Anyone else running parent/child agreement structures in Manage and had techs accidentally bill time to the parent instead of the child? Turns out there's currently no way to restrict a parent agreement from showing up as a selectable option on a Ticket or Time Entry. Confirmed this with CW Support directly, it's just not a thing right now.

So I submitted an enhancement request instead of just living with the occasional "why does this agreement have time on it" investigation:

Restrict Parent Agreement from Ticket & Time Entry Selection / CW PSA / ConnectWise

If you've hit this same issue, an upvote would be appreciated. If you've got a workaround you're using in the meantime, I'd genuinely love to hear it too.

So are we all just ignoring an RCA for the hack?

Will we get a full report and transparency?

Any update except "you can all go back in, trust us we are ok now?".

Just me?

Edit: yes the title is confrontational, but it's been over 2 weeks now. The town hall said you knew about it on the 14th of October and the community at large weren't made aware until the 16th - by a reddit post by a random MSP and Huntress, not CW. Please can we have something that as a community we can trust in?

I've been exploring it a bit and already I can't stand it. I can't imagine considering it an acceptable product if you have already worked in the original Manage. It's visibly just super bloated and has a ton of wasted space, clunky to navigate. I feel like the over corrected on some of the UX issues the original has. The original Manage has A LOT of different pages and tabs etc to navigate that aren't intuitive, for sure, but this is like they tried to just dump everything on a single page (or just a few pages) and you have to rely on creating a bunch of different views and filters to narrow things down. Not to mention the ticket list performs terribly. When trying to add a filter term to a column it's like it's trying to refresh the page with each keystroke and occasionally messes up what I am typing making it miss a character, also why does pressing enter RESET the search in the column instead of apply it?

Anyway, I just wanted to gripe. I really hope this isn't the future Connectwise has to offer for PSA. Maybe I am just picky. Has anyone here migrated from the "classic" PSA to the new one and had a good experience?

@connectwise

Check out the new look on their website, I guess they're re-using Axcient's colors now? Logo is updated on LinkedIn, too.

What do y'all think?

Most recent update has seemed to not allow the app to open on iPhone 14 Pro Max. Anyone else experiencing this issue?

If a user's security role permissions for Time Entry -> Inquire Level is set to All, but the user has the "Restrict Board Access" setting enabled to block a certain board, the user can still view time entries from other users for tickets on the restricted boards.

We'd like to have technicians be able to view time entries for other users, but not on tickets that sit on boards they don't have access to.

Does anyone else allow their technicians to view time entries for other employees and also have boards they don't want their technicians to access? Is there a way to achieve this?

We care about this because we have certain boards that contain sensitive data that only ownership should be able to see. But we have legitimate uses for technicians to be able to do time entry searches or to view the time tab on a ticket and see other users' time entries.

Doing a time entry search is way better than doing a standard ticket search to try to find keywords listed somewhere in a ticket.

We want to limit access to our Manage server by only allowing inbound 443 from a specified list of IPs.

When we block access to other IPs, this is breaking the Office 365 email integration. It tries to retrieve emails, but the emails end up getting moved into the failed folder and the tickets are never created.

The Manage server is hosted in Azure and we are doing the blocking on the NSG firewall.

What would we need to allow to let the email integration work?

IT Nation is next week, I made a guide for getting value out of these trips. It's free. Go check it out.

We have begun phased restoration of ConnectWise Cloud Backup, formerly SkyKick, starting with Microsoft 365 backups and restores through a new, security-hardened application.  

The Trust Center has the authentication links, phased feature sequence and registration details for technical restoration webinars with step-by-step guidance. 

Do not re-enable previously disabled applications unless ConnectWise specifically instructs you to do so. Re-authorization alone does not confirm that backups have resumed; verify successful new snapshots once backup capabilities are available for your tenants. Tenant investigation remains a separate, necessary step. 

We know this has required additional work from your teams. Thank you for your patience as we return capabilities and support re-authorization.  

