ConnectWise Microsoft 365 app compromise (Storm-0940, October 2026): stolen ConnectWise multi-tenant app credentials used against 2,250+ Microsoft 365 tenants without user sign-in. How do I check my tenant and contain it?

What happened: Microsoft attributed an October 2026 supply chain attack on ConnectWise customers to the China-aligned actor Storm-0940, which used the ARTEX agentic AI framework to automate it. The attacker obtained credentials for ConnectWise's multi-tenant Microsoft Entra applications and used them to authenticate as those apps (service principal sign-ins, no user and no MFA) into Microsoft 365 tenants where customers had consented to them. More than 2,250 tenants were targeted after ConnectWise discovered the compromise on October 15; in some cases the attacker reached privileged access within three hours. ConnectWise published advisories from October 16. Am I affected: - Your tenant has (or had) any of these ConnectWise enterprise applications: app ID 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (Teams integration), 0de14c77-b9b0-4137-9360-34878a929827 (Graph integration). Check Entra admin center, Enterprise applications, filtered by these application IDs. MSPs should check every customer tenant. - In Entra sign-in logs, view Service principal sign-ins for those app IDs from October 1 onward, successful and failed, including from 144.172.64.60, 144.172.64.99 and 144.172.64.128. - In audit logs and Graph activity logs: directory and permission enumeration, new credentials added to service principals or apps, role assignments (especially Global Administrator), mailbox and Teams data access by those apps. Fix: 1. Disable sign-in for the affected ConnectWise enterprise applications (don't delete them yet, to keep evidence) until ConnectWise confirms they're restored, and follow ConnectWise's remediation guidance. 2. If you find malicious activity: remove credentials the attacker added, revoke role assignments they made, revoke sessions for affected admins, and rotate any secrets or keys the apps could read. 3. Reduce third-party app permissions to the minimum, and apply Conditional Access for workload identities (for example restrict service principal sign-ins to the vendor's known IP ranges) where your licensing allows. After: keep alerting on new credentials added to service principals, new privileged role assignments and unusual service principal sign-ins, and review every multi-tenant app consented in your tenant, not only ConnectWise's. Sources: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/ https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html