# CIPP Documentation Welcome to the CyberDrain Improved Partner Portal (CIPP) User Documentation ## Introduction Welcome to the CIPP User Documentation! CIPP (pronounced "sip") is the CyberDrain Improved Partner Portal, a powerful Microsoft 365 multi-tenant management system designed to help MSPs streamline their clients' Microsoft 365 administration tasks. Created by Kelvin Tegelaar in 2021, CIPP aims to fill the gaps left by existing multi-tenant management solutions, making it easy and efficient to manage multiple clients from one centralised portal experience. CIPP consists of two main components: the CIPP UI and the CIPP API. The frontend is built using React and Core UI, while the API is built with PowerShell. The system leverages Azure Functions and Azure Static Web Apps to provide a fast, responsive, and maintainable solution. ### Key Features * **Central User Management**: CIPP offers a simple user management interface, making it easy to add, edit, and delete users, offboard users, change calendar permissions, manage shared mailboxes, and more. * **Easy Standardisation**: Deploy standards across your entire client base, ensuring tenants are always in the desired state. CIPP's alerting and best practices features help you provide the best experience for your clients. * **Secure and Report**: CIPP includes industry best-practice standards and integrations, allowing you to report on everything in your M365 tenants and secure your customers' environments. ### Documentation Components The documentation is organised into the following components: 1. **Setup Documentation**: This section covers the initial setup process of deploying your own instance of CIPP, including system requirements, installation, and configuration. 2. **User Documentation**: Here, you'll find detailed guides and tutorials on how to use the CIPP platform once it's been deployed to manage your clients' Microsoft 365 tenants. 3. **Developer Documentation**: If you're looking to extend the functionality of CIPP or integrate it with other tools and services, the Developer Documentation provides API documentation, custom scripting, and other advanced topics for developers. In addition to the core documentation components, we also provide a **Troubleshooting Guide** and an **FAQ** section to help you quickly resolve common issues and find answers to frequently asked questions. CIPP is an open-source project, and we encourage users to review the code and contribute to its ongoing development. For more information about the project, its contributors, and funding, please refer to the documentation in the relevant sections. We hope this documentation serves as a valuable resource as you explore and utilise the CyberDrain Improved Partner Portal. If you have any questions or need further assistance, please don't hesitate to check us out in [Discord](https://discord.gg/cyberdrain). ## Our Sponsors
# Setting Up CIPP # Prerequisites This page covers everything you need before installing CIPP. To get started you must follow or have the following ready. Click on the links for instructions on how to perform some of these tasks, or for more information on the functionality in question. ## CyberDrain Hosted Clients {% stepper %} {% step %} ### Active Sponsorship Start by signing up for the $99 subscription using your GitHub account on the [GitHub Sponsorship](https://github.com/sponsors/KelvinTegelaar/sponsorships?tier_id=101398) page. {% endstep %} {% endstepper %} ## Self-Hosted Clients {% stepper %} {% step %} #### Microsoft Tenant Requirements * **Multi-Tenant Mode**: A Microsoft Partner account with your clients’ tenants added.\ If you’re an MSP managing multiple tenants, this is essential for CIPP to function across them. * **Single Tenant Mode or Direct Adds:** When you are not a Microsoft Partner, but want to add multiple tenants, one tenant has to be designated as the tenant that hosts the Application registration CIPP connects with. We consider this the "Partner Tenant" going forward. {% endstep %} {% step %} #### Azure Subscription You’ll need an **active Azure Subscription** where your CIPP resources (Function Apps, Static Web Apps, Key Vault, etc.) will live. If you’re new to Azure, check out [Azure’s free trial](https://azure.microsoft.com/free/) or confirm your existing subscription’s permissions {% endstep %} {% step %} #### Azure Expertise (Assumed) For the installation and maintenance of CIPP, we assume you’re comfortable with: * **Azure Web Apps**: [Learn more](https://learn.microsoft.com/azure/azure-functions/) * **Azure Key Vault**: [Learn more](https://learn.microsoft.com/azure/key-vault/general/) * **Azure Cost Management**: [Learn more](https://learn.microsoft.com/azure/cost-management-billing/) * **Azure Storage** (Tables, Blobs, Files): [Learn more](https://learn.microsoft.com/azure/storage/) {% hint style="warning" %} The linked resources above will help you understand the Azure services CIPP depends on that you will be required to configure and maintain. If you’re missing any of these skills, we suggest reviewing these before proceeding. Proper knowledge ensures a smooth deployment and ongoing maintenance. Failing to understand proper deployment and maintenance of an application deployed to Azure can lead to ballooning costs. {% endhint %} {% endstep %} {% endstepper %} *** {% hint style="info" %} ## **You’re Ready for Installation** Once you’ve checked off these prerequisites, move on to the next page to set up your self-hosted instance. Happy CIPPing! {% endhint %} # Installation Installing Your CIPP Whether you opt to be hosted by CyberDrain or self-host, we've made installation of your instance a breeze. See below for instructions. ## CyberDrain Hosted Deployment {% stepper %} {% step %} ### Open the Management Portal You will receive an email from GitHub once you complete your sponsorship payment directing you to [management.cipp.app](https://management.cipp.app/). {% endstep %} {% step %} ### Log In Use the GitHub account you signed up for the sponsorship to log in to the management portal. {% hint style="warning" %} If you used an organisation account, please send in a support ticket to with the organisation GitHub account and a personal GitHub account. We will add the personal account to the sponsorship to allow you to log in. {% endhint %} {% endstep %} {% step %} ### Start Onboarding Click the Start Onboarding button to begin the installation process {% endstep %} {% step %} ### Choose "Deploy my Instance" Click Next Step {% endstep %} {% step %} ### Complete the Form Details {% hint style="warning" %} Use caution when selecting your deployment region. You should choose a region that is geographically close to where you are located. This will provide your users with the best experience possible as you will have the lowest latency between your users and the server. {% endhint %} {% endstep %} {% step %} ### Verify and Confirm If the information looks correct, click Confirm. {% endstep %} {% step %} ### Monitor You will be able to monitor progress. The management portal will refresh and show your instance information when completed. Alternatively, you can navigate away as you will receive an email once installation is completed. {% hint style="info" %} If you receive an error during installation rest assured that the helpdesk has been alerted and will work to resolve the error quickly. {% endhint %} {% endstep %} {% endstepper %} {% @storylane/embed subdomain="app" url="" linkValue="8lif4yxgrpxs" %} ## Self-Hosted Deployment {% stepper %} {% step %} ### Confirm You’ve Met All Prerequisites Before deploying, ensure you’ve completed everything in the [Prerequisites](/setup/setting-up-cipp/index) section (Azure subscription, experience to manage complex azure environments, and all other requirements). {% endstep %} {% step %} ### Use Template to Deploy This template creates all necessary resources in your selected region, including: * **Azure Web App** (API) with a **Storage Account** * **Azure Key Vault** for CIPP secrets * **Azure App Service Plan** for your computing power * Performance is impacted by your region selection. Make sure you choose the region closest to you for optimal performance. * After you have completed the prerequisites in, select the button below to run the automated setup. [![](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FCyberDrain%2FCIPP%2Frefs%2Fheads%2Fdev%2Fdeployment%2Fcipp-deploy-azure-button.json) {% hint style="danger" %} **What if the deployment fails?** It’s simplest to **delete the resource group** in the Azure portal and try again. This ensures a clean slate. {% endhint %} {% endstep %} {% endstepper %} # Adding a Custom Domain Name Custom domain ## Why set up a custom domain? 