State-Linked AI Attack Hit 2,250 Microsoft 365 Tenants via Trusted App Identities

What happened

Why it matters

• ·Third-party application identities used in this attack were trusted by Microsoft 365 at the platform level, bypassing controls that assume human sign-in behavior. Organizations that have not audited which vendor applications hold standing access to their cloud environments face the same entry point, regardless of how strong their user-facing authentication controls are.
• ·The speed of this attack, from initial entry to privileged persistence in under three hours, makes human-gated incident response inadequate as a primary control. Compliance programs that rely on analyst review cycles measured in hours, rather than automated detection and containment thresholds, will not catch this class of intrusion before material damage occurs.
• ·This incident exposes a gap that 55% of Organizations Run System-Changing AI Agents Without Identity Controls already flagged. Non-human identities are the software accounts that vendors and AI agents use to access systems. They are not subject to the same review and rotation controls as human accounts. Regulators including those enforcing the EU AI Act (Regulation (EU) 2024/1689) and financial sector supervisors are increasingly treating unmanaged non-human access as a governance failure, not merely a security oversight.

Governance controls affected

What to do now

• ☐Pull a list of every third-party vendor application, including backup, remote management, and IT tooling vendors, that has standing access to your Microsoft 365 or other cloud environments, and confirm what permissions each one holds and whether any of those permissions can be used to authenticate on behalf of users.
• ☐Ask your IT or security team whether your current monitoring tools can detect login attempts made by vendor application accounts at high volume or at unusual hours, and what threshold would trigger an automatic block rather than a human alert.
• ☐Review your ConnectWise or similar remote management vendor contract to confirm what breach notification obligations the vendor has to you, and whether you received timely notice of the credential exposure that enabled this attack.
• ☐Check whether any of the non-human application accounts connected to your cloud environment have access that exceeds what those applications actually need day-to-day, and request that excess permissions be removed.
• ☐Test your incident response plan against a scenario where an attacker gains privileged cloud access within three hours via a trusted vendor app identity, and confirm at what point your team would be able to detect and contain the intrusion.

What to watch next

Financial sector supervisors and cloud security regulators are likely to treat this incident as evidence that non-human identity governance and third-party application access reviews must be explicit program requirements. They should not be left to vendor discretion. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already names non-human identity as a core control area. Enforcement bodies may begin citing this attack in examination findings. Organizations should also monitor whether Microsoft publishes updated guidance on conditional access policies for third-party application identities. Any such guidance is likely to become an informal compliance baseline for cloud-dependent enterprises.