The vendor revoked certificates and stopped scheduled backups after intruders used stolen application credentials to reach customer Microsoft 365 tenants.