ConnectWise (SkyKick) App Sign-in from Non-Azure Address or Scripted Client

Awais Munir@iawais

•updated today•3•0•5

Flags service principal sign-ins by the ConnectWise/SkyKick app IDs from a public address or a Python/curl client. Per Huntress, the vendor apps normally egress from Azure private IPv6 (fd...) and call Graph with the kiota-dotnet SDK. Both conditions together are the strongest signal. This survives IP rotation. Baseline your tenant first, since a legitimate public egress would show here.