Your Microsoft 365 Might Be Secure. But What About the Apps Connected to It?
Cyber security is no longer just about protecting your passwords, computers and emails. Sometimes, the biggest risk comes from something your business has already trusted.
Most businesses understand the importance of protecting Microsoft 365. Multifactor authentication, strong passwords, security policies and regular monitoring have become essential parts of keeping company information safe.
But there's another question that doesn't always get asked. What happens when a trusted third-party application becomes the security risk?
A recently reported cyber incident involving ConnectWise Cloud Backup has highlighted exactly why this matters.
What Happened with ConnectWise?
In October 2026, ConnectWise suspended several cloud services following a security incident involving credentials associated with its applications.
Security researchers reported unauthorised sign-ins across 173 Microsoft 365 tenants, with attackers allegedly using access associated with a trusted third-party application.
The incident is particularly concerning because it demonstrates a different route into business systems. Rather than necessarily compromising an individual employee's password, attackers can target the credentials and permissions used by software that businesses have already authorised.
ConnectWise has taken steps to contain the incident, and investigations into its full impact are ongoing.
The wider lesson extends far beyond one provider.
Your Business Is More Connected Than You Think
Think about how many applications your business relies on every day. Your accounting software might connect to Microsoft 365. Your CRM could synchronise contacts and emails. Backup services may access company files. Automation platforms might interact with calendars, documents and shared mailboxes.
These connections help businesses work efficiently, reduce administration and improve productivity. But every integration also creates a relationship of trust.
When an application connects to your Microsoft 365 environment, it may be granted permission to access information or perform actions on behalf of your organisation.
Some permissions are limited. Others can be extensive. And depending on how the application is configured, those permissions may remain active long after the original reason for connecting it has disappeared.
The question isn't whether connected applications are useful. It's whether your business understands what access they have.
A Secure Password Doesn't Protect Every Door
Businesses invest considerable time in educating employees about phishing emails, password security and multifactor authentication. And rightly so. But these measures primarily address particular types of risk. An attacker using compromised application credentials may be able to authenticate through a different route, using permissions previously granted to the application.
That means an organisation could have strong employee account security while still being exposed through third-party access. It doesn't make passwords or multifactor authentication less important. It means they're only part of the picture.
Cyber security needs to protect more than the people signing into your systems. It needs to consider the applications connecting to them too.
Who Is Actually Managing Those Connections?
Here's something worth asking your IT team or technology provider.
How many third-party applications currently have access to your Microsoft 365 environment?
Which of them can access company data?
Are those permissions reviewed regularly?
What happens when an application is no longer needed?
And would anyone notice if one of those applications suddenly started behaving unusually?
For many businesses, these questions aren't part of everyday conversations about IT.
New software gets introduced, permissions are approved and employees get on with their work. Over time, organisations can accumulate applications, integrations and access rights that nobody has properly reviewed. This is particularly relevant as businesses adopt more cloud services, automation platforms and AI-powered tools. The technology might be new, but the principle remains the same.
If something has access to your business, that access needs to be understood, managed and monitored.
The Problem With Trusting a Supplier Completely
Working with reputable technology providers is important. But no supplier can guarantee that it will never experience a security incident. Even established software companies with dedicated security teams can become targets.
This is why businesses should think about third-party cyber security as an ongoing responsibility, rather than something that ends when a contract is signed.
That means understanding what a supplier can access, how that access is controlled and what would happen if the supplier experienced a security incident. It also means considering business continuity.
If a cloud service suddenly becomes unavailable, could your organisation continue operating? Would your data remain protected? Is there a clear recovery plan?
These aren't questions designed to discourage businesses from using technology. They're questions that help businesses use it responsibly.
What Should Businesses Be Doing?
The starting point is visibility. Businesses should have a clear understanding of the applications connected to their systems, particularly those with access to sensitive information or important business services. Permissions should be appropriate for what each application needs to do, rather than granting unnecessarily broad access. Unused integrations should be reviewed and removed where appropriate. Security monitoring should also consider application activity, not just employee sign-ins. And organisations should have clear processes for responding when a technology supplier reports a security incident.
For businesses without an internal IT department, this is exactly the kind of conversation worth having with their managed IT provider.
Not every organisation needs to understand the technical detail behind application permissions. But every organisation should know that someone is taking responsibility for them.
Proactive IT Support Means Looking Beyond the Obvious
At Sunrise Technologies, we believe good IT support is about more than responding when something goes wrong.
It's about understanding the technology a business depends on, identifying potential risks and helping organisations make informed decisions before those risks become problems.
The ConnectWise incident is another reminder that cyber security is constantly evolving.
Protecting your employees, devices and Microsoft 365 accounts remains essential.
But so does understanding the wider technology environment around them.
The applications. The integrations. The permissions. The suppliers.
Because sometimes the biggest security concern isn't an unknown attacker trying to break down your defences.
It's the access your business has already granted.
Is Your Business as Secure as You Think?
Do you know which applications have access to your Microsoft 365 environment, what permissions they hold and whether those permissions are still necessary?
If you're unsure, it may be time to review your wider IT and cyber security arrangements.
Speak to Sunrise Technologies about taking a more proactive approach to protecting your business.