Every vendor app you consent in Microsoft 365 is a loaded credential: whoever holds the vendor's secret inherits your permissions. In October 2026, one stolen ConnectWise secret reached 173 tenants. Add your vendor apps below, tick their permissions, and get your blast-radius score — with least-privilege fixes.
Direct answer: Third-party app risk is the blast radius of permissions you grant vendor apps. In October 2026, one stolen ConnectWise Cloud Backup credential gave attackers access to 173 Microsoft 365 tenants — because consented apps inherit broad mailbox, file, and directory access everywhere they're installed. Map your own exposure: list vendor apps and permissions below.
Add each vendor app consented in your tenant(s), tick its permissions, and set roughly how many tenants it is installed in. Then score.
In October 2026, a stolen credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to sign in to 173 Microsoft 365 partner and customer tenants. The attacker authenticated as the trusted application (AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) from IP 144.172.64[.]128 on October 15, 2026, and inherited the broad permissions customers had already consented — mailboxes, OneDrive, SharePoint, Teams, and directory data. No user passwords were needed.
The total data and access an attacker gains if one vendor app's credential is stolen: every permission the app holds, multiplied by every tenant where it is consented. A backup app with mailbox and directory access installed in 100 tenants is 100 tenants of exposure from a single secret — which is exactly what the ConnectWise incident demonstrated.
Review Microsoft Entra sign-in logs for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, look for authentications from non-standard IPs (the attacker used 144.172.64[.]128), hunt for newly added credentials on service principals, and check for privilege escalations such as the app granting itself Global Administrator. ConnectWise disabled 7 app identities and closed Cloud Backup access in response.
No. This is a manual self-assessment: you list your vendor apps and tick their permissions, and the mapper scores the blast radius from that input. It cannot see your real Entra consents. Use it to prioritize a real review in the Microsoft Entra admin center, where every consented app and permission is listed.
Honest scope: incident facts are drawn from the linked Cybersecurity News and Hacker News reports (October 2026). Blast-radius scores are heuristic weights for prioritization, not measurements of your tenant. Verify all consents in the Microsoft Entra admin center.
Ingenious AI publishes 21 live security platforms, and 100% of them run on permanent getingeniousai.com domains.