1. The automatically generated domain uses azurewebsites.net which is often blocked by web filtering products as it's often used by spammers and phishing sites due to the ease of obtaining an azurewebsites.net subdomain. 2. Your bookmark stays the same if you redeploy. 3. Easier to communicate internally and looks better for your team. At the moment of deployment, the application uses a generated domain name. To change this, follow these instructions: ## CyberDrain Hosted Clients {% stepper %} {% step %} ### Log In to Management Portal Go to [management.cipp.app](https://management.cipp.app/) {% endstep %} {% step %} ### Pick the Domains tab {% endstep %} {% step %} ### Click Add Domain {% endstep %} {% step %} ### Add DNS Records The screen will give you the DNS record you need to add at your DNS provider: a CNAME for a subdomain, or an A record for an apex (root) domain. {% hint style="warning" %} If a TXT record named `asuid.` exists from a previous setup, remove it — domain-verification TXT records are no longer used, and a leftover one blocks validation. {% endhint %} {% endstep %} {% step %} ### Enter Domain and Submit Enter your desired domain into the management portal. Click Add Domain {% endstep %} {% step %} ### Wait The system will validate that the DNS record exists and provision a certificate. The custom domain will become available when certificate provisioning is complete and its status changes to Ready. {% endstep %} {% endstepper %} ## Self-Hosted {% stepper %} {% step %} ### Go to the Azure Portal {% endstep %} {% step %} ### Find the resource group you deployed CIPP in {% endstep %} {% step %} ### Click on the App Service {% endstep %} {% step %} ### In the sidebar, click on Settings, Custom Domains {% endstep %} {% step %} ### Click on Add Custom Domain and enter your information {% endstep %} {% endstepper %} For more information see Microsoft's documentation at # Setting Up SSO and Getting Access to CIPP How to grant users access to the CIPP App ## First Time SSO and First User Setup When you first set up CIPP, you'll need to setup your instance to create your first user, and allow yourself access via SSO. {% stepper %} {% step %} ### Browse to your newly setup CIPP domain For CyberDrain hosted clients, this is in the management portal or the email you receive when deployment is complete. For self-hosted clients, this will be found in the Azure Portal {% endstep %} {% step %} ### Enter a username for the superadmin This must be a M365 user that is able to log on to your tenant. {% hint style="info" %} CyberDrain hosted clients do not need to manually complete this step. It is generated from the form you filled out on the management portal to start your deployment process. This section will be greyed out. {% endhint %} {% endstep %} {% step %} ### Choose which type of logon you want to allow to CIPP * Single tenant is the most secure, and the logons will be limited to the tenant you sign in with * Multi-tenant is required if you have a separation between GDAP and normal usage tenant. {% endstep %} {% step %} ### Sign in Sign in with a user that has Application Administrator permissions or higher, advanced users can use Setup 2B for manual setup of the SSO app. {% endstep %} {% endstepper %} {% @storylane/embed subdomain="app" url="" linkValue="admss49amlvr" %} ## Additional User Setup Once you have your initial user added, this user can add more users through the CIPP interface under CIPP -> Advanced -> Authentication -> [CIPP Users](/user-documentation/cipp/advanced/authentication/cipp-users). ## Built-In Roles CIPP features a role management system which utilises the [Roles feature of Azure Static Web Apps](https://learn.microsoft.com/en-us/azure/static-web-apps/authentication-authorization?tabs=invitations#roles). The roles available in CIPP are as follows: | Role Name | Description | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | readonly | Only allowed to read and list items and send push messages to users. | | editor | Allowed to perform everything, except change system settings and manage Standards. | | admin | Allowed to perform everything. | | superadmin | A role that is only allowed to access the settings menu for specific high-privilege settings, such as setting up the [I Want to Manage My Own Tenant](/setup/installation/owntenant) settings. | You can assign these roles to Entra groups or users using the [CIPP Roles](/user-documentation/cipp/advanced/authentication/cipp-roles) page, so you no longer have to add users manually. ## Custom Roles {% hint style="info" %} Not sure how built-in and custom roles combine when a user is in multiple Entra groups? See [How CIPP Evaluates Roles](/setup/resources/how-cipp-evaluates-roles) for the precedence for rules. {% endhint %} While CIPP only supplies the above roles by default, you can create your own custom roles and apply them to your users with `editor` or `readonly` rights, admin users are unaffected by custom roles. {% hint style="info" %} Custom role permissions can only grant the highest level of the base permission. You cannot grant edit permissions to the `readonly` role. Assigning the `editor` role and then using a custom role to remove permissions will provide you with the functionality you're looking for there. In the same way, assigning multiple custom roles is restrictive and not additive. The user will only have the lowest granted permission included in the combined set. A missing permission in the set is implied as no permission. {% endhint %} Set up Custom Roles by following these steps: {% stepper %} {% step %} ### Open the CIPP Roles Page Go to CIPP -> Advanced -> Authentication -> [CIPP Roles](/user-documentation/cipp/advanced/authentication/cipp-roles). {% endstep %} {% step %} ### Select a Custom Role from the list or start typing to create a new one if you do not yet have any {% hint style="info" %} Please ensure that your custom role is entirely in lowercase and does not contain spaces or special characters. {% endhint %} {% endstep %} {% step %} ### Entra ID Group Mapping Optionally select a Entra group this role will be mapped to. Adding an Entra group removes the requirement to add the user to either the SWA or inviting via the Management Portal. {% endstep %} {% step %} ### Allowed Tenants For Allowed Tenants select a subset of tenants to manage, tenant groups, or AllTenants. {% hint style="info" %} If AllTenants is selected, you can block a subset of tenants or tenant groups using Blocked Tenants. {% endhint %} {% endstep %} {% step %} ### Endpoint Restrictions Optionally select the CIPP endpoints that you want to block for the role. For example, if you do not want the role to have access to delete users/mailboxes you would block `RemoveUser`. {% endstep %} {% step %} ### API Permissions Select the API permission from the listed categories and choose from None, Read or Read/Write. * To find out which API endpoints are affected by these selections, click on the Info button. * Not defining a category is the same as setting None. Be sure that you define all base role permissions you want to apply to the user. {% endstep %} {% step %} ### Base Role Assignment You must be sure to assign both the custom role and the base role `readonly` or `editor` to the users. * If using Entra ID groups, you can map the base role to a Entra group (eg. `CIPP readonly` mapped to `readonly`) and add the user to the base role Entra group and the custom role Entra group to properly manage permissions * If using SWA role management (self-hosted) or management portal (CyberDrain hosted) be sure to add both roles to the user manually. {% endstep %} {% endstepper %} # Configuring CIPP Getting started with setting up the CyberDrain Improved Partner Portal ## Introduction This section of the documentation will walk you through the process of setting up the CyberDrain Improved Partner Portal (CIPP) to manage your clients' tenants efficiently. CIPP is a powerful Microsoft 365 multitenant management system that will allow you to deploy standard properties across all your tenants, easily manage everything from a single portal, and keep your managed environments in the best shape. ## How will you be planning to use CIPP? Depending on how you will deploy the software will determine where you will want to start. * **Self-Hosted Instance:** If you are planning on forking and hosting CIPP in your own Azure environment, you will want to start on the [Prerequisites](/setup/setting-up-cipp/index) page. * **Hosted Sponsor Instance:** If you are planning on sponsoring the CIPP project and having us host your instance for you, you can skip the "Self-hosting guide" and start configuration of CIPP by clicking next. # Creating the CIPP Service Account ## Setup Video for the CIPP Service Account *** {% embed url="" fullWidth="false" %} {% hint style="danger" %} ### When setting up your Service Account, remember: ### Administration Requirements 1. Must be at least **Application Administration**, **Privileged Role Administrator**, and **User Administrator** while setting up the integration. If setup fails, you may need to switch to **Global Administrator** to ensure all necessary permissions are granted. 