Security Intelligence
Loading table of contents...
At a glance:
-
MSP Process recently disclosed a security incident involving unauthorized access to infrastructure containing application credentials, administrator refresh tokens, and Granular Delegated Admin Privileges (GDAP) relationship data used by Microsoft administrative integrations.
-
Public reporting indicates compromised MSP Process credentials were used in customer environments. Reported activity included authentication attempts across multiple tenants and, in at least one investigated environment, the creation of additional credentials, role assignments, and service accounts intended to maintain access.
-
The primary concern, beyond the exposure of the original credentials, is that additional credentials, permissions, accounts, or other persistence mechanisms could have been established before containment actions were completed.
Threat summary
On November 7, MSP Process notified partners that a threat actor who gained access to one of its internal servers had access to a company storage account between approximately 09:56 UTC and 14:40 UTC.
The storage contained application client IDs and client secrets used by MSP Process integrations, administrator refresh tokens associated with connected services, and Granular Delegated Admin Privileges (GDAP) relationship information.
MSP Process removed the threat actor’s access, rotated platform credentials, and disabled the compromised storage key at 19:05 UTC that day.
The incident affects MSP Process apps used for identity management and tenant administration, including Authenticator, Password Reset, and Contacts Sync. These apps connect to customer environments through Microsoft Partner Center’s administrative relationships and have permissions to manage user accounts, authentication methods, and applications across connected tenants.
Following the disclosure, MSP Process reported that the threat actor also accessed infrastructure supporting its Microsoft Partner Center integrations, including application credentials and access tokens used by those services. The company disabled password reset, multifactor authentication (MFA) reset, user unlock, and authenticator verification functionality, engaged an external incident response firm, and expanded its remediation guidance to all customers. The guidance includes rotating API keys and credentials for integrations such as PSA, RMM, messaging, Teams, and mail.
The significance of the incident lies in these permissions. Possession of a valid client secret allows an application to authenticate directly to Microsoft cloud services without user interaction, an administrator sign-in, or an MFA challenge.
Third-party reporting indicates the exposed credentials were used in customer environments, with authentication attempts across 47 environments. Most activity was limited to brief authentication events. In one investigated environment, the threat actor reportedly granted additional permissions to the MSP Process application, added credentials to dozens of applications, created service accounts, accessed data, and re-enabled accounts disabled during response efforts. Attempts to use exposed administrator refresh tokens reportedly failed. The activity has not been publicly attributed to a specific threat actor.
Analysis
To perform password resets, MFA administration, and other delegated-administration functions, MSP Process applications rely on Microsoft Graph application permissions that allow them to act independently of a signed-in user.
Depending on the feature enabled, documented permissions include:
-
Application.ReadWrite.All, which allows credentials to be added to other applications within the tenant.
-
AppRoleAssignment.ReadWrite.All, which allows permissions to be assigned to applications, including the compromised application itself.
-
User-PasswordProfile.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All, and User.ReadWrite.All, which allow account administration, password resets, and registration of new authentication methods or Temporary Access Passes
These permissions explain the potential impact of the incident. Combined, they provide a path to broad administrative control within a Microsoft 365 environment.
The affected credentials also operate outside many controls organizations commonly rely on. Applications authenticate through the OAuth client credentials flow without user involvement, so MFA and user-focused Conditional Access policies do not apply. Activity appears in Microsoft Entra ID audit logs under the application’s identity rather than a user’s, making it easier to miss during routine investigations.
The primary remaining risk is persistence. Removing the exposed MSP Process credential closes the original access path but does not remove anything created before remediation. Credentials added to other applications, newly created service accounts, newly granted permissions, assigned directory roles, and newly registered authentication methods all remain active after the original credential is removed and consent is revoked.
Incident response reporting described this pattern in at least one investigated environment, including credentials added across numerous applications and accounts re-enabled after responders disabled them.
The scale of exposure stems from how delegated administration platforms operate. A single set of MSP Process applications can be connected across many customer environments, so a compromise of the vendor created downstream risk for organizations that may never have interacted directly with MSP Process.
The incident also reflects a broader trend of application identity abuse. Recent activity involving Todyl, reporting from Microsoft Threat Intelligence, and abuse of trusted application identities in other service provider environments demonstrate the value threat actors place on application credentials, since a single trusted application can provide access to many customer environments at once.
Mitigations
Organizations using MSP Process can contain affected integrations by deleting client secrets from MSP Process application registrations in Microsoft Entra ID, revoking sessions for the administrator account that connected the service, revoking consent for the applications, disabling them within customer environments, and keeping integrations disconnected until MSP Process confirms remediation is complete. Rotate API keys, application credentials, refresh tokens, certificates, and other authentication material associated with the integrations.
MSP Process applications may appear under names other than "MSP Process," such as "Identity Management" or "Microsoft Authenticator." Legitimate Microsoft and third-party applications can use similar names, so verify the application ID and owning organization before disabling or removing any application. Applications registered through MSP Process commonly list the managing organization's tenant as the owner rather than MSP Process or Microsoft.
Review Microsoft Entra ID audit logs beginning November 6, 2026, and prioritize actions initiated by applications rather than users. Focus on application role assignments, service principal credential additions, application credential management events, directory role assignments, password resets, account creation, account re-enablement, MFA registration events, and Temporary Access Pass creation. Review service principal sign-ins from unfamiliar IP addresses and review non-interactive sign-ins associated with the administrator account that connected MSP Process. Within the Microsoft Purview unified audit log, review mailbox access, file downloads, inbox rule creation, and mailbox forwarding activity associated with MSP Process application identifiers.
Remove unauthorized credentials, permissions, directory roles, and accounts. For affected administrator accounts, reset passwords, review authentication methods, and revoke active sessions. Organizations using Microsoft Entra ID Free should export audit and sign-in logs before November 14, 2026, when records associated with the incident begin to expire. Organizations working with a service provider can confirm whether MSP Process was used in their environment and whether tenant reviews have already been completed.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
