The persistence move is the part to underline: adding client secrets to two other trusted apps means disabling the seven ConnectWise identities is not cleanup, it is step one. "Review every consented application" is really "re-attest grants you made years ago under a different threat model". For a team that finds a rogue secret, is revoke-first always right, or does keeping it alive for forensics ever win?