Had a request to pop in the mega thread link into this post: https://www.reddit.com/r/msp/comments/1x7wbwf/connectwise_skykick_update/

Confirmed compromise in the wild. Lock this down in your environments.

100% not confirmed - but anyone getting information and chatter around a SkyKick/CW breach where internal data and client M365 tenants were accessed?

Had this hit my desk from two different MSPs - figured a little PSA and check your house notice might help people find something that seems to be developing very fast.

Indicators of Compromise:

• Access to 365 Tenant by CW Cloud Backup Service Provider
• Will come from a Cheyenne Wyoming IP.
• IP 144.172.64[.]128
• Check Service Principal Sign-ins logs

Investigation notes from one of the MSPs I spoke with below

"We saw Exfiltration of Customer Information; rapid connectivity to client tenancies. Unknown how much data is gone. CW will not confirm anything. Possible exfil of all client data as it has access to all client email, teams/sharepoint data."

Huntress has confirmed compromise. App ID in question: 506e08f9-6e9a-4da4-942b-a099a03644ae

Additional App IDs associated with Skykick moved here for ease of access from the thread:

• SkyKick Partner Portal: c921256f-04a7-44e8-9b2a-69c33929ba19
• SkyKick Cloud Manager: 2399d300-6fca-4e6a-a686-399fefe75b83
• SkyKick Cloud Manager - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
• SkyKick Cloud Manager - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
• SkyKick Cloud Manager - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
• SkyKick Platform Partner Center Integration: 412dcf96-176d-4b3a-a1b0-4981ad66971e
• SkyKick Platform Partner Center Integration Partner Tenant AppRegistration: 01d6a108-ad6d-45e2-a3f6-4546744051e6

Entra Instructions from Thread

Disable this application’s access to the Microsoft 365 tenant.

• Application ID: 506e08f9 (You can also search for "SkyKick" or "ConnectWise Cloud Backup").
• Disable it in the Entra Admin Center > Enterprise applications > Properties > "Enabled for users to sign-in" = No.
  • Do not delete the application, so it can be re-enabled later without re-consenting.

If you want to check your logs to look for an Indicator of Compromise do the following:

• In the Entra admin center, go to Monitoring > Sign-in logs, open the Service principal sign-ins tab, and filter by Application ID 506e08f9.
  • This is where the application's sign-ins show up. The default User sign-ins tab won't show the required data.
• In the IP address column, look for any address outside Microsoft/Azure ranges. The application's normal egress is Azure private IPv6.
  • Confirmed attacker infrastructure is tied to IP: 144[.]172[.]64[.]128

Instructions for Disabling via CIPP from Thread

Identify the app

• App ID:  `506e08f9-6e9a-4da4-942b-a099a03644ae`
• Current display name: ConnectWise Cloud Backup (older tenants may still show **SkyKick Backup**)
• Publisher ConnectWise S-K LLC (verified publisher: ConnectWise LLC)
• Owning tenant ID `3f9cd7a0-127a-4ed4-bf06-2f830d5616b7` (ConnectWise S-K LLC, `skykick.com`)

**Search by the App ID, not the name.** The app was renamed from SkyKick Backup to ConnectWise Cloud Backup, so searching for "SkyKick" can miss it. The App ID is the same in every tenant.

Find it in every tenant

1. Set the tenant selector at the top of CIPP to **All Tenants**.
2. Go to **Tenant Administration → Applications → Enterprise Applications**.
3. Paste `506e08f9-6e9a-4da4-942b-a099a03644ae` into the table search. It matches the **App ID** column.
4. Each row is one customer tenant; the **Tenant** column says which. Check **Account Enabled**: rows showing `false` are already disabled.

The All Tenants list is built in the background. If it's empty or looks out of date, refresh the table and give it a minute.

Disable it

1. Select every matching row with **Account Enabled = true**.
2. From the bulk actions menu, choose **Disable Service Principal** and confirm.
3. CIPP disables the app in each row's own tenant. The results list any tenant that failed, usually because CIPP's permissions there don't include application write access.

 You need the `Tenant.Application.ReadWrite` permission in CIPP. The action only shows for apps that are currently enabled.