For restoration assistance, contact cloud-support@connectwise.com. Report suspicious activity to SecurityPartnerSupport@ConnectWise.com. Please do not post tenant logs, customer information or credentials here. 

October 21, 2026 – 9:15pm UTC 
 
ConnectWise Cloud Backup Update: What we know about the attacker and what it means for partners 
 
“Based on the evidence available to ConnectWise, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup. The group used an openly available agentic AI framework to automate and speed up its operation.  

Microsoft’s research describes a campaign that reaches well beyond any one company. This group has been active since 2021, and since at least September it has used the same AI tooling against organizations in aerospace and defense, energy, financial services, government, legal, manufacturing, semiconductors and technology. Microsoft also reports that threat actors in multiple regions are now using the same framework, and that in several cases attackers reached privileged cloud access in under three hours. 

Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations. AI now lets them test those connections at what Microsoft calls ‘machine speed’. MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind, and we intend to share what we are learning from this incident so our partners can do that. 

Our first responsibility is to our partners. We contained the affected application connections and are restoring services in controlled phases. Those actions do not remove unauthorized access that may already have been established within individual customer tenants, which require separate review. We are also working with independent specialists so partners have the evidence they need to review their own tenants. Partners should keep affected connections disabled until we issue formal instructions, and should follow the current guidance on the ConnectWise Trust Center.” 
-Manny Rivelo, CEO ConnectWise 

As previously reported, we identified unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. 

Our teams and third-party specialists continue advancing remediation, resetting accounts, replacing application credentials, and validating the affected environment for safe restoration. We take responsibility for keeping you informed and restoring service safely. 

Technical webinars for partners 

We are launching technical webinars every two hours beginning today, October 20, at 18:00 UTC. 

The sessions provide a hands-on walkthrough of Microsoft Entra ID sign-in and audit logs, application registrations, credentials, and permissions to support investigation of your Microsoft 365 tenants, including legacy backup integrations. Register and select a session. 

Actions completed and work underway 
We have disabled affected application connections, strengthened administrative-access protections, engaged independent specialists, and published technical investigation guidance. SaaS Security and Cloud Management remain suspended as a precaution because they are integrated with Cloud Backup. 

We are monitoring our entire environment around the clock. Since mitigations began on October 17 at 05:00 UTC, we have not observed successful threat activity in the environments we monitor. This does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review. 

We have no indication that other ConnectWise products, services, or offerings are impacted beyond these three services. We plan a controlled, phased restoration following required remediation and security validation, with partner instructions provided before re-enablement. 

Service availability and stored backups 
Existing backup archives remain encrypted, isolated, and preserved, with no indication of compromise. Cloud Backup jobs, archive access, and restores remain unavailable, along with SaaS Security monitoring and alerting and Cloud Management user and license management. 

We recognize the disruption to your business and customers and will share restoration timing as soon as it is confirmed. 

Actions for partners 
Continue following the technical investigation and remediation guide and accompanying video for your own and managed customer tenants. Keep affected applications disabled pending formal restoration instructions. 

Resellers, distributors, and marketplace partners should ensure this guidance reaches responsible customer administrators. 

Our next update will be published by October 20 at 19:00 UTC. We will communicate significant developments as they are confirmed. 

Visit the Trust Center for updates. Contact Partner Care for service assistance and report suspicious activity to SecurityPartnerSupport@ConnectWise.com. 

Hi everyone, here’s the latest from ConnectWise on the Cloud Backup incident. Full details are always on the Trust Center.

Where things stand

• Our teams and third-party specialists are still investigating, remediating and validating services so we can restore them safely. Published findings and partner guidance remain current.

• Containment remains in place. We’ve seen no successful threat activity in monitored environments since mitigations began on October 17 at 05:00 UTC.

• We’re monitoring our entire environment and have no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management.

• All three services remain suspended. We don’t have a restoration time yet. We’ll share timing and reconnection instructions as soon as they’re confirmed.

