves like a dependency

When an MSP consents to a backup application, it grants standing access to mail, files, chats and directory data across every tenant where the app is deployed. That grant persists until someone removes it. Nothing in a typical procurement process reviews it after installation, and nothing in a typical vulnerability scanner looks at it.

The comparison with a software dependency is close. Both are third-party components, both are approved once and used continuously, and both become dangerous when the upstream party loses control of a credential. The difference is that a compromised library announces itself through crashes and odd behaviour, while a compromised application secret produces valid sign-ins.

The audit trail that procurement should request

Three questions belong in a vendor review for any application that will hold standing access to Microsoft 365 data.

• Which secret or certificate does the application use to authenticate, and what is its rotation interval with evidence attached?
• Does the vendor notify customers when that secret is suspected compromised, within what timeframe?
• Can the application's credential be scoped so that read access to backups is separate from directory administration?

The last question would have limited the escalation Huntress described, where a separate ConnectWise app added itself to Global Administrator and planted new client secrets on an MSP management application and on a security platform application.

What the public measurements add

The population that consumes these integrations is large and externally visible. ZoomEye queries on 26 October 2026 counted 133,507 pages for title="ConnectWise", 78,257 assets for app="ConnectWise Automate", and 570,656 assets for app="Microsoft Exchange" on the Microsoft side. Those numbers describe reachable tooling and reachable mail infrastructure, not compromised tenants.

The staging address, ip="144.172.64.128", returned 0 results at collection time. Supplier infrastructure that is retired after use becomes invisible to measurement long before the consent grants it exploited are cleaned up, which is a useful argument for auditing configuration instead of chasing addresses.

The rotation lesson

Todyl noted that tokens already issued stay valid for up to 90 minutes after an application is disabled, and that revoking user sessions does nothing to this access. Both facts point at the same conclusion. The party that can rotate the credential is the party that actually controls the exposure, and every customer action is a partial mitigation.

That imbalance is what a supply chain contract is for. A vendor that holds standing access should commit to rotation on a defined schedule, to notification within hours rather than days, and to a documented disablement path that customers can test. Those commitments cost nothing until they are needed.

References

• Huntress, vendor credential enables unauthorized access: https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
• Todyl investigation into unauthorized access through the ConnectWise Cloud Backup Microsoft 365 app: https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app
• ConnectWise trust advisories: https://www.connectwise.com/company/trust/advisories