Which Apps Can Get Into Your Microsoft 365?

Laptop and tablet on a desk beneath a glowing cloud connected to document, calendar and email icons

Most small businesses think about passwords and who on staff can log in. But people aren’t the only ones with access to your Microsoft 365. Apps have access too.

Backup tools, management tools, and security tools often connect straight to your email, files, and Teams. That’s how they do their jobs. It also means that if one of those apps is misused, someone could get in without ever touching a password.

What Happened

This month, the security company Huntress reported that a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised. Huntress confirmed it was being used to get into customers’ Microsoft 365 environments without permission.

A backup service needs broad access. It reads mail, files, Teams, and directory data so it can copy them. Anyone holding that app’s credential gets the same access. And because it’s an app signing in, not a person, there’s no user and no multi-factor prompt to stop it.

Huntress also saw an attacker use one of these apps to give itself admin rights. It then added new credentials to other apps in the same account to keep a way back in.

Check Your Own Account

You don’t have to use this product to learn from it. Every business on Microsoft 365 should know which apps are connected. Here’s how to look:

  1. Sign in to the Microsoft Entra admin center with an admin account.
  2. Go to Enterprise applications.
  3. Look through the list. Ask yourself: do we know this app? Do we still use it?
  4. If you use ConnectWise or SkyKick tools, search for “SkyKick” and “ConnectWise.” In older accounts, they may show up as “SkyKick Cloud Manager.”
  5. For an app you need to stop, open Properties and set “Enabled for users to sign-in” to No.

Huntress advises disabling these apps, not deleting them. Deleting removes the consent, and you’d have to set it up again to restore service. Disabling a backup app pauses new backups, but your email, files, and sign-ins keep working.

Huntress also notes that disabling an app does not remove credentials an attacker may have already added. So it suggests a few more checks:

  • Review the client secrets and certificates on your Enterprise applications and App registrations. Remove anything you didn’t create.
  • If one of these apps holds an admin role you never gave it, remove that role after the app is disabled.
  • In the sign-in logs, check the Service principal sign-ins tab. The default tab only shows user sign-ins.

Not Sure Where to Start?

This can feel like a lot. That’s okay. Many Lawrenceville and Gwinnett businesses set up Microsoft 365 years ago and never looked at the app list again.

We help local businesses with managed IT and Microsoft 365 every day. Call us at 678-985-8222, or stop by 561 West Pike Street, Suite 100A, Lawrenceville, GA 30046. We’ll help you see what’s connected and what isn’t needed anymore. Learn more at wtcomputers.com.