Third-Party App Risk: a Cybersecurity Blast-Radius Map

Every vendor app you consent in Microsoft 365 is a loaded credential: whoever holds the vendor's secret inherits your permissions. In October 2026, one stolen ConnectWise secret reached 173 tenants. Add your vendor apps below, tick their permissions, and get your blast-radius score — with least-privilege fixes.

What is third-party app risk?

Direct answer: Third-party app risk is the blast radius of permissions you grant vendor apps. In October 2026, one stolen ConnectWise Cloud Backup credential gave attackers access to 173 Microsoft 365 tenants — because consented apps inherit broad mailbox, file, and directory access everywhere they're installed. Map your own exposure: list vendor apps and permissions below.

Key facts — the ConnectWise / SkyKick incident

October 17, 2026: Microsoft Threat Intelligence disclosed an active supply-chain attack — a compromised credential for ConnectWise Cloud Backup (formerly SkyKick) used for unauthorized Microsoft 365 access. Source: Cybersecurity News.
173 partner/customer tenants with confirmed unauthorized sign-ins (Huntress). The attacker used app ID 506e08f9-6e9a-4da4-942b-a099a03644ae from 144.172.64[.]128 on Oct 15, 2026, 06:13–08:34 UTC, stepping through tenants seconds apart — a scripted run. Source: The Hacker News.
Why it worked: the attacker signed in as the trusted application — no passwords, no MFA prompts. Tokens carried the permissions customers had already approved: mailboxes, OneDrive, SharePoint, Teams, directory data.
Response: ConnectWise disabled 7 app identities and closed Cloud Backup access. Follow-on activity included attempts to add new credentials to service principals. Source: Cybersecurity News.

Map your blast radius

Add each vendor app consented in your tenant(s), tick its permissions, and set roughly how many tenants it is installed in. Then score.

Least-privilege remediation

Audit every consented app in the Microsoft Entra admin center — if you cannot name what an app does, revoke it.
Require admin consent workflow so no app gets broad permissions without a recorded approval.
Prefer delegated over app-only permissions wherever the workflow allows; scope app-only access to the minimum data.
Run periodic access reviews on third-party apps — permissions drift as vendors "need just one more scope."
Apply Conditional Access to workload identities — block service principals from unexpected IPs and locations.
Use app governance / Defender for Cloud Apps to flag over-privileged or unused apps automatically.
After any vendor incident: check sign-in logs for the app ID, hunt for newly added service-principal credentials, and verify no privilege escalations (e.g. self-granted Global Admin).

What this mapper does NOT do

It does not connect to your Microsoft 365 tenant or read your real Entra app consents.
Permission weights are a heuristic ranking for triage, not a vulnerability score.
It cannot detect an active compromise — for that, review sign-in and audit logs directly.
It is a self-assessment aid, not a security audit.

Cybersecurity FAQ

What happened in the ConnectWise Cloud Backup breach?

In October 2026, a stolen credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to sign in to 173 Microsoft 365 partner and customer tenants. The attacker authenticated as the trusted application (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) from IP 144.172.64[.]128 on October 15, 2026, and inherited the broad permissions customers had already consented — mailboxes, OneDrive, SharePoint, Teams, and directory data. No user passwords were needed.

What is a blast radius in app-consent terms?

The total data and access an attacker gains if one vendor app's credential is stolen: every permission the app holds, multiplied by every tenant where it is consented. A backup app with mailbox and directory access installed in 100 tenants is 100 tenants of exposure from a single secret — which is exactly what the ConnectWise incident demonstrated.

How do I check whether my tenant was affected by the ConnectWise incident?

Review Microsoft Entra sign-in logs for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, look for authentications from non-standard IPs (the attacker used 144.172.64[.]128), hunt for newly added credentials on service principals, and check for privilege escalations such as the app granting itself Global Administrator. ConnectWise disabled 7 app identities and closed Cloud Backup access in response.

Does this mapper connect to my Microsoft 365 tenant?

No. This is a manual self-assessment: you list your vendor apps and tick their permissions, and the mapper scores the blast radius from that input. It cannot see your real Entra consents. Use it to prioritize a real review in the Microsoft Entra admin center, where every consented app and permission is listed.