MSP Market Pulse — October 2026

The month in one paragraph

September was about clients doubting. October was about access nobody was watching. The month’s incident came through a backup vendor’s app that Microsoft 365 tenants had consented to, sometimes years earlier, and it reached tenants that had stopped using the product. A second thread showed the same shape at the size of one mailbox. A third cluster asked who holds the controls when a client relationship ends. The common thread: the tools providers rely on are built around a person signing in, and most of this month’s problems never signed in.

1. Consent that outlived its reason

The two biggest incident threads (⬆143 with 173 comments, and ⬆123) tracked the mid-October compromise of a cloud backup vendor’s Microsoft 365 app. A disclosed security vendor described the targeting in the thread: “a script walking a sorted list of every tenant that consented to the app, including tenants with no active backup subscription.” Its published write-up counted nine such tenants. Then operators checked their own estates. One found the app in a client tenant “from 8 years ago. (Before we were ever involved…)” (⬆19). Another, who had not used the product in years, got an alert that its service principal “appears to have assigned itself the Exchange Administrator role outside of PIM” (⬆14), and removed the apps “that had been lingering in our tenant.” The pinned remediation kept a reversibility rule worth copying: “Do not delete the application, so it can be re-enabled later without re-consenting.” Counts of affected tenants differ by source, so none are repeated here.

2. A rule that holds for people

A follow-up thread (⬆47, 56 comments), started by a detection-vendor customer and framed as a learning exercise rather than a complaint, asked what actually discovered the breach. The answer from the incident thread (⬆18): a provider “was in Entra for an unrelated item, noticed something weird in logs, called it out live on call (happenstance).” In one tenant a second vendor app had added itself to Global Administrator. One reply (⬆12) explained why the familiar rule didn’t help: only a Global Administrator can assign the role, but that “holds for people. An app with one of those permissions can do it too.” Another comment put the detection gap plainly: service principals “are basically invisible unless you’re specifically hunting for them.” Fairness note: a security firm’s own write-up says its review of sign-in logs flagged the activity once someone looked, so the thread’s point is about what looked first, not that detection failed. The vendor itself was criticized for hours of silence while competitors posted live.

3. Revocation reached the person, not the thing acting as the person

A phished user (⬆79, 116 comments). The security tool caught the sign-in and locked the account. Credentials rotated, sessions revoked. Another sign-in the next day, so all of it again, plus a re-imaged laptop. “Today, 5 days later, the user sends out 2,000 emails. We check the logs and there have been no sign-ins since last week.” The top diagnosis (⬆36) named the class: “oauth grants that survive password resets and session revokes.” The poster’s update was four words: “It was a connector.” Which kind was asked and not answered. One reply (⬆18) asked the process question anyway: “Or did you just rotate the password + revoke sessions and thought that was enough? (spoiler: it’s not).”

4. Whoever holds the controls when the relationship ends

An incoming provider (⬆35) found the outgoing one had “pretty much refused an Offboarding, shutdown and disabled their servers in azure, and did not remove [the endpoint and MFA tools], but they did disable them on their side, hence locking users out of desktops.” Per the poster, the client owed nothing. The thread mostly sent it to lawyers. The friendly version (⬆33, 92 comments) was a client asking for admin credentials to a firewall it paid for. The split was ownership against risk: “If the customer owns the equipment, they get the passwords” (⬆13) versus “they own the equipment but you own some of their risk” (⬆9). The answers that moved it forward were about who makes changes, not who holds the password: “a completely different account for auditing purposes” (⬆33), and written access authorization approved by the client’s governing body rather than whoever happens to ask (⬆9).

5. Three smaller threads, same lesson

• A free monitoring tool, disclosed as AI-built, posted with its source and a request for peer review before use (⬆53). A peer found a false positive on day one and the author shipped a fix the same day. The sharpest critique was about routing: “Why doesn’t it notify support automatically? It should trigger an alert in the RMM. Open a ticket in the PSA” (⬆24).
• An eDiscovery demand where delegate settings meant 10 mailboxes became 45 in the search (⬆41). Top advice (⬆24): bring in an eDiscovery vendor “so they can be the ones who can testify to what happened and why it happened.”
• A client said its provider overcharged because a reseller quoted less (⬆50, 115 comments). The cheaper quote left out tax. With it, the provider was about 4k cheaper. Top answer (⬆151): “Show them how you are saving them money by showing them the totals with tax.”

6. Questions your peers asked that nobody answered well

1. Which vendors still hold consent in tenants that stopped using them? (Every provider that checked found something old. Nobody had the list before the incident.)
2. What watches the identities that never sign in? (Answered for people. For apps, connectors and service principals, nobody named a tool that looked first.)
3. What does revoking actually revoke? (A password reset and session revoke ran twice and left the sending path intact.)
4. Who holds the off-switch when the relationship ends? (The offboarding thread went to lawyers. The credentials thread got as far as a separate audited account and stopped before asking who approves its use.)
5. Where should a tool’s alert land: with the user who can’t fix it, or in the queue of the people who can?

---

Compiled by JieGou from public r/msp threads (one-month window ending October 26, 2026). New editions when there’s something worth reading.