Here's the uncomfortable part of the ConnectWise story: when a vendor's app already holds standing Microsoft 365 permissions you granted it, a stolen credential can act as that app, with no user password and no multi-factor authentication prompt in the way.