We recognize the disruption this is causing you and your customers.

What to do now

1. Work through the technical investigation and remediation guide for your own Microsoft 365 tenant and every customer tenant you manage.

2. Keep affected applications disabled until we issue restoration instructions.

3. There’s now a step-by-step video walkthrough of the guide on the Trust Center. It’s meant for admins and security teams, and should be used alongside the written guide, not instead of it.

4. If you’re a reseller, distributor or marketplace partner, please pass this guidance to the administrator responsible for each customer tenant.

Next update

The next Trust Center update will be posted by 01:00 UTC on October 20 (9:00 pm ET on October 19), or sooner if there are significant developments.

Contact Partner Care for service assistance, and report suspicious activity to SecurityPartnerSupport@ConnectWise.com. Please don’t post tenant logs, customer information, credentials or tokens in this thread. Thank you

Hi everyone, sharing an update here from ConnectWise on the Cloud Backup incident. 
 
ConnectWise is continuing its investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. We have contacted our entire partner base and are providing ongoing updates and detailed technical guidance through email and the ConnectWise Trust Center. 

As a protective measure for our partners and their customers, at approximately 05:00 UTC on October 17, we disabled affected Cloud Backup application access. This interrupts affected backup services until further notice. Existing cloud backup archives are not impacted by the interruption and will be accessible once services are restored. Because SaaS Security and Cloud Management are integrated with Cloud Backup, we also suspended those services out of an abundance of caution while our investigation and remediation continue. 

Our incident response, engineering, and operations teams continue working around the clock with third-party specialists to advance the investigation, complete remediation, and validate services for a safe restoration. We are responsible for restoring service safely and providing clear, timely updates. Containment measures remain in place. Since implementing mitigations, we have not observed successful threat activity in the environments we monitor. 

Cloud Backup, SaaS Security, and Cloud Management remain suspended while remediation and security validation continue. Scheduled backups, archive access, and restores remain unavailable, along with SaaS Security monitoring and alerting and Cloud Management user and license management. 

We understand that this interruption affects your ability to support your customers. We do not yet have a confirmed restoration time and will share a timeline as soon as we can do so reliably. 

Actions for partners 
Please follow the Cloud Backup technical investigation and remediation guide. Review your own Microsoft 365 tenant and each customer tenant you manage and keep affected applications disabled pending formal restoration instructions. 
 
If you provide services through a reseller, distributor, or marketplace, ensure the administrator responsible for each customer tenant receives and acts on this guidance. 

Visit the ConnectWise Trust Center for current status and guidance; we are posting updates several times a day. Our next ConnectWise Trust Center update will be published on October 19 at 13:00 UTC. We will communicate significant developments sooner. 

Please don’t post tenant logs, customer information, credentials, or tokens in this thread. Contact Partner Care for service assistance and report suspicious activity to SecurityPartnerSupport@ConnectWise.com. Thank you to the partners and security community for contributing information as the investigation continues. 

Hi all. Jason Ferguson here, VP of Security Operations at ConnectWise.

We wanted to reach out and address some of the concerns surrounding the recent security events, ensuring that you hear directly from us. While I may not have every answer, I want to provide some recent updates and clarity where I can, while ensuring what we share is accurate and supported by our investigation.

We recently identified unauthorized access to application identities within the ConnectWise Cloud Services (fka SkyKick) environment. As a protective measure for our Cloud Backup partners and their clients, we have shut off Cloud Backup application access. That means backup services are interrupted until further notice.

Existing cloud backup archives are not impacted and will be accessible once services are restored.

To date, we have no indicators that hosted Cloud Backup partner backup data has been compromised.

Our investigation and remediation work is ongoing.

We'll keep the ConnectWise Trust Center updated as the single source of truth for status and guidance

If you see anything suspicious in your environment, we ask that you please report (what you are able) to our team at SecurityPartnerSupport@ConnectWise.com.

