Microsoft 365: ConnectWise or SkyKick Apps Holding Directory Roles
S
Shawn Sailer
Huntress reports that the compromised ConnectWise Cloud Management apps assigned themselves directory roles in affected tenants, mostly Exchange Administrator and Global Administrator in one tenant. Disabling the apps does not remove a role assignment, so check which roles they hold. This metric lists directory roles that have a ConnectWise Cloud or SkyKick service principal as a member. Role members are matched by display name because role membership does not include the Application ID. A match doesn't mean a tenant was accessed, but any ConnectWise or SkyKick app holding a role should be reviewed immediately.
Metric 1: Microsoft 365: ConnectWise or SkyKick Apps Holding Directory Roles
Description: Lists directory roles held by a ConnectWise Cloud or SkyKick service principal. Alert above 0, then review in the Entra audit log and disable (don't delete) the app.
Query:
Roles[?Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))]].{Role: displayName, Apps: Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))].displayName}
Metric 2: Microsoft 365: Count of ConnectWise or SkyKick Apps Holding Directory Roles
Description: Count of directory roles held by a ConnectWise Cloud or SkyKick service principal. Alert above 0, then review in the Entra audit log and disable (don't delete) the app.
Query:
length(Roles[?Members[?isServicePrincipal==`true` && (contains(displayName || '', 'SkyKick') || contains(displayName || '', 'ConnectWise Cloud'))]] || `[]`)
Metric 3: Microsoft 365: Service Principals Holding Directory Roles
Description: Lists all service principals (apps) holding any directory role. Use to review non-human role assignments.
Query:
Roles[?Members[?isServicePrincipal==`true`]].{Role: displayName, ServicePrincipals: Members[?isServicePrincipal==`true`].displayName}
What to do: alert on a count above 0. Review when each role was assigned using the Entra audit log (Add member to role), remove the assignment if it is unexpected, and disable the app rather than deleting it. Do not re-enable it until ConnectWise confirms credentials have been reset. Follow Huntress and ConnectWise for current guidance.