A verifiable identity can carry permissions worth stealing.

For the administrator whose ConnectWise cloud backup stopped, containment had an immediate consequence. The service was halted during the investigation. Recovery had acquired a dependency of its own.

ConnectWise said on Saturday that it had disabled seven application identities while investigating unauthorized access. Its cloud backup service was halted. That establishes a containment action, without establishing that all seven identities were compromised. Customers still lost their cloud backup service.

A Microsoft technical post published on October 16 describes how a third party can verify Entra-issued agent identity and authorization records offline, without Microsoft credentials or access to the originating systems. That is useful evidence about identity and recorded authority. It cannot establish that every action taken under that authority is legitimate. Valid credentials can authorize damaging actions.

The Microsoft post concerns agent identities; ConnectWise's disclosure concerns application identities. There is no supplied evidence connecting the incident to agents. The operational connection is the permission: verifying who holds it leaves the separate question of what that holder can do.

Restricting application permissions to the minimum required limits what stolen access can reach. Revoking access cuts off the service using it. At ConnectWise, containment left customers without their cloud backup service.