2. If you wish to manage your own tenant, you can assign additional permissions as described here: [Recommended Roles](/setup/maintaining-cipp/recommended-roles) and continue to [I Want to Manage My Own Tenant](/setup/installation/owntenant). 3. Must be added to the **AdminAgents** group**.** This group is required for connection to the Microsoft Partner API. ### Multi-factor Authentication 1. **MFA Setup:** This account must have **Microsoft** MFA enforced for each logon. 1. Use [Conditional Access](/setup/installation/conditionalaccess) when available or via [Per User MFA](https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx) when not available. 2. **Microsoft MFA is mandatory.** Do not use alternative providers like Duo, and ensure it's set up **before any login attempts.** 1. Reference [this article on Supported MFA options](https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements-mandating-mfa#supported-mfa-options) from Microsoft for more details. {% endhint %} ## Setup Walkthrough for the CIPP Service Account *** This guide walks you through the process from the video of setting up the CIPP Service Account. Follow the instructions on this page to the letter to ensure a seamless setup process down the line. The CIPP service account will be the account used to execute any actions on your tenants via CIPP. To get started, head to the Microsoft Entra Portal's user overview at [entra.microsoft.com](https://entra.microsoft.com/) **If you would like to use notifications, webhook triggers, or exporting to other system the account you use must have a mailbox available. This mailbox will be used for outgoing reports, exports, and notifications.** 1. Click on the "New user" button. ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2Fv5BfyGiEY4FqmbqxRCymsD_doc.png?alt=media\&token=ad9a3831-cec6-4244-b5f4-f90d08ae87ea\&time=Fri%20Jul%2026%202024%2021:57:39%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 2. Create a new internal user in your organisation ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FsTTkLSePkCmuzgTg9nFYvJ_doc.png?alt=media\&token=2017aff5-ecc2-4030-ba90-9b955a14ec97\&time=Fri%20Jul%2026%202024%2021:57:44%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 3. Enter a username in the field, we recommend something identifiable like "CIPPServiceAccount" ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2Fmp4FiwSvkpKyfKgcbQ3Ac9_doc.png?alt=media\&token=eda4079d-869a-40bd-8a0f-2c436806be3e\&time=Fri%20Jul%2026%202024%2021:57:46%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 4. Enter "CIPP Service Account" in the Display Name field. Set the password to something strong, and save this password in a secure location ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FhLEJyFsy7Dxs69tcJkYt4p_doc.png?alt=media\&token=216ec97e-b904-4dcb-8a4c-1f359ae5fc91\&time=Fri%20Jul%2026%202024%2021:57:47%20GMT-0400%20\(Eastern%20Daylight%20Time\)) {% hint style="info" %} It is recommended to use these values since the Permissions Check in [Permissions](/user-documentation/cipp/settings/permissions) will look to ensure "CIPP" or "Service" exists in the Display Name or User Principal Name of the account. The permissions check is an often used tool when troubleshooting CIPP errors. {% endhint %} 5. Click on "Next: Properties". ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FreEjqnr9Xp15EZ3UPq6ZVJ_doc.png?alt=media\&token=acee15fa-1072-459a-ac97-77c4fb8e30bd\&time=Fri%20Jul%2026%202024%2021:57:49%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 6. Click on "Next: Assignments". ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FeY6Qmd985ryQ1gDMCLiL86_doc.png?alt=media\&token=a8fddef5-d5be-4419-9d9c-582385be0847\&time=Fri%20Jul%2026%202024%2021:57:50%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 7. If you are a Microsoft Partner, and want to manage all your client tenants, click on Add Group. ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FpwCpPxMXQuSwM9V8e6hVGi_doc.png?alt=media\&token=9cb5bf0c-a093-4610-a099-a9e15f163f78\&time=Fri%20Jul%2026%202024%2021:57:51%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 8. Select the AdminAgents group. This group is required for connection to the Microsoft Partner API. ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FpZSBZsEEMGeyHRon7PjrnM_doc.png?alt=media\&token=790a804e-52cf-4f8e-b6cc-b1caace518cd\&time=Fri%20Jul%2026%202024%2021:57:59%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 9. Select your GDAP groups ***If*** you have already migrated to GDAP you select your GDAP groups at this stage. If you migrated using CIPP these groups start with `M365 GDAP`. If you have migrated without using CIPP, check our [Recommended Roles](/setup/maintaining-cipp/recommended-roles) page for the latest required GDAP roles. If you have not migrated or used GDAP at all or are planning to onboard your GDAP tenants using CIPP, continue on. You'll want to come back after creating your `M365 GDAP` groups and add your service account to them. {% hint style="warning" %} These groups might not exist if you have not yet migrated to GDAP. If you want to move to using CIPP and Microsoft's best practice recommendation of mapping one role to one security group, you can skip this step for now. CIPP will create the groups when you first add your client tenants through [Tenant Onboarding](/setup/installation/gdap-invite-wizard). {% endhint %} ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FohuBSMhxAWuhe35TnuLP9o_doc.png?alt=media\&token=fcdc99db-ea70-46bb-8276-1a21d659948e\&time=Fri%20Jul%2026%202024%2021:58:00%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 10. Click "Add role" ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FrNKg3zxDF4cCxMzhGPHRfT_doc.png?alt=media\&token=eee64997-0439-4965-ad41-c8a89d343d36\&time=Fri%20Jul%2026%202024%2021:58:01%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 11. Add the Application Administrator, Privileged Role Administrator, and User Administrator Roles Find the Application Administrator and User Administrator roles. These roles are required for the CIPP-SAM application creation and are recommended to be removed directly after installation. ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FpqpK88ZAo9i5iijFyHjy6u_doc.png?alt=media\&token=8e954768-0be0-4dd0-8da1-1b0063fdd1e0\&time=Fri%20Jul%2026%202024%2021:58:01%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 12. Click "Next: Review + create" ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FpnRtZ7vUas2492Hrzv5Fnr_doc.png?alt=media\&token=b193f7ba-8881-44ad-8df1-1d42001ec558\&time=Fri%20Jul%2026%202024%2021:58:01%20GMT-0400%20\(Eastern%20Daylight%20Time\)) 13. Click on "Create". This creates the account. ![preview](https://storage.app.guidde.com/v0/b/guidde-production.appspot.com/o/quickguiddeScreenshots%2FIEPB08VSavefFaCa9OSp3Y87aGu1%2Fi9fztXsCUWjY3cr8mySvCX%2FdBdzTWoKBR8LRgmQYnAWFK_doc.png?alt=media\&token=2fb657ce-f9c5-47bc-8dfc-d6e71a4f11a3\&time=Fri%20Jul%2026%202024%2021:58:02%20GMT-0400%20\(Eastern%20Daylight%20Time\)) # Conditional Access Configuration Set up your Conditional Access policies for CIPP. To make sure CIPP is able to access your tenants securely we recommend the usage of Conditional Access. Both your, and your clients Conditional Access Policies will need to be configured for optimal usage. ## Setup of Your Conditional Access Policies {% stepper %} {% step %} ### Open Azure Browse to the [Conditional Access Policies](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) blade in Azure. {% endstep %} {% step %} ### Edit Existing Conditional Access Policies Exclude the CIPP service account from **each** existing policy, this way we have a dedicated policy for the CIPP service account {% endstep %} {% step %} ### Create CIPP Specific Policy Create a new policy and include the CIPP user. Enforce Azure Multi-Factor Authentication for each logon (set sign in frequency under session to every time) and for all cloud applications. Do not add any exclusions or trusted locations. Save this policy under the name "CIPP Service Account Conditional Access Policy" {% endstep %} {% endstepper %} ## Setup of Clients' Conditional Access Policies GDAP is affected by your clients' conditional access policies. To make sure you can access your clients using your CIPP integration user we recommend excluding the MSP from the Conditional Access Policy per [Microsoft's Documentation](https://learn.microsoft.com/en-us/partner-center/gdap-faq#what-is-the-recommended-next-step-if-the-conditional-access-policy-set-by-the-customer-blocks-all-external-access-including-csps-access-aobo-to-the-customers-tenant) {% stepper %} {% step %} ### Open Azure Browse to your client's [Conditional Access Policies](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) blade in Azure. {% endstep %} {% step %} ### Edit Conditional Access Policies For each policy listed. Add an exclusion to "Users and Groups" with the following settings: * Guest or external users * Service Provider Users * Selected * Enter your tenant ID. If you do not know what your tenant ID is, you can look this up [here](https://whatismytenantid.com/). {% endstep %} {% endstepper %} {% hint style="warning" %} Optional: If you are running in Direct Tenant mode, exclude the CIPP service account for this tenant instead of the tenant exclusion. Optional: If you have already onboarded the tenant and see access issues, you can use the action "Add service provider exception to policy" on [CA Policies](/user-documentation/tenant/conditional/list-policies). {% endhint %} # Executing the Setup Wizard This guide walks you through the process of executing the Setup Wizard inside CIPP for the first time. The Setup Wizard presents you with multiple options. If this is your first setup, choose the "First Setup" option. ## Getting Started with the CIPP Setup Wizard {% @storylane/embed subdomain="app" url="" linkValue="vxdbaztterzq" %} {% stepper %} {% step %} ### Begin Setup Click on "First Setup" to start the configuration process. {% endstep %} {% step %} ### Application Registration On this page, you’ll create the necessary Application Registration in your Microsoft 365 environment. This application is used to manage tenant connections. * Click Authenticate and follow the on-screen instructions to register the application. * Important: Use the dedicated CIPP service account created during the preparation steps. {% hint style="info" %} If authentication fails, assign Global Administrator to the service account temporarily to ensure sufficient rights to approve all necessary application permissions. {% endhint %} {% endstep %} {% step %} ### **Tenant Configuration** Start with **"Connect to Partner Tenant"**, even if you're not a Microsoft Partner. This step is needed regardless of how you plan to connect your tenants. Authenticating here consents the **CIPP-SAM** application in your partner tenant (or, if you're not a Microsoft Partner, in the first tenant you designate as the "partner" tenant). That consent is what lets CIPP manage its own credentials and application permissions, such as creating and managing additional API clients. The option to add separate tenants becomes available once a partner tenant is connected. {% hint style="info" %} You'll sign in again here — this is a separate authentication from the previous step, so use the same dedicated CIPP service account. If you're already signed in to another account, your browser may pick it automatically, so it's worth checking the account shown before approving consent. Afterwards, the page displays the connected tenant and user so you can confirm it's correct. {% endhint %} Once the partner tenant is connected, you can also use **"Connect to Separate Tenants"** to add tenants individually, outside your partner relationship. Repeat that step for each tenant you want to add. * For these separate tenants, use a service account with equivalent permissions as the partner tenant. More information on these roles can be found under [Recommended Roles](/setup/maintaining-cipp/recommended-roles) {% endstep %} {% step %} ### Select Baselines Choose from a list of available configuration baselines. These presets help you quickly apply best practices and policies. * We recommend selecting the **CyberDrain Templates** for the most optimised standard configurations and receiving templates and examples on how to utilise standards. {% endstep %} {% step %} ### Configure Notifications Set up email notifications on the next page. * Ensure your service account has a mailbox enabled to support email alerts. This can either be a shared mailbox * You can test notification delivery directly from this screen. {% endstep %} {% step %} ### Optional Features The final step presents a list of optional features you can enable to further enhance CIPP’s functionality. Review and configure these as needed. Many of these features are quite powerful and CIPP users often find they greatly enhance their experience and ease the burden of tenant administration. {% endstep %} {% endstepper %} ### Common Errors
"Response status code does not indicate success" during Step 2 We have seen Microsoft implement some new secure by design initiatives that are impacting the ability for tenants, especially newly created tenants, from successfully completing the authentication. By default, Microsoft has disabled the ability for Enterprise Applications to add passwords in new tenants. Open up the Entra portal for your tenant. Navigate to Enterprise Applications > Application Policies. View the "Password addition restriction" policy. To remain most secure, leave the policy enabled but set an exclusion for the CIPP-SAM app by selecting "All applications with exclusions" and adding the CIPP-SAM app to the excluded apps list. Wait a bit for the policy to update to apply and then try the Setup Wizard again.
# Tenant Onboarding You'll continue to use the Setup Wizard to onboard your client tenants. You can either add a GDAP tenant or a direct tenant if no GDAP relationship exists. *** ## **Wizard Steps for GDAP Tenants** {% @storylane/embed subdomain="app" url="" linkValue="p6cyd3t8w8ru" %} {% stepper %} {% step %} ### **Click on "Add a Tenant"** To get started, we click the "Add a Tenant" button and "Next Step". {% endstep %} {% step %} ### Select Tenant Add Method of "Add GDAP Template" Select "Add GDAP Tenant" and click "Next Step" {% endstep %} {% step %} ### Select GDAP Role Template Select the GDAP Role Template you would like to use for this onboarding. This will automatically map your GDAP security groups with the GDAP roles. {% hint style="info" %} If this is your first GDAP tenant, you will be prompted to optionally add the CIPP Default role template. This role template will automatically create the 15 GDAP groups matching the [Recommended Roles](/setup/maintaining-cipp/recommended-roles). {% endhint %} {% endstep %} {% step %} ### Click "Create Invite URL" and Consent in Client Tenant This will generate a unique GDAP invite URL with the associated roles selected from your template. This link will need to be consented by your client's Global Administrator in order to accept the contractual relationship. Once completed, check the box that the invite has been accepted and click "Next Step". {% endstep %} {% step %} ### Tenant Onboarding On this step, you can review the relationship info. Before clicking "Start Onboarding", decide if you want to have the tenant excluded from All Tenants standards to allow you time to review the tenant before those are applied. Once done, click "Start Onboarding". CIPP will now automatically complete the tenant onboarding. This includes verifying the relationship was accepted, the roles are present in the relationship, the security groups are mapped to the tenant, and the tenant is accessible via Graph API. {% endstep %} {% step %} ### Confirm The final page is a confirmation that shows you what you've completed. {% endstep %} {% endstepper %} ## Wizard Steps for Direct Tenants {% @storylane/embed subdomain="app" url="" linkValue="kcszcpgdcg6m" %} CIPP will also allow you to manage tenants that you do not have a GDAP relationship with. {% stepper %} {% step %} ### Click on "Add a Tenant" To get started, we click the "Add a Tenant" button and "Next Step". {% endstep %} {% step %} ### Click on "Add Direct Tenant" Select "Add Direct Tenant" and click "Next Step" {% endstep %} {% step %} ### Click "Connect to Tenant" Click the "Connect to Tenant" button. Use a service account with equivalent permissions as the partner tenant. More information on these roles can be found under [Recommended Roles](/setup/maintaining-cipp/recommended-roles). {% hint style="info" %} Be sure to consent on behalf of the organisation to prevent prompts for future users who may log in to CIPP, such as a co-managed