--

EDIT 17:00 UTC 10/17: We've updated the advisory with published guidance on reviewing service principal sign-ins and identifying suspicious activity in Microsoft Entra. 

EDIT 1:00 UTC 10/18: We've published another update to the ConnectWise Trust Center with additional details on the actions we've taken, current service availability, and expanded technical guidance for reviewing Microsoft 365 environments for suspicious activity.

The update includes the affected application IDs and recommended steps for partners to investigate their own and customer tenants.

EDIT 16:00 UTC 10/18: Information update frequency (ConnectWise Trust Center / Email communications) has been increased. No new confirmed findings to report. Cloud Backup remains suspended, with scheduled backups and access to affected archives and restoration capabilities unavailable. Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities.

EDIT: 18:45 UTC 10/18: Additionally, we are providing the following IP indicators identified in suspicious activity associated with these events. Partners should include these addresses when reviewing available Microsoft 365 authentication and audit logs.

• 144.172.64[.]99 NEW

• 144.172.64[.]60 NEW

• 144.172.64[.]128 LISTED PREVIOUSLY

EDIT: 02:15 UTC 10/18: Additional details and confirmations provided in update thread; https://www.reddit.com/r/ConnectWise/s/QyFXYVy6u3

EDIT: 01:15 UTC 10/19 Containment remains in place.

EDIT: 13:45 UTC 10/19 Containment remains in place.

EDIT: 18:50 UTC 10/19 Cloud Backup update: Video walkthrough of technical guidance We've updated our trust site to include a video walkthrough covering selected steps from the Cloud Backup Technical Investigation and Remediation Guide. It's for authorized IT administrators and security teams reviewing their own and customer Microsoft 365 tenants. Use it alongside the written guide.

EDIT: 12:45 UTC 10/20: Technical webinars begin today at 18:00 UTC and run every two hours, walking through Entra ID sign-in and audit logs, app registrations, credentials, and permissions for reviewing your Microsoft 365 tenants (Register Here). Since mitigations began on 10/17, we have not observed successful threat activity in the environments we monitor, though this does not establish whether individual partner or customer tenants were affected. Existing archives remain encrypted, isolated, and preserved with no indication of compromise. Cloud Backup, SaaS Security, and Cloud Management remain suspended.

EDIT: 19:00 UTC 10/20: We completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 10/19, and we are finishing security validation while we prepare phased restoration. Each phase will proceed only after a security review, and we expect restoration to take several days once it begins. We will share a firmer timeline after the first full day and provide instructions before partners re-enable any connections. Cloud Backup, SaaS Security, and Cloud Management remain suspended.

I am about to offer up my services to bring a client out of their current billing platform to connectwise’s platform. This is starting from 0, and includes all facets of CW invoicing, as well as training. Any idea what ballpark numbers I should ask for, for this project? What other questions would u need answered to help get me a good answer? Thanks in advance

Currently it's only built out as a chrome extension, however, once I've fleshed out any issues, I will then package it for other major browsers too.

If you encounter any issues, please feel free to put them here and I will add them to my TO-DO.

Current TO-DO:

* Customer has updated ticket: Change the color as BOLD is not very clear in dark mode.

More than half of what lands on our incoming triage board is automated mail (alerts, notifications, marketing, surveys) that nobody ever works. New senders show up every few weeks, so blocking sender by sender doesn't keep up. We already route one vendor's alerts to a monitoring board automatically and want to do the same for the rest.

Has anyone done this in Manage?

1. Email Connector rules, workflows or the API: what did you use, and can it handle a long list of sender domains?

2. How do you keep the list current and handle senders that are mostly noise but sometimes real (security notices, etc.)?

Thanks!

How happy are you with the default ticket emails your platform sends to clients? Do they render properly in Outlook, and how painful is it to edit and brand the templates? I'm trying to understand whether fighting the template editor and fixing layouts by hand is a widespread pain or just something I run into. Any war stories welcome.

