{
  "id": "mspprocess-entra-credentials",
  "url": "https://ohshit.app/incidents/mspprocess-entra-credentials/",
  "title": "MSP Process intrusion exposes Microsoft Entra integration credentials",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-08",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "msp",
    "entra",
    "gdap",
    "credentials",
    "breach"
  ],
  "ecosystems": [
    "microsoft-365",
    "entra"
  ],
  "summary": "MSP Process confirmed an intrusion and says it notified affected partners. A customer-posted copy of its notice says an attacker reached storage holding Entra application secrets, an administrator refresh token and delegated tenant information. The notice reports credential abuse in customer tenants.",
  "splash": "MSPs using MSP Process with Microsoft Partner Center and their clients with delegated Entra integrations.",
  "wipe": "Delete connected app secrets, revoke the consenting admin's sessions, and hunt for persistence in partner and client tenants.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Cut off the affected integration",
      "hint": "In the partner tenant, go to Entra ID → App registrations → Certificates & secrets and delete every client secret on each app connected to MSP Process. Coordinate with client tenant admins to disable affected enterprise apps under Entra ID → Enterprise apps → Properties. Set Enabled for users to sign-in to No to stop new tokens from being issued for the app. Wait for vendor guidance before reconnecting."
    },
    {
      "title": "Revoke the consenting administrator's sessions",
      "hint": "In Entra ID → Users, select the account that granted consent and choose Revoke sessions. For accounts showing compromise, block sign-in during investigation, reset passwords, remove unauthorized MFA methods and revoke sessions. Existing access tokens or application sessions can persist temporarily."
    },
    {
      "title": "Preserve logs and hunt across partner and client tenants",
      "hint": "Export Entra audit and sign-in logs from Nov 7, 09:00 UTC onward. Search service principal sign-ins by the connected app IDs and review privileged user sign-ins, unexpected password resets, authentication changes including Temporary Access Passes, new app or service principal credentials, new users, directory role assignments and app consents. In the Microsoft Purview audit log, check Exchange inbox rules and forwarding, and look for `FileDownloaded` and `MailItemsAccessed` by app ID to assess possible data exposure. Record gaps where audit data is unavailable. Petra reported activity from shared Azure IP 172.169.63[.]30. A match alone does not prove compromise."
    },
    {
      "title": "Remove attacker access and coordinate recovery",
      "hint": "Remove unauthorized secrets, certificates, MFA methods, accounts, roles, consents, rules and forwarding after preserving evidence. Contact MSP Process via a known support channel with affected tenant and app IDs and relevant timestamps. Notify affected clients and confirm each tenant's cleanup before re-enabling the integration."
    }
  ],
  "sources": [
    {
      "name": "MSP Process founder's public response",
      "url": "https://www.reddit.com/r/msp/comments/1xqkpva/comment/19sax55tiu9pe/",
      "says": "Confirms the attack, notifications to affected partners by email and SMS, and an ongoing investigation.",
      "primary": true
    },
    {
      "name": "Customer-posted copy of the MSP Process notice",
      "url": "https://www.reddit.com/r/msp/comments/1xqkpva/msp_process_got_popped_check_your_tenants/?sort=top",
      "says": "Describes the storage access window, credential exposure, downstream abuse and containment steps.",
      "primary": false
    },
    {
      "name": "Petra incident observation",
      "url": "https://www.reddit.com/r/msp/comments/1xqkpva/comment/19saw6yal131g/",
      "says": "Observed unusual service principal activity from a shared Azure IP and says attribution is inconclusive.",
      "primary": true
    },
    {
      "name": "Microsoft Entra emergency access revocation guidance",
      "url": "https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access",
      "says": "Explains user session revocation and why some access may persist until tokens or sessions expire.",
      "primary": true
    },
    {
      "name": "Microsoft Entra enterprise application containment guidance",
      "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/disable-user-sign-in-portal",
      "says": "Shows how a tenant administrator can prevent new tokens from being issued for an enterprise application.",
      "primary": true
    },
    {
      "name": "Microsoft Purview audit activity reference",
      "url": "https://learn.microsoft.com/en-us/purview/audit-log-activities",
      "says": "Lists event names for mail rule changes, mailbox access and file downloads.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "MSP Process confirmed an intrusion. A reposted customer notice reports tenant abuse.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 7, 09:56 UTC",
      "title": "Attacker accesses integration storage",
      "body": "The customer-posted notice places access between 09:56 and about 14:40 UTC."
    },
    {
      "date": "Nov 7, 19:05 UTC",
      "title": "Stolen storage key stops working",
      "body": "The customer-posted notice says MSP Process removed the attacker's access and rotated its platform credentials."
    },
    {
      "date": "Nov 8, 2026",
      "title": "Customer notice surfaces and MSP Process confirms the intrusion",
      "body": "Founder Patrick Leonard says the company notified affected partners and is still investigating."
    }
  ],
  "body_markdown": "The customer-posted notice describes an attacker reaching an MSP Process storage account after entering\nan internal server. The affected integration uses Microsoft Partner Center's granular delegated admin\nprivileges (GDAP) for Authenticator, password reset and contact synchronization. The storage held Entra\napp IDs and client secrets, the refresh token for the administrator who connected the integration, and\na list of client tenants and their delegated roles.\n\nWith a stolen client secret, an attacker can obtain an app token without signing in as a user or\npassing user MFA. The possible actions depend on which application permissions the MSP granted.\nThe notice lists `Application.ReadWrite.All` and `AppRoleAssignment.ReadWrite.All` for Authenticator,\nand `User.ReadWrite.All`, `User-PasswordProfile.ReadWrite.All` and\n`UserAuthenticationMethod.ReadWrite.All` for Password Reset. The notice reports use against client tenants of at least\ntwo MSPs and does not establish the total number of affected tenants or what was copied for each partner.\n\nMSP Process founder Patrick Leonard publicly confirmed that the company sent notices and was still\ninvestigating. The initial entry method and full scope remain unknown. Removing the original secret\nstops its use for new tokens. It leaves any credentials or permissions the attacker added in place,\nso check both the partner tenant and each connected client tenant."
}