client technician. {% endhint %} {% endstep %} {% step %} ### Confirm The final page is a confirmation that shows you what you've completed. {% endstep %} {% endstepper %} {% hint style="warning" %} Do not attempt to add your partner tenant as a direct tenant. This will result in a permission error. To add your partner tenant, please see [Tenant Mode](/user-documentation/cipp/advanced/super-admin/tenant-mode) and select "Multi Tenant - Add Partner Tenant" or "Single Tenant - Own Tenant Mode". {% endhint %} ### Limitations of Direct Tenants There are limitations to what CIPP can do with directly added tenants due to some features relying on Lighthouse, Partner Center APIs or authentication via GDAP; * Admin Portal Links - These utilise the GDAP relationship to log in as your CSP user. You will have to log in to the portal with an account native to the tenant * Alerts - There are certain alerts that will only work with GDAP/Lighthouse * Alert if Defender is not running * Alert if Defender Malware found * Inactive Users Report - Relies on a CSP report # I Want to Manage My Own Tenant If you want to manage your own tenant or if you are not a Microsoft Partner but still want to use CIPP you can perform the setup and enable access to the partner tenant or enable Single Tenant Mode. The CIPP Service Account should be granted at least the [Recommended Roles](/setup/maintaining-cipp/recommended-roles) within the tenant being managed. {% hint style="warning" %} To manage the tenant mode, a user with the CIPP `superadmin` role will need to access the [Tenant Mode](/user-documentation/cipp/advanced/super-admin/tenant-mode) page of the Super Admin settings. {% endhint %} ### There are 3 different modes in CIPP to choose from: * **Multi Tenant - GDAP mode** * This is the default mode in CIPP, it does not allow access to the partner tenant. * **Multi Tenant - Add Partner Tenant** * This mode allows direct access to the partner tenant in addition to your customer tenants via GDAP. See the Limitations below for more details. * **Single Tenant - Own Tenant Mode** * This mode is for if you would like to manage your own tenant and/or are not a Microsoft Partner. See the limitations below for more details. ## Limitations of Single Tenant Mode When using Single Tenant Mode CIPP runs in a somewhat more limited state - You are not able to add any other tenant to CIPP, and it only works for the configured tenant. GDAP permissions will not apply, and you must directly assign roles such as Global Admin to the service account. ## Limitations of Partner Tenant Enabled When using Partner Tenant Enabled mode you can see your partner tenant inside of CIPP. There will be no permissions applied to who can see this tenant and control it. {% hint style="danger" %} It is highly recommended to use a custom role if multiple users have access to your CIPP instances. This can help ensure not all users have access to manage your partner tenant. If you do not, it's important to note that all your users will have access to edit/configure your partner tenant. Information on custom roles can be found [here](https://docs.cipp.app/setup/installation/roles#custom-roles). {% endhint %} GDAP permissions will not apply, and you must directly assign roles to the service account in the Entra portal (e.g. User Administrator, Exchange Administrator, etc.). ## To set the tenant mode, follow these steps 1. Log in to CIPP with an account with the role `superadmin`. This role will allow you access to the menu to change this setting. 2. Click CIPP at the bottom of the left-hand menu 3. Click Advanced 4. Click Super Admin 5. The default tab is the Tenant Mode tab 6. Select one of the three modes. The default mode is "Multi Tenant - GDAP Mode" 7. Clear the tenant cache. Users of CIPP now have access to the CSP Partner tenant, or to the single tenant it's been configured for. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Maintaining CIPP # Updating Versions Keeping CIPP up-to-date ensures you have the latest features, security patches, and bug fixes. {% hint style="warning" %} ## **CyberDrain Hosted Clients** If you’re using a CyberDrain-hosted instance of CIPP, updates happen automatically; generally, within **48 hours** of a new release. You can safely skip the rest of this page; however, it is important to perform a permissions check via CIPP > Application Settings > [Permissions](/user-documentation/cipp/settings/permissions) to ensure any newly added permissions are accounted for. {% endhint %} Update your self-hosted CIPP instance to the latest release using the following instructions: {% stepper %} {% step %} ### Log in to CIPP Log in to CIPP as a superadmin account {% endstep %} {% step %} ### Open Container Management Go to CIPP -> Advanced -> Container Management -> [Status & Updates](/user-documentation/cipp/advanced/container-management/status) {% endstep %} {% step %} ### Update Management Set your auto-update settings or press the "Check now" button to check for updates and install them. {% hint style="info" %} You can optionally change which Release Channel you target for updates. Use caution when running Dev or Nightly as these can contain untested changes. {% endhint %} {% endstep %} {% endstepper %} # Recommended Roles As CIPP is an application that touches many parts of M365 selecting the roles might be difficult. The following roles are recommended for CIPP, but you may experiment with less permissive groups at your own risk. {% hint style="warning" %} Please note that any relationship that contains the `Global Administrator`/`Company Administrator` role will NOT be eligible for auto extend. {% endhint %} The table below outlines the recommended roles for use in CIPP, describing what each role enables. Click on the Role Name to navigate to Microsoft's [Entra ID built-in roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#cloud-app-security-administrator) page for detailed information about each specific role. ## Roles
Role NameWhat it allows for
Application AdministratorCan create and manage all applications, service principals, app registration, enterprise apps, consent requests. Cannot manage directory roles, security groups.
Authentication Policy AdministratorConfigures authentication methods policy, MFA settings, manages Password Protection settings, creates/manages verifiable credentials, Azure support tickets. Restrictions on updating sensitive properties, deleting/restoring users, legacy MFA settings.
Billing Administrator*Can perform common billing related tasks like updating payment information.
Cloud App Security AdministratorManages all aspects of the Defender for Cloud App Security in Azure AD, including policies, alerts, and related configurations.
Cloud Device AdministratorEnables, disables, deletes devices in Azure AD, reads Windows 10 BitLocker keys. Does not grant permissions to manage other properties on the device.
Domain Name Administrator*Can manage domain names in cloud and on-premises.
Exchange AdministratorManages all aspects of Exchange Online, including mailboxes, permissions, connectivity, and related settings. Limited access to related Exchange settings in Azure AD.
Global Reader*Can read everything that a Global Administrator can but not update anything.
Intune AdministratorManages all aspects of Intune, including all related resources, policies, configurations, and tasks.
Privileged Authentication AdministratorSets/resets authentication methods for all users (admin or non-admin), deletes/restores any users. Manages support tickets in Azure and Microsoft 365. Restrictions on managing per-user MFA in legacy MFA portal.
Privileged Role AdministratorManages role assignments in Azure AD, Azure AD Privileged Identity Management, creates/manages groups, manages all aspects of Privileged Identity Management, administrative units. Allows managing assignments for all Azure AD roles including Global Administrator.
Security AdministratorCan read security information and reports, and manages security-related features, including identity protection, security policies, device management, and threat management in Azure AD and Office 365.
SharePoint AdministratorManages all aspects of SharePoint Online, Microsoft 365 groups, support tickets, service health. Scoped permissions for Microsoft Intune, SharePoint, and OneDrive resources.
Teams AdministratorManages all aspects of Microsoft Teams, including telephony, messaging, meetings, teams, Microsoft 365 groups, support tickets, and service health.
User AdministratorManages all aspects of users, groups, registration, and resets passwords for limited admins. Cannot manage security-related policies or other configuration objects.