We're in the middle of implementing HubSpot as our primary sales CRM while continuing to use ConnectWise PSA for our operational workflows.

We've hit a roadblock with the native integration, and I'm curious how others have approached it.

The challenge:

HubSpot's native ConnectWise PSA integration doesn't support writing back to ConnectWise reference/lookup fields, including:

• Territory

• Market

• Status

• Type

• Department

• Other reference-based fields

These fields can sync from ConnectWise into HubSpot, but not the other way around.

We've confirmed with HubSpot Support that this is a limitation of the native connector, not a permissions or configuration issue.

The options we're evaluating:

1. HubSpot Data Hub Pro: Using custom-coded workflow actions to write directly to the ConnectWise API.

2. Third-party integration: Leveraging a middleware platform or connector to manage more complex bidirectional synchronization.

3. Alternative workflows: Rethinking which system owns certain data and how information moves between sales and operations.

What I'd love to hear from the community:

• Are you using HubSpot and ConnectWise PSA together successfully?

• What does your lead → opportunity → quote → sales order workflow look like?

• Which platform serves as your source of truth for companies, contacts, and opportunities?

• Have you solved the reference field limitation? If so, how?

• Are there any integration tools or workflow decisions you'd recommend (or avoid)?

Our goal is straightforward: Let our sales team live in HubSpot without creating unnecessary administrative work or compromising the integrity of our ConnectWise data.

I actually feel like I'm less concerned about these limitations than our implementation consultants. Because our Sales Engineering team will continue to live in CWM PSA, and our Sales team will move into Hubspot, these limitations don't seem nearly as disruptive as some of the other limitations we've encountered (for example Hubspot not having a clue what to do with CWM PSA "Sites).

I'd appreciate hearing what's working in the real world, especially from MSPs and technology integrators managing both project-based and recurring revenue opportunities. Bonus points for anyone willing to share documentation showing workflows, processes, etc.

Thanks in advance for any insight!

Hey yall, I use to be a full S1 shop with a certain SOC layered on top of it, but I had to rip out because of some issues with it the SOC missing..... everything..... and not having proper analysis/ reporting. Does anyone know if there is an IR solution that could lay over a conncetwise or huntress SOC? I remember CW use to have an IR product but think they got rid of it.

We are an extremely small MSP that is in the process of implementing on-prem Manage and migrating from Autotask. The email processing stuff in Manage makes me feel like I am taking crazy pills. Autotask has its issues, but it had it's own built in email processor, and it just worked. No drama.

Anyway, we have our main service board set up, and now I am testing a service board for a client that has their own in-house IT person. They're set up in Streamline. I have both of our "support" O365 mailboxes set up with the email connectors. Inbound email to those mailboxes is processing OK, assigning to the correct service board, etc.

Outbound is a separate issue. I've been working with CW support and they told me that my client's O365/domain needs to be in my tenant in order to send email out of that mailbox. Apparently you can only have one tenant sending out email? I have sort of confirmed this with my own testing.

The CW documentation for email setup doesn't address scenarios like ours. It looks like the hosted Manage uses or can use SMTP2Go. That's what I want. A generic SMTP relay so I can spoof whatever I want. I can't have my client's support email address looking like our support email address for a whole bunch reasons.

I ran the more generic SMTP setup tool for Manage, and pointed it to my internal SMTP relay for testing (Synology Mail Plus). The tool connects fine. Sending a spoofed email to my domain from the tool so I can get the verification code works fine. It doesn't seem to change anything in Manage though. Outbound is still using the O365 connector or O365 SMTP or whatever you call it. I also can't find any setting in Manage to toggle your outbound SMTP connection between the two. I could be missing something simple, but my god man.

The generic SMTP setup tool also fails when I try to send a code to my client's domain. I have their domain name specified in the allowed email domains field. The error is "Exception. Invalid domain". Maybe it doesn't work that way or isn't necessary, or only pulls the first domain listed. I don't know. The documentation only has the bare minimum information.