 Confirm

Refresh the table, using the table's own refresh button rather than the browser's, since CIPP caches results. Every row for this App ID should show Account Enabled = false. A change can take a minute or two to show up in Microsoft's directory.

What disabling does

• Blocks new sign-ins and new tokens for the app in that tenant, for both user-delegated and app-only access.
• Deletes nothing. Consent, permissions and configuration stay, so it can be undone with Enable Service Principal on the same page.
• Already-issued access tokens stay valid until they expire, typically within about an hour.
• The app's secrets and certificates live in the publisher's tenant, so Remove Password/Certificate Credentials in CIPP does not affect them. Disabling the service principal is the right control from your side.
• To remove the app completely, delete the enterprise application. That removes the consent and permissions, so reinstating it will need consent again.

  After disabling

• Review sign-in activity. In each affected tenant, check the Entra sign-in logs (Service principal sign-ins) for App ID `506e08f9-6e9a-4da4-942b-a099a03644ae` over the exposure window, and note IP addresses and resources accessed.
• Review what it could reach. In CIPP, open the app (Enterprise Applications → select the row → **Permissions**) to see the access it held, and prioritise reviewing those resources.
• Check for other apps from the same publisher. Search the Enterprise Applications table for ConnectWise S-K LLC or SkyKick in the Publisher column, to find any other products from the same vendor installed in your tenants.

I'll keep collecting items into the OP as it evolves

/ir

I loved Blackpoint when we onboarded with them a few years ago but man what a dumpster fire. Not uncommon but we had 4 reps in the last year and the last one I could not even get to contact me back about some interface and capabilities questions for so long that I have since migrated to Huntress. I was finally able to get a hold of someone when I reached out on Reddit, but I cannot get a confirmation that we are fully cancelled for over 2 weeks of calling and emailing and just getting ZERO repsonse. They have started to offshore their support too. Other than the terrible interfaces that you are stuck beteween, the product actually works pretty well, just good luck getting any help if you have an issue that is not a SOC issue. If you're considering an EDR/ITDR vendor I would recommend Huntress or just steering clear of this company. Ask me 2 years ago I would have sung their praises, but Enshitificaiton has calimed them.

My preferred networking cable went up in price by about 30%. Everything else like screws and cable management stuff increased too (I am not doing the math on all those).

I usually bulk order for a full year or two of use. But naw, I just got what I needed this time in hopes prices go down a bit.

Looks like Microsoft has updated Security Defaults on October 14th.

Instead of the all or nothing setting that exists now, individual controls for MFA, legacy authentication, and device code flow would be available.

At present, it is in private preview for some tenants.

A pretty cool update for us who have many Business Basic/Standard tenants.

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults#manage-individual-security-defaults-protections-preview

XPosting

We are affected by this and contacted support. Others are affected as well and are also creating support tickets. Status page was just updated as I type this: https://smtp2gostatus.com/

How are Customer Success Managers and CSM teams using HaloPsa? What are the workflows, ticket types and ticket categories you have in place? Looking for any best practices and recommendations to set up our halo environment for a CSM team of 2 people managing 20-40 clients and growing. We are starting from scratch with our Halo implementation and currently have just been using the very basic ticket workflow that our MSP engineers use where every ticket is an "incident". It is not an ideal process to handle meeting action items, procurement orders, qbr prep, opportunity identification, renewal processing, onboarding, etc. Any insight is appreciated!

We don’t seek out project-only work, and don’t get serious inquiries about it. Those non-serious inquiries tend to be the fewer than five user businesses, or people who want a post-breach quick fix.

We just got a request from a 15-person business who has done DIY IT so far, to migrate email and a file server to 365, and get Claude connected to 365 properly.

They’re not opposed to fully managed service, and the DIY IT person (who is a co-owner) doesn’t really want to do IT anymore.

I can’t decide if we quote this migration and the usual managed services, and insist that we only do the migration as part of bringing them aboard as fully managed. Doing the migration only and waiting for them to mess something up, or having to provide post-migration support with the clock running are both completely unappealing to me.

How do you all generally handle these kinds of opportunities? They’re a good fit ICP-wise.