{% hint style="warning" %} \*- A previous version of this document merely suggested that these roles were recommended. CIPP is transitioning to requiring these as part of your baseline GDAP deployment given the depth of features being added to the product that require them. It is recommended that these be added to your [GDAP Role Mapping](/user-documentation/tenant/gdap-management/roles/add) and add these three roles to your [Role Template](/user-documentation/tenant/gdap-management/role-templates). {% endhint %} ## Handling the Additional Recommended Roles With v10.1, CIPP added the three previously suggested roles to the core recommended roles as part of the code. This is causing many who have been using CIPP for a while to show the missing roles when doing a permission check. Here's our recommended way to best handle resolving these issues: {% stepper %} {% step %} #### Map the Additional Roles Go to `Tenant Administration` > `GDAP Management` > `Role Mappings` and click `Map GDAP Roles`. Select `Billing Administrator`, `Domain Name Administrator`, and `Global Reader` in the dropdown. Hit `Submit` and CIPP will create the `M365 GDAP` groups. {% endstep %} {% step %} #### Add the CIPP Service Account to the New Role Groups If you've added your partner/internal tenant to CIPP, use `Identity Management` > `Administration` > `Users` to add the service account to the three additional security groups. If not, manually complete this in Entra or the Microsoft 365 Admin portal. {% endstep %} {% step %} #### Recreate the CIPP Defaults Role Template In `Tenant Administration` > `GDAP Management` > `Role Templates`, locate your CIPP Defaults role template and delete it. A prompt will show asking if you would like to create the CIPP Defaults template. Click the button to create the defaults. This new template will include all 15 roles. {% endstep %} {% step %} #### Generate New GDAP Relationships {% hint style="warning" %} You cannot add GDAP roles to an existing relationship and there is no supported way to automate this. {% endhint %} From the `Invites` tab, use the `New Invite` action to generate enough invite links with the new CIPP Defaults template to establish new relationships with all your GDAP clients. {% endstep %} {% step %} #### Consent to New GDAP Relationships A Global Administrator in each client tenant will need to consent to the new relationship. {% endstep %} {% step %} #### (Optional) Terminate Old GDAP Relationships From `Tenant Administration` > `GDAP Management` > `Relationships`, select your old relationships and use the action `Terminate Relationship`. This can either be done one by one or using the check boxes and bulk actions. {% endstep %} {% endstepper %} # Migrating to Hosted CIPP When you start a **CIPP sponsorship**, you can either: * Continue self-hosting and receive support for that setup, **or** * Use the **version hosted by CyberDrain** (fully managed). If you decide to **migrate** from a self-hosted instance to our **hosted** environment, follow these steps: *** ### 1. Back Up Your Self-Hosted Instance {% hint style="warning" %} NOTE: Please ensure your function app is set to run on PowerShell 7.4, otherwise the backups may be corrupted. {% endhint %} {% stepper %} {% step %} **Log In** to your **self-hosted** CIPP instance. {% endstep %} {% step %} Go to **Application Settings** → click **Run Backup**. {% endstep %} {% step %} **Download** the generated backup file. * Store this file in a safe location (it contains all your CIPP config). {% endstep %} {% endstepper %} *** ### 2. Deploy Your Hosted Instance {% stepper %} {% step %} **Go to** CIPP's [Management Portal](https://management.cipp.app/) and log in with the GitHub account you used to sponsor. {% hint style="warning" %} NOTE: If you sponsor with an organisation GitHub account, please send in a message to with your personal GitHub username so that we can manually add that user to the portal. You cannot log in to the management portal with organisation accounts. {% endhint %} {% endstep %} {% step %} **Deploy** your hosted CIPP instance by filling out the required information. {% endstep %} {% step %} **Accept** the initial invite and log into the newly created hosted environment. {% endstep %} {% endstepper %} *** ### 3. Transfer Your Key Vault Secrets The CIPP Key Vault holds four secrets you'll need to enter into the hosted setup wizard: {% stepper %} {% step %} Return to your **self-hosted** instance → **Application Settings** → **Backend**. {% endstep %} {% step %} Click **Go to Keyvault**. This opens the Azure portal on your Key Vault's **Overview** blade. Keep this tab open. {% endstep %} {% step %} **Grant yourself permission to read the secrets.** By default, even the user who deployed CIPP does not have data plane access to the secret values; only management plane access to the vault itself. Add yourself under **Access policies** — not under **Access control (IAM)**. 1. In the Key Vault's left navigation, click **Access policies**. 2. Click **+ Create**. 3. On the **Permissions** tab, under **Secret permissions**, tick: **List**, **Get**, **Set**, **Delete**, **Recover**, **Backup**, and **Restore**. Leave Key and Certificate permissions unticked. Click **Next**. 4. On the **Principal** tab, search for your own account, select it, then click **Next**. 5. Skip the **Application** tab by clicking **Next**. 6. On the **Review + create** tab, click **Create**. {% hint style="info" %} If **Access policies** is missing from the left navigation, your Key Vault is using the Azure RBAC permission model rather than the vault access policy model. Switch it under **Settings** → **Access configuration**, or grant yourself the **Key Vault Secrets Officer** role under **Access control (IAM)** instead. {% endhint %} {% hint style="info" %} The policy usually takes effect within 30–60 seconds. If you get a "Caller is not authorized" error in the next step, wait a moment and refresh. {% endhint %} {% endstep %} {% step %} **Open the secrets list.** In the Key Vault's left navigation, expand **Objects** and click **Secrets**. You should see the four secrets listed above. {% endstep %} {% step %} **Reveal and copy each secret value.** For each of the four secrets: 1. Click the secret name (e.g. `ApplicationID`). 2. Click the row for the **current version** (the GUID shown under "Current Version"). 3. At the bottom of the version page, click **Show Secret Value**. 4. Click the **copy** icon to the right of the revealed value. 5. Switch to your hosted CIPP tab and paste the value into the matching field in the setup wizard (see the table at the top of this section). 6. Use the browser back button twice to return to the secrets list, and repeat for the next secret. {% hint style="warning" %} Treat these values like passwords. The Application Secret and Refresh Token together grant unattended access to every customer tenant connected through your CIPP-SAM application. Don't paste them into anything other than the hosted setup wizard. {% endhint %} {% endstep %} {% step %} In your **hosted** instance, open the CIPP **Setup Wizard** (if you haven't already) and select **"I have an existing application and would like to manually enter my tokens."** {% endstep %} {% step %} Confirm all four fields are populated, then click \*\*Next\*\* to finish the wizard. {% endstep %} {% endstepper %} *** ### 4. Restore Your Backup {% stepper %} {% step %} In your **hosted** CIPP instance, navigate to **Application Settings** → **Restore Backup**. {% endstep %} {% step %} **Upload** the backup file you downloaded in Step 1. {% endstep %} {% step %} Wait for the restore to complete—CIPP will import your original configuration and data. {% endstep %} {% endstepper %} *** ### 5. (Optional) Custom Domain Cleanup * If you used a **custom domain** on your self-hosted instance, remove it there first so you can reuse it in the hosted environment. * In the **Management Portal**, add your custom domain to the hosted CIPP instance following the on-screen instructions. *** ### That’s It! Your instance and settings now live in the fully managed, **CyberDrain-hosted** version of CIPP. Congratulations on a smooth migration! Enjoy your new, hosted CIPP with automatic updates and support. # Migrating to the Latest Version of CIPP In July of 2026, we were pleased to announce new infrastructure for CIPP. Migrating to the new infrastructure gains speed and controlled cost. Newly deployed CIPP instances are already on the new infrastructure. ## CyberDrain Hosted Clients {% stepper %} {% step %} ### Open the Management Portal Navigate to [management.cipp.app](https://management.cipp.app/). {% endstep %} {% step %} ### Go to Early Opt-In {% endstep %} {% step %} ### Complete the Form {% endstep %} {% step %} ### Submit The Overview tab will show when your migration is complete. {% hint style="info" %} If you receive an error during migration rest assured that the helpdesk has been alerted and will work to resolve the error quickly. {% endhint %} {% endstep %} {% step %} ### SSO Setup If you haven't already completed the SSO set up steps you will be prompted to complete that setup when you first open CIPP again. See [Setting Up SSO and Getting Access to CIPP](/setup/setting-up-cipp/roles) {% endstep %} {% step %} ### Custom Domain If you had a custom domain on your old version of CIPP, you'll need to migrate it too. To migrate a domain to the new generation of CIPP, point its existing CNAME record at CIPPXXXX.azurewebsites.net, then add the domain here. It will move over automatically. If a TXT record named `asuid.