---
title: Monitoring Microsoft 365 application access | Vahti
description: Even a trusted app's permissions can be misused. Learn how Vahti monitors Microsoft 365 application permissions, credentials and sign-ins.
---

<https://vahti.ai/en/blog>

# [Monitoring Microsoft 365 application access | Vahti](https://vahti.ai/en/blog/monitor-microsoft-365-application-access)

 Written by [Teemu Tapper](https://vahti.ai/en/blog/author/teemu-tapper) | Oct 19, 2026, 2:01:01 PM

Even a trusted application's permissions can be misused. That is why businesses need to monitor application permissions, new credentials and their use in Microsoft 365.

Businesses connect applications to Microsoft 365 for tasks such as backup, reporting, security and user management. These applications do useful work in the background and need permissions to do it.

Depending on its permissions, an application can read emails and files, change settings or manage other applications. Businesses therefore need to know who is using these permissions and what they are doing with them.

## What does a vendor security incident mean for customers?

An advisory published by ConnectWise in October 2026 brought this issue into focus. The company reported unauthorized use of applications associated with its Cloud Backup service, formerly SkyKick. It urges customers and IT partners to review sign-ins, permissions and other potential routes into their Microsoft 365 environments. The vendor's investigation alone does not establish what happened in an individual customer's environment. [Read the ConnectWise advisory](https://www.connectwise.com/company/trust/advisories).

Similar risks apply to many integrations. Businesses should know which applications they have given access to their data and monitor how those permissions are used.

## Applications can sign in without a user

Strong authentication protects user sign-ins. Background applications can sign in using their own credentials, such as a client secret or certificate. A user does not approve these sign-ins on their phone, so application access needs to be monitored too. [Read Microsoft's guidance on application access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity).

If an application credential falls into the wrong hands, an attacker may be able to use the permissions already granted to that application. The broader its permissions, the greater the potential consequences of misuse. This applies even when there is a legitimate need for those permissions.

## An attacker can retain access through another application

Pay particular attention to applications that can grant permissions to other applications or add credentials to them.

Imagine an attacker using one integration's permissions to add a new credential to another application. The attacker then signs in using that credential. Blocking the original integration may close the first route. Access through the second application still needs to be investigated separately.

If you suspect unauthorized activity, review new credentials, newly granted permissions and changes to other applications or users. Microsoft's investigation playbook covers both restricting an application's access and investigating and correcting the changes it has made. [Read Microsoft's investigation playbook](https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app).

Start with these questions:

- What data can the application access, and what can it change?
- Have new credentials or permissions been added?
- Has a new credential been used to sign in successfully?
- Has the application made changes that allow access through another application?

## Vahti connects permissions, changes and sign-ins

Vahti helps answer these questions by bringing together application permissions, sign-ins and changes as clear, understandable findings.

Vahti flags the addition of a new client secret or certificate for review. When the evidence shows a successful sign-in with that same newly added credential, Vahti links the sign-in to the same finding. The customer can see what happened and what it means for the application concerned.

Vahti also connects events involving different applications when there is sufficient evidence of a link between them. For example, one finding can show that an application received administrative privileges and then added a credential to another application. The same finding can also show a later sign-in using that credential.

Vahti can also flag a dangerous permission change when there is proof that an application made it. This type of finding does not require a new application credential to have been added in the customer's environment.

Vahti explains what was observed, which applications are involved and why the activity needs attention. This helps the customer assess the situation and take it to their IT partner or another authorized specialist.

## A sign-in is not proof of data access

A successful sign-in shows that the application authenticated successfully. Reading, changing or copying data requires separate evidence. Adding a new application credential can also be a legitimate maintenance task. The reason for the change therefore needs to be confirmed before drawing conclusions.

## Start with applications that have broad permissions

Businesses should start with applications that have broad access to emails, files or administrative functions. Identify what each application is for and who is responsible for it. Check that its permissions are justified by that purpose. For practical help with the review, read [What can applications do in your company's Microsoft 365 environment?](https://vahti.ai/en/blog/review-microsoft-365-application-permissions?hsLang=en)

Ask your IT partner to review Microsoft 365 application permissions, credentials and recent changes. Vahti's findings give you a clear starting point for that conversation.

[**Explore Vahti and Microsoft 365 security monitoring**](https://vahti.ai/en/product?hsLang=en).

[View full post](https://vahti.ai/en/blog/monitor-microsoft-365-application-access)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Teemu Tapper"
  },
  "dateModified" : "2026-10-19T14:01:01.437Z",
  "datePublished" : "2026-10-19T14:01:01Z",
  "headline" : "A trusted app can give attackers access to Microsoft 365",
  "image" : {
    "@type" : "ImageObject",
    "height" : 941,
    "url" : "https://147921880.fs1.hubspotusercontent-eu1.net/hubfs/147921880/blog/monitor-microsoft-365-application-access/cover-vahti-en-v1.webp",
    "width" : 1672
  },
  "mainEntityOfPage" : "https://vahti.ai/en/blog/monitor-microsoft-365-application-access",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 0.0,
      "url" : "https://147921880.fs1.hubspotusercontent-eu1.net/hubfs/147921880/vahti-logo-vaakaArtboard%201.svg",
      "width" : 0.0
    },
    "name" : "blog"
  }
}
```