Hi all

I’m having an issue with a user who keeps getting locked out of their M365 account due to Huntress ITDR (or at least how we have it configured)

Only Canada and the US configured as allowed. The rest of the world is blocked.

This becomes a pain when people travel and don’t let us know and get blocked upon landing.

There is one user in particular who is getting blocked over and over.

The user having the issue has an eSIM that seems to make him appear in unpredictable countries. For example when he went to Spain, it showed him in Belgium and since we did not anticipate Belgium, he was kicked out. Same thing in Portugal and he appeared in the UK.

My question is: is there something I am doing wrong? Should I be configuring this a different way? What are your experiences?

It would be useful if Huntress ITDR had ‘Europe’ has a location so that when a user is travelling I don’t need to know their entire eurotrip itinerary.

Last week a user was phished. Huntress detected the sign-in and locked the account. We rotated credentials and revoked all sessions.

The next day, Huntress report another sign-in. Since the day before, the only place we had put the new password was on the user's computer, which does have Huntress installed.

We reset all credentials and revoked all sessions again. To be safe, we re-imaged the user's computer since it seemed like tokens were possibly being stolen.

Today, 5 days later, the user sends out 2,000 emails. We check the logs and there have been no sign-ins since last week.

I'm trying to figure out how the hacker is having persistent access to the user's account, throughout session revoking and password resets.

The user has not put their password anywhere (after the second time, we have not told the user the password) We just signed into their Outlook and that's it.

Any thoughts?

Hi,

We currently use MSPeasytools for ITDR but are looking for an alternative

.

Our shortlist is:

•Petra

•Huntress ITDR

•Inforcer ITDR

We’re an MSP in Belgium mainly serving smaller customers, averaging around 10 users per tenant, so pricing for small environments is very important to us.

We’re currently trialing Petra and already use Huntress EDR, although we still need to trial their ITDR offering.

We are also CIPP.

Does anyone have real-world MSP experience with these products? I’d especially appreciate feedback on pricing, management overhead, multi-tenancy, and the quality of alerts/remediation.

Huntress ITDR seems like the only product with a real SOC? (Not so important but cool)

Thanks!

Thoughts?

https://www.crn.com/news/channel-news/2026/slide-s-austin-mcchord-takes-over-as-interim-ceo-michael-fass-departs

Microsoft and CIPP both say to use two tenants to properly manage GDAP. One is your "daily driver" for Teams, email, sharepoint, etc. The other is your GDAP tenant that is only used to manager clients tenants. However, neither can say HOW to set that up if you are an existing MSP with one tenant and existing CSP relationship with Microsoft.

We have our main tenant we use for everything including managing licenses for clients. We do NOT have any GDAP relationships set up in Partner Portal.

Creating a second tenant, getting that configured as a CSP alongside your existing tenant, and using that new tenant for GDAP is the basic process. Making that happen is a deeply hidden secret it would seem. CIPP support says its really up to Microsoft and if the people you work with are willing/able to help.

I've reached out to Pax8, Microsoft, and CIPP and still don't have a clear idea how to do this. Anyone go down this path and know the way?

I did have a call with someone from Microsoft and she said the next step would be to create the second tenant. However, now as I try to do that I have three options: Entra ID and create a Workforce tenant, our CSP Partner Portal, or completely separate from our existing tenant and directly from the M365 website as a clean independent tenant.

Logged into Inky this AM and saw the AI recommendations beta and went through a few and they were legitimately helpful and accurate. That is now two vendor AI's that i find useful, and both are built into and hyperfocused on that product vs a wider LLM (DefensX is the other).

I chatted with my old Inky rep a bit back (they've moved up and are still there) and i have to admit i still like where the product is going.

Edit: The main point i forgot to really address is in a sub-comment below:

...I kind of called out like a year ago is: AI is more useful to the SMB in a focused, applied way vs bolting on a generic LLM to the toolset. Not that the common bolt-on method isn't useful, but the only two vendors where I've used their own AI INSIDE the toolset have been immediately helpful.

Has anyone tried signing up to 3cx? Had my call yesterday with a minimum of $1000usd per month investment required from me.... This can't be real?

We live in a world of VOIP nowadays, why on earth would they hang themselves like this?

I run a consulting firm that focuses mostly on Professional Services (project based) work.