` exists from your previous setup, remove it — domain-verification TXT records are no longer used, and a leftover one blocks validation. This step must be performed in the [management portal](https://management.cipp.app/). {% hint style="warning" %} Users who load your pre-existing custom domain prior to the certificate being provisioned will be redirected to the new Azure URL. After the certificate is provisioned they may still experience this behavior as their local DNS cache will remember the redirect. Please direct those users to clear their cache. {% endhint %} {% endstep %} {% endstepper %} {% @storylane/embed subdomain="app" url="" linkValue="d3kcpzf2efuj" %} ## Self-Hosted Clients More information coming at a future date. We are only handling CyberDrain hosted migrations at this time. # Implementing CIPP # Recommended First Steps First things to check out after setting up CIPP. Welcome to the post-setup implementation guide for CIPP! In this guide, you will learn how to navigate and configure various settings within the CIPP application. Let's discover some of the key features of CIPP and see how to use them. {% hint style="info" %} This guide is not meant to be exhaustive but rather point you towards other pages in the documentation for a deeper dive. Click any of the available links for more information on each page. {% endhint %} {% hint style="success" %} Select [Setup Wizard](/user-documentation/cipp/sam-setup-wizard) from CIPP settings for easy set up of several of the basics needed to operate CIPP. {% endhint %} ## Tenant Navigation Using the [Tenant Select](/user-documentation/shared-features/menu-bar/tenant-select) at the top you can switch tenants at any time. This allows you to dynamically choose what you're working on. You can also use the Tenant Selector to select "All Tenants", which allows you to see all your tenants at once. ## Personalisation Let's set up some personal things first. The [User Preferences](/user-documentation/shared-features/menu-bar/user-settings) section has your personal preferences and profile information. Let's start by setting up CIPP the way you like it. ### Change How CIPP Looks to You Click the [Display Mode](/user-documentation/shared-features/menu-bar/display-mode) toggle to switch to your preferred mode to display CIPP. ### Application Settings Let's go check out some of the [Application Settings](/user-documentation/cipp/settings) next. ### Password Styles We can generate two password styles when creating a new user or resetting a password: the classic password, with capitalisation, numbers, and symbols; or the modern passphrase-style password. A passphrase is more readable and often stronger than randomly generated characters. Let's select the "Correct-Battery-Horse" option, which uses passphrases. ### DNS Resolver You can choose the DNS resolver CIPP uses. By default, the resolver is Google. ### Access Checks CIPP can help you figure out why you can't access a tenant by executing an access check. These checks can help you detect issues with GDAP, access rights, or general M365 issues. These checks are done on the [Permissions](/user-documentation/cipp/settings/permissions) tab of CIPP Application Settings. ### Tenants Tab Talking about tenants, let's go check out our internal tenant list. We see all our tenants on the [Tenants](/user-documentation/cipp/settings/tenants) tab of CIPP Application Settings. We can exclude a tenant from CIPP. This means the tenant will not be connected to CIPP, and we will not be able to make any changes to this tenant. This is done from the Actions column for individual tenants or the Bulk Actions button when multiple tenants are checked. ### Notifications Tab Navigate to the [Notifications](/user-documentation/cipp/settings/notifications) tab. CIPP can send many types of notifications, in this screen we can do some of the basic setup of these notifications to filter them or select where they need to go. ## User Administration Let's see how CIPP works in action. We'll navigate to the Identity Management > Administration > [Users](/user-documentation/identity/administration/users) section to start managing users. ## Bulk Actions Most pages in CIPP work by showing you a table layout. The table allows you to filter data, export it, or execute actions. Let's try executing some bulk actions. Setting the checkbox means we are going to take a bulk action on that specific row in our table. You'll find all available actions in the "Bulk Actions" dropdown. Each page has different actions. Let's look at some more of the options we have. Most tables in CIPP have a three-dot action menu as the right-hand visible column. This three-dot menu gives you a dropdown menu with options and information about that specific row. For users, we have a lot of actions we can take. We could reset passwords or even add them to groups. Let's not bother our users and check out some other parts of CIPP for now. ## Tools Navigate to the [Tools](/user-documentation/tools) section. ### Graph Explorer Select Tools > Tenant Tools > [Graph Explorer](/user-documentation/tools/tenant-tools/graph-explorer). CIPP has the option to report on anything inside of the Graph API. even when there is not a direct page created for it. You can use the Graph Explorer option to craft your own report. Let's try using the All User with Email Addresses report. Execute the query by clicking "Apply Filter". The report allows you to check this data as raw as it comes back from the API. you can also create an export using the PDF or CSV buttons. ## Standards Let's go check out the standards next by navigating to Tenant Administration > [Standards & Drift](/user-documentation/tenant/standards). Standards allow you to create a baseline for a tenant. This means you can easily deploy your wanted settings to any tenant. With how important Standards are to the function and power of CIPP, we'll take a deeper dive in [Standards Setup](/setup/implementation-guide/standards-setup), or you can review the full [Standards & Drift](/user-documentation/tenant/standards) documentation. ## Report Builder Let's go check out some reporting. Click on Tools > [Report Builder](/user-documentation/tools/report-builder) next. The Report Builder gives you the ability to zoom in on your tenants and their current state. You can use custom built reports or import catalogue examples to tell your clients what actions they need to take to become more secure. ## Alerts Talking about best practices. You want to be notified when something goes wrong, so let's look at some of the alert options available in Tenant Administration > Administration > [Alert Configuration](/user-documentation/tenant/administration/alert-configuration). The documentation linked above has lots of information on the two types of alerts you can configure in CIPP: * Audit Log Alert: Microsoft Audit Log received alert * Scripted CIPP Alert: Data processed by CIPP on a schedule ## Tenant Administration Let's try managing our tenants next. Click on Tenant Administration > Administration > [Tenants](/user-documentation/tenant/administration/tenants). ### Tenant Overview The tenant overview shows you your tenant names, default domains, and direct links to each of the portals. You can use these links to directly manage that tenant using GDAP. ### Tenant Actions We can also take actions on the tenants. Let's try using the three-dot icon in the Actions column to do so. You'll find some more information about the tenant in this flyout, and you can edit a tenant. This allows you to set a tenant friendly name for CIPP, manage CIPP tenant group memberships, and more! ## Conclusion There are so many more features, but now that you understand the basics you can find more of the features yourself. We hope you enjoyed the walkthrough of the basic settings. You're now ready to deep dive into the platform. # Standards Setup This guide will walk you through the process of setting up standards in CIPP. Follow these instructions to configure and run standards for your organisation. {% hint style="info" %} For more information on Standards, what they are, and where to find the available ones, check out the [Standards & Drift](/user-documentation/tenant/standards) section of the user documentation {% endhint %} ## **Walkthrough Steps for Setting Up Standards** *** ## **Purpose** This guide walks you through setting up **Standards** in CIPP for the first time. It focuses on applying and managing standards to maintain security and compliance across your organisation. ## **Accessing Standards** 1. Navigate to **Tenant Administration > Standards & Drift**. 2. Here you'll be presented with a table of Standards templates and an action in the upper right to create new templates. ## **Reporting Options** Each standard offers three options: * **Report**: Logs the current configuration in a Best Practices Report. * **Alert**: Sends you a notification via the configured method in CIPP -> Application Settings -> Notifications. * **Remediate**: Automatically applies the desired configuration. {% hint style="info" %} Turning off **Remediate** prevents future fixes but doesn’t undo changes already applied {% endhint %} ## **Understanding Impact** * Each standard includes: * A **description** of what it does. * An **impact label** (Low, Medium, High) to indicate user impact. * Review these details to ensure changes align with your needs. ## Customising Standards ### Input Fields * Some standards require settings, like custom text fields or dropdown selections. * Enter the required values to customise the standard. ### Categories * Standards are grouped by categories, like security, compliance, or usability. * There are over 150 standards ([Templates](/user-documentation/tenant/standards/alignment/templates#available-standards)), with more added regularly. ## Deploying Templates * Use templates for consistent configurations across clients. * Examples include templates for **Intune**, **Exchange**, and **Conditional Access** ### **Excluding Tenants** * Exclude specific tenants from **All Tenants** standards to: * Prevent global standards from applying. * Allow custom standards for that tenant only. ### Template Reapplication * Templates reapply every **12 hours**, maintaining the desired state. * If changes are made by admins, they are automatically reverted to match the template. * Update a template once, and all linked tenants will receive the changes. ### **Run Standards Manually** * Use the **Run Template Now** options from the Actions menus. * Apply standards immediately to: * A specific tenant by selecting (Currently Selected Tenant only) to match the tenant in the menu Tenant Selector. * All tenants in one go for all tenants in the template. ## **Key Takeaways** * Standards automatically reapply settings every **12 hours** for consistency. * Categories and templates simplify management across multiple tenants. * Customisation and manual runs give you flexibility to meet tenant-specific needs. By following these steps, you’ll ensure your M365 tenants remain secure, consistent, and compliant with minimal manual effort. # Resources # How CIPP Evaluates Roles How CIPP decides a user's effective permissions when they hold multiple roles CIPP assigns access through **built-in roles** and **custom roles**, and a single user can end up holding several of them at once — especially when roles are mapped to Entra ID groups and a user is a member of more than one group. This page explains, in plain terms, how those roles combine into the permissions a user actually gets. For instructions on *creating* roles and mapping them to Entra groups, see [Adding Users and Managing Roles](/setup/setting-up-cipp/roles). ## The mental model > **Built-in roles are the ceiling. Custom roles are an explicit allow-list.