Microsoft’s 11 Checks After the AI-Driven ConnectWise Breach

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and says nothing about Microsoft, ConnectWise, Storm-0940 or any company in this piece.

What Microsoft Tells Customers to Check

Microsoft Threat Intelligence’s report of 21 October 2026 on Storm-0940, which it calls “a China-state aligned actor,” includes a list of 11 “Immediate actions” for organisations that used the affected ConnectWise Cloud Backup applications. Microsoft says the actor used the agentic AI framework ARTEX “to attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute.” We covered the attack itself in our Storm-0940 piece. This piece is about the checklist, and about why the check falls to each customer rather than to the vendor.

The first two items set the tone. Microsoft says: “Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions.” Then: “Do not delete enterprise applications as the first response. Preserve configuration and evidence before making irreversible changes.”

Much of the list is about service principals. A service principal is the identity an application uses to sign in on its own, without a person typing a password. Microsoft says the actor abused applications “that had already been granted access,” which “allowed the threat actor to operate without requiring an interactive user sign-in.”

The 11 Immediate Actions, Grouped

The grouping below is ours; the quoted passages in the right-hand column are Microsoft’s own wording from the report.

Why the Backdoor Can Outlive the Fix

Microsoft says the actor’s agents went beyond signing in. In some environments it observed “application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.”

That is why the order of the steps matters. Microsoft warns that such changes “can remain active as a backdoor even after the original compromised application is mediated.” Switching off the vendor’s app, in other words, does not by itself remove what an intruder may have added.

Microsoft also keeps two caveats. It says “the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated,” and that the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.”

What ConnectWise Says It Did

ConnectWise’s own status page tells the vendor side. On 16 October it said it was “investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment.” Early on 17 October it said it was “shutting off Cloud Backup application access. This will interrupt backup services for customers until further notice.”

Later that day it said it had “suspended Cloud Backup service by revoking certificates used for affected application connections across all users,” and that “Cloud Backup archives remain encrypted and isolated.” On 20 October it said it had “completed an account and credential reset in the affected Cloud Backup environment.” On 21 October it said it had “begun restoring services in controlled phases,” and in its latest update, posted at 00:52 UTC on 22 October: “We expect restoration to take several days.”

By our count from those timestamps, the backup service was interrupted for more than four days before phased restoration began.

Why the Check Falls to Customers

The clearest line on who does the checking is ConnectWise’s own: “By design, the configuration of Cloud Backup does not provide us visibility or access to downstream partner and customer environments. As a result, we cannot determine through our investigation alone whether a particular customer’s Microsoft 365 environment experienced unauthorized activity.”

Microsoft’s longer-term advice points the same way. It asks organisations to “Apply least privilege to multi-tenant application permissions and consent grants” and to “Verify that vendor credential rotation and any tenant-level remediation eliminated remaining unauthorized access.” Least privilege means giving each application only the access its job needs.

Connecting the Coverage

Our Storm-0940 piece of 21 October covered the attack side of the same report: Microsoft’s account of ARTEX, the more than 2,250 tenants and the multiple cases of under three hours from targeting to privileged access. Our Cloudflare PHP piece of the same day reported Cloudflare’s chief technology officer writing that “We are seeing early attacks emerging” hours before PHP’s fixes, and our Node.js piece covered the 10 vulnerabilities, four rated high, that Node.js fixed the same day.

What is new here is the defender side: the 11 steps Microsoft asks for, and the vendor’s statement that it cannot see into customer tenants.

The Structural Read

As we read it, the order of Microsoft’s steps carries the message: contain and preserve evidence first, because changes an intruder makes “can remain active as a backdoor even after the original compromised application is mediated.”

As we read it, ConnectWise’s line that Cloud Backup “does not provide us visibility or access to downstream partner and customer environments” is what moves the work to each customer’s own team.

As we read it, the attack ran at machine speed, while the response Microsoft describes is manual: inventories, audit records and a look-back to 1 October where records exist.

Three Implications

FOR IT AND SECURITY TEAMS Microsoft asks for review “starting from at least October 15, 2026” and says to “Search by application ID rather than display name.”

FOR COMPANIES BUYING SOFTWARE Microsoft asks organisations to “Apply least privilege to multi-tenant application permissions and consent grants,” which, as we read it, makes every vendor app with standing access a question for procurement as well as security.

FOR VENDORS WITH CLOUD INTEGRATIONS ConnectWise says it suspended its service “by revoking certificates used for affected application connections across all users,” and later that “We expect restoration to take several days.”

The Business Engineer Lens

This story maps onto the Business Engineer framework Enterprise AI: From Software to Substrate.

The framework’s core claim: “The value proposition shifts from features to integration depth.”

As we read it, this breach shows the cost side of that depth: a backup app woven into Microsoft 365 with standing access was, by Microsoft’s account, the route in, and switching it off interrupted the service itself. The framework was published in December 2025 and does not discuss Storm-0940 or ConnectWise.

What Is Not Established

Neither company has said how many customer environments had data accessed. ConnectWise has not given a date for full restoration, only “several days.” Microsoft’s attribution to Storm-0940 is its own assessment.

The Bottom Line

Microsoft’s list turns an AI-speed attack into an ordinary but long to-do list for each customer: contain without deleting, find every copy of the app by ID, keep the logs, look back to 1 October where possible, and remove changes only after evidence is preserved. ConnectWise says it cannot run that check for them.

95,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.

A note on sourcing. The checklist, figures and quotations come from Microsoft Threat Intelligence’s report of 21 October 2026 as it read on 22 October, and the vendor timeline from ConnectWise’s own status page. The grouping of Microsoft’s steps and the count of days are ours. We left out indicators, application IDs, queries and attack details. We did not contact either company. Nothing here is security or investment advice.

Sources: Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (21 Oct 2026) · ConnectWise status page: Cloud Backup incident updates (16-22 Oct 2026)