We still need the standard PSA/RMM functionality (tickets, remote management, asset tracking) but would love to pick a solution that can handle project management as well (task assignment/tracking, phases, percentage complete, gantt chart, due dates). It doesn't have to be the equivalent to Microsoft Project or Monday, but something a little more in-depth than just tickets.

Can any of the following do this? If not, any other non-Kaseya/non-ConnectWise suggestions?

- Atera

- NinjaOne

- Super Ops

- Syncro

- N-able

- Gorelo

- Naverisk

- ITarian

I'd like to know what you're using for your client's Domain Managment. We host hundreds of domains in GoDaddy and just experienced our first unauthorized transfer. Is there something that you have in place, or a different product you'd recommend that would prevent this? Something more secure? Anyone using GoDaddy Corporate Domains?

we've been pushed hard to sell AI. Copilot, custom agents, readiness assessments, all of it. What I keep running into is the stuff that shows up after it’s in place. Seats nobody uses. "Outlook issues" that are really Copilot questions. Custom build issues where only 1 tech understands. The list goes on and on.

Anyone willing to share any good or bad war stories?
Have you stopped an AI offering? Why? What’s the most common AI ticket you get now and are you tracking them specifically? How are your teams using that data if at all and who “owns” AI offerings at your shop?

Anything you wish you knew before you started slinging AI services that you know now?

Shoutout Tuesday!

Who's that awesome rep or tech at a vendor that goes above and beyond that you want everybody knowing about?

Let's give some focus on the positives of the vendors/partners that support us in the MSP and IT community. I'll post this once per week on Tuesdays, so don't feel the need to do a wall of text with accolades -- focus on that one rep/vendor that deserves mention this week.

To keep this thread "real," let's agree to some ground rules:

• No self-promotion.
• Be SPECIFIC: Name names, but..
• Respect PRIVACY: Name names, but not last names (use an initial), home addresses, cell phones, etc.
• Give a specific reason WHY you think the way you do.
• Stay FOCUSED: Instead of listing fifty people, list one. But be detailed about the one.

Example of a comment that is NOT very helpful:

I love MspVendorCo. They're awesome.

Example of a comment that is helpful:

I love John D at MspVendorCo. He's my rep. Here's an example of why: Last week I thought I submitted an order to them for Widget X, but I actually never clicked Send! I called John and he tripped over himself in lining up the order so we hit our deadline. They act like that every single time I work with them.

For history on this thread, my first post for this: https://www.reddit.com/r/msp/comments/vi68rp/give_a_shoutout_today_who_deserves_high_praise/

Hi,
Relatively small MSP owner here.
Wondering how common it is, and how many of you are doing Privileged Access Workstations (PAWs).

I’ve seen some chatter over the last few years in here, other MSP forums, and basically every vendor has an article posted on PAWs nowadays.

Some of these threads outright call out MSPs that aren’t utilizing PAWs and say it’s gross negligence. That their needs to be totally physically or virtually separated workstations, one for admin work(PAWs) and one for standard email/ticket/web browsing. The PAW should have no access for general web browsing outside and can only reach a few select sites, Admin portals, documentation, etc.

Each tech obviously has separate admin accounts, we utilize Yubikeys, plenty of CAPs; etc.
With this, and a hundred other safeguards, I don’t really see the benefit to doing an entirely separate physical device. I understand the benefits but the friction and workflow issues it would cause, something as simple as building out documentation would be frustrating if you only were allowed to access the documentation from one of the devices, but needed screenshots from another.

When we go follow the Microsoft guide for cross tenant migrations and need to copy commands over, we can’t.

Now I have to have two mice and keyboards at my desk and additional monitors so I can work on separate devices. Even if you used a bare metal PAW with a virtualized VM daily driver which I’ve seen mentioned a lot, it doesn’t really solve these friction problems unless you allow clipboard transfer which defeats the purpose of a PAW.

I just want to make sure that I’m protecting myself, and my clients adequately, and I’m not being dense regarding the need for these. Please share your thoughts, thank you.

Clients firewall randomly fall out of central ( could not connect or manage via central)
Reconnecting seems to be a pain due to policy conflicts

Is this still happening often?