ConnectWise recovery update: reporting returns; verify remaining tenant gaps

The 60-second summary

ConnectWise's 4 November 2026 update says Backup Health reporting, export jobs and Marketplace APIs returned on 3 November. Billing remains in progress; core notifications are live while additional notifications are being enabled. The platform backup dashboard is not fully restored. Re-authorised tenants still need fresh-backup and restore verification, alongside their own investigation.

Timeline that matters

16 October 2026, 17:47 UTC
Development 1
Initial vendor advisory published.
17 October 2026, 07:00 UTC
Development 2
Seven vendor application identities disabled and associated credentials revoked, per technical guide.
18 October 2026
Development 3
Tenant investigation guide issued.
21 October 2026
Development 4
Vendor announced phased recovery work; Microsoft published threat research.
22 October 2026, 00:45 UTC
Development 5
Previous status reviewed by PrivacyBuilt; service availability remained subject to validation.
23 October 2026, 14:00 UTC
Development 6
Vendor clarifies restore access first, followed by phased service re-enrolment.
24 October 2026, 14:00 UTC
Development 7
Vendor narrows the recovery target.
25 October 2026
Development 8
PrivacyBuilt reviewed the update and refreshed the existing draft.
26 October 2026
Development 9
Earlier conditional recovery target; superseded by the latest advisory, not confirmed availability.
26 October 2026, 14:00 UTC
Development 10
Advisory keeps recovery preparations open without a confirmed access date.
27 October 2026, 14:30 UTC
Development 11
Vendor reports completed preparations and pending third-party validation; restore access still unconfirmed.
28 October 2026, 16:00 UTC
Development 12
Vendor begins phased recovery using a new application and publishes tenant-authorisation steps.
29 October 2026
Development 13
PrivacyBuilt updates this existing draft; earlier recovery states remain historical.
30 October 2026, 21:00 UTC
Development 14
Vendor marks Phases 1 and 2 complete; reporting is in progress and notifications follow.
3 November 2026
Further functions restored
Vendor reports restoration of Backup Health reporting, export jobs and Marketplace APIs.
4 November 2026, 18:55 UTC
Latest vendor status
Some billing, dashboard and notification functions remain incomplete.
2026-11-05
Reviewed
Existing unpublished draft refreshed.
2026-11-06
Next review
Check restoration status and customer verification steps.

What changed

More service functions are available than in the previous draft. The remaining recovery gaps now concern billing, the platform backup dashboard and additional notifications. Tenant re-authorisation remains necessary for backups and restores. The new status should replace the earlier blanket description of reporting and notifications as unavailable.

Who should pay attention?

Affected teams

Cloud Backup customers, managed-service providers, tenant administrators, incident responders and privacy owners

What the guidance clarifies

Scope note 1: Application presence or a successful sign-in alone does not prove data exfiltration.
Scope note 2: No returned log events may reflect collection or retention gaps.
Scope note 3: Vendor statements about stored archives do not resolve tenant-specific exposure.
Scope note 4: The Axcient PHP-related portal action is described by ConnectWise as separate from this incident.
Scope note 5: AI-assisted attribution does not change the need to verify ordinary credentials, permissions and logs.
Scope note 6: Do not re-enable previously disabled applications unless the vendor specifically instructs this; use the new application and current instructions.
Scope note 7: Completed authorisation does not establish fresh backup coverage, restore success or completion of the tenant investigation.
Current recovery limitations: As of 4 November, billing and the platform backup dashboard remain incomplete, and not all notifications are enabled. Check the current advisory before closing a tenant recovery record.
Educational use: Educational information only, not legal advice. The implementation checklist is original PrivacyBuilt analysis; adapt it to the facts, applicable obligations and qualified specialist advice. No regulator, standards-body or vendor endorsement is implied.

Practical relevance

Why this matters for global organisations.

Trusted application access can span many customers without an interactive user sign-in. Supplier containment needs to be paired with customer-level investigation, clear recovery authority and evidence of what each identity could access.

16 actions to start now

List every current and dormant integration and identify the administrator accountable for each tenant.
Match application client IDs against official guidance rather than relying on display names.
Record tenant-specific service-principal object IDs and local enabled status.
Preserve sign-in, directory-audit, application and workload evidence with retention limits documented.
Review credentials, consent grants, app permissions and directory-role changes against approved baselines.
Correlate successful authentication with later Graph and workload activity; record failed attempts separately.
Investigate unexpected identities, forwarding rules, access grants and other persistence indicators.
Use the current vendor list and Microsoft guidance together; their example application sets are not identical or necessarily exhaustive.
Remediate confirmed unauthorised changes under incident-response oversight and preserve before-and-after records.
Follow the current official password-reset, MFA and tenant-authorisation instructions for the new application; preserve approval and completion records.
Keep previously disabled applications disabled unless the vendor explicitly instructs otherwise.
Confirm fresh successful backup snapshots and perform an approved restore test for each tenant.
Record snapshot gaps, parked resources, unavailable features and the current recovery phase.
Continue each customer's investigation, data-exposure assessment and notification decisions separately from service restoration.
Close recovery only against agreed tenant-specific acceptance criteria, with unresolved exceptions assigned to owners.
Reconcile the now-restored reports and exports with the manual recovery record; keep manual checks for remaining dashboard and notification gaps.

Suggested next steps

Verify fresh successful backups and an approved restore for each tenant.
Reconcile restored reporting with manual records and retain checks for remaining feature gaps.
Continue tenant investigation and notification assessment independently of restoration. Next review: 6 November 2026.

Evidence worth retaining

Tenant and application inventory
Credential, consent and role baselines
Preserved audit and sign-in exports with coverage dates
Investigation chronology and activity correlation
Remediation approvals and verification
Service-specific restoration instructions and acceptance tests
Data-exposure and notification decisions
New-application authorisation approvals and tenant completion records
Fresh snapshot and restore-test evidence; recorded recovery gaps
Per-tenant recovery acceptance record with current feature availability and monitoring workarounds
3 November restoration reconciliation and dated exceptions for billing, dashboard and notification gaps.

Questions to take to counsel or your conformity team

These are discussion prompts, not legal advice or conclusions.

Who owns review of customer tenants we cannot administer directly?
What telemetry was enabled and retained during the relevant period?
Can a persistent access path survive the vendor credential reset?
Which data access is confirmed, possible or unsupported by evidence?
What exact service conditions must be met before reconnection?
Who verifies remaining dashboard and notification gaps and reconciles the reports that have returned?

Official sources

PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.

PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.

LinkedIn Share on X WhatsApp