MSP Process intrusion exposes Microsoft Entra integration credentials
MSP Process confirmed an intrusion and says it notified affected partners. A customer-posted copy of its notice says an attacker reached storage holding Entra application secrets, an administrator refresh token and delegated tenant information. The notice reports credential abuse in customer tenants.
- Disclosed
- Nov 8, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- MSPs using MSP Process with Microsoft Partner Center and their clients with delegated Entra integrations.
- microsoft-365 · entra
- In the wild
- Yes
- MSP Process confirmed an intrusion. A reposted customer notice reports tenant abuse.
What happened
The customer-posted notice describes an attacker reaching an MSP Process storage account after entering an internal server. The affected integration uses Microsoft Partner Center’s granular delegated admin privileges (GDAP) for Authenticator, password reset and contact synchronization. The storage held Entra app IDs and client secrets, the refresh token for the administrator who connected the integration, and a list of client tenants and their delegated roles.
With a stolen client secret, an attacker can obtain an app token without signing in as a user or
passing user MFA. The possible actions depend on which application permissions the MSP granted.
The notice lists Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All for Authenticator,
and User.ReadWrite.All, User-PasswordProfile.ReadWrite.All and
UserAuthenticationMethod.ReadWrite.All for Password Reset. The notice reports use against client tenants of at least
two MSPs and does not establish the total number of affected tenants or what was copied for each partner.
MSP Process founder Patrick Leonard publicly confirmed that the company sent notices and was still investigating. The initial entry method and full scope remain unknown. Removing the original secret stops its use for new tokens. It leaves any credentials or permissions the attacker added in place, so check both the partner tenant and each connected client tenant.
Crime-scene timeline
Nov 7, 09:56 UTC
Attacker accesses integration storage
The customer-posted notice places access between 09:56 and about 14:40 UTC.
Nov 7, 19:05 UTC
Stolen storage key stops working
The customer-posted notice says MSP Process removed the attacker's access and rotated its platform credentials.
Nov 8, 2026
Customer notice surfaces and MSP Process confirms the intrusion
Founder Patrick Leonard says the company notified affected partners and is still investigating.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- MSP Process founder's public responsePrimaryConfirms the attack, notifications to affected partners by email and SMS, and an ongoing investigation.
- Customer-posted copy of the MSP Process noticeDescribes the storage access window, credential exposure, downstream abuse and containment steps.
- Petra incident observationPrimaryObserved unusual service principal activity from a shared Azure IP and says attribution is inconclusive.
- Microsoft Entra emergency access revocation guidancePrimaryExplains user session revocation and why some access may persist until tokens or sessions expire.
- Microsoft Entra enterprise application containment guidancePrimaryShows how a tenant administrator can prevent new tokens from being issued for an enterprise application.
- Microsoft Purview audit activity referencePrimaryLists event names for mail rule changes, mailbox access and file downloads.