Audit which third-party apps can act in your Microsoft 365 tenant
24 October 2026
The ConnectWise attack worked because a trusted multi-tenant app already had broad permissions. In the Entra admin center, open Enterprise apps, pick each vendor app and check its Permissions tab for admin-consented access; revoke what you no longer use, and remove apps for services you've dropped.
Based on reporting by Microsoft Learn. Read their full coverage for details.