** * A **built-in role** (`readonly`, `editor`, `admin`, `superadmin`) sets the **maximum** a user can ever do. * A **custom role** is an explicit list of allowed permissions, scoped by tenant and endpoint. Paired with a built-in role it **narrows** that ceiling; used on its own it grants **exactly what it defines** — no more, no less. Everything below follows from those two ideas. ## Built-in roles: highest wins Built-in roles rank from least to most privileged: `readonly` → `editor` → `admin` → `superadmin` If a user is a member of several Entra groups that map to **different built-in roles, they do not add together — the single highest role wins.** A user who is both `editor` and `readonly` is simply an `editor`; the `readonly` membership contributes nothing. | Built-in role | Effective access | | ------------- | ----------------------------------------------------------- | | `readonly` | Read/list only. No settings, no admin. | | `editor` | Read **and** write, except system settings and Standards. | | `admin` | Everything except a small set of super-admin-only settings. | | `superadmin` | Everything, including high-privilege settings. | {% hint style="warning" %} **`admin` and `superadmin` ignore custom roles entirely.** If *any* group grants a user `admin` or `superadmin`, they receive the full built-in permission set and every custom role on that user is disregarded. You cannot use a custom role to restrict an admin — assign `editor` or `readonly` instead and filter from there. {% endhint %} ## Custom roles: an explicit allow-list A custom role is a hand-built list of permission categories — each set to `None`, `Read`, or `Read/Write` — optionally scoped to specific tenants (Allowed/Blocked Tenants) and with specific endpoints blocked (Blocked Endpoints). {% hint style="warning" %} **Any permission category you do not explicitly set is a deny.** An unset category is treated exactly as if you had selected `None`: the user is denied that permission. To let a user keep a capability, you must set that category to `Read` or `Read/Write` in the custom role — leaving it blank removes it. {% endhint %} How a custom role behaves depends on whether the user **also** holds a built-in role. ### With a base role (`editor` or `readonly`) The built-in role sets the ceiling and the custom role **narrows it down**: * The user can do only what the base role allows **and** the custom role explicitly grants. * A custom role can never raise a user **above** the ceiling. Granting `Read/Write` to a `readonly` user still results in read-only access, because `readonly` is the ceiling. * Tenant and endpoint scoping from the custom role applies on top. ### Without a base role (custom roles only) If the user has **only** custom roles and no built-in role, the custom roles apply **on their own**: * Their access is exactly what the custom role explicitly grants — nothing more, nothing less. * There is no built-in ceiling, so base-role exclusions (such as system settings or Standards) do **not** apply. A custom role grants precisely what is defined in it, so scope these roles carefully. ### Multiple custom roles on one user If a user holds more than one custom role, their granted permissions are **combined — a union, most permissive wins**. If they also hold a base role, that ceiling still caps the combined result. {% hint style="warning" %} Tenant scope is evaluated **per custom role**, not pooled across them. For any single action, one custom role must grant **both** the required permission **and** access to the target tenant. A user cannot borrow the permission from one custom role and the tenant access from another. {% endhint %} ## Worked examples ### Example 1 — Built-in roles only Jane is a member of two Entra groups: * `CIPP-Editors` → mapped to `editor` * `CIPP-Read` → mapped to `readonly` **Result:** the higher role wins, so Jane is an **editor**. The `readonly` membership changes nothing. ### Example 2 — Built-in role + custom role Mark is a member of two Entra groups: * `CIPP-Editors` → mapped to `editor` * `CIPP-Helpdesk` → mapped to a custom role that grants **Identity: Read/Write** only, with **Allowed Tenants = Contoso** **Result:** `editor` sets the ceiling (read/write everything except settings and Standards). The custom role filters that down to **only Identity read/write**, and only for **Contoso**. Net effect: Mark can manage users in Contoso and nothing else. If Mark were removed from `CIPP-Editors`, the custom role would then apply **on its own** — he would keep exactly the permissions it defines (Identity read/write on Contoso), just with no `editor` ceiling shaping the result. See Example 4. ### Example 3 — Admin plus a restrictive custom role Sara is a member of two Entra groups: * `CIPP-Admins` → mapped to `admin` * `CIPP-Helpdesk` → the restrictive custom role from Example 2 **Result:** `admin` wins outright and the custom role is **ignored**. Sara has full admin access. To actually limit her, remove the `admin` mapping and give her `editor` (or `readonly`) plus the custom role. ### Example 4 — Custom roles only (no base role) Priya is a member of one Entra group: * `CIPP-Reporting` → mapped to a custom role granting **Reports: Read** and **Identity: Read**, Allowed Tenants = `AllTenants` She is **not** in any group that maps to `editor`, `readonly`, `admin`, or `superadmin`. **Result:** with no base role, the custom role applies on its own. Priya gets exactly **Reports read** and **Identity read** across all tenants — and nothing else, because every category she was not granted is a deny. If Priya were also added to a second custom role granting **Endpoint: Read**, her access would be the **union** of the two: Reports read, Identity read, and Endpoint read. ## Quick reference | The user holds…​ | What they get | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------- | | Several built-in roles | The single **highest** role. | | `admin` or `superadmin` (+ anything) | Full built-in access; **custom roles ignored**. | | `editor`/`readonly` + one custom role | Built-in ceiling **filtered down** by the custom role's permissions, tenants, and blocked endpoints. | | `editor`/`readonly` + several custom roles | **Union** of the custom roles' grants, still capped by the built-in ceiling; tenant scope checked per role. | | One custom role, **no** base role | Exactly what that role explicitly grants — no ceiling. Unset categories are denied. | | Several custom roles, **no** base role | **Union** of all the roles' explicit grants; tenant scope checked per role. | {% hint style="info" %} Because `admin`/`superadmin` bypass custom roles, the most common pattern for scoped access is to map a base role (`editor` or `readonly`) to one Entra group and a custom role to another, then add users to **both** — the base role provides a safe ceiling and the custom role tailors it. Custom-roles-only assignments also work, but without a base-role ceiling they grant exactly what is defined, so review them carefully. See [Custom Roles](/setup/setting-up-cipp/roles#custom-roles) for the full setup steps. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Professional Onboarding Services Get up and running with CIPP quickly and confidently—no guesswork, no headaches. ## **Introduction** We get it—GDAP can be confusing, but setting up CIPP doesn’t have to be painful! Let our **CIPP experts** show you the ropes. They’ve seen it all and know the best tips and tricks to help you get up to speed. Stop banging your head against the wall and start benefiting from the time-saving, streamlined features CIPP offers once it’s configured correctly. *** ## **Why Choose Professional Onboarding?** ✅ **Recorded Sessions**: Use the recordings to train your team and replicate processes effortlessly.\ ✅ **Future-Proofing**: Establish scalable systems that grow with your business.\ ✅ **Expert Guidance**: Work with a seasoned CIPP specialist who has hands-on experience.\ ✅ **Save Time**: Avoid trial-and-error setups and get clear, actionable steps. *** ## **What to Expect** For a **one-time fee of $750 USD**, you’ll receive: * A **90-minute live session** with a CIPP expert. * A **recording of your session** for easy reference and team training. ### **Session Objectives** By the end of the session, you’ll: 1. Understand the **step-by-step process** for onboarding clients to CIPP. 2. Learn how to configure **regional settings** and custom domain names. 3. Identify and resolve **common performance issues** related to region selection. 4. Use the **CIPP management portal** for user role assignments and permissions. 5. Implement **best practices** for inviting and managing additional users. 6. Gain familiarity with the Setup **Wizard** and GDAP setup process. 7. Complete a full **GDAP setup for one client** within CIPP. {% hint style="warning" %} **Note**: If you’ve already completed parts of the setup or need a specific focus, discuss this with your CIPP expert **before scheduling**. Unique requirements must be communicated in advance to ensure they’re addressed within the allotted time. {% endhint %} *** ### **Getting Started** 1. **Fill Out the Form**: Share your name, email, company name, and deployment status. 2. **Check Your Email**: Receive onboarding details and the sign-up link. 3. **Complete Payment**: Submit your payment securely to confirm your session. 4. **Relax and Wait**: Your dedicated CIPP expert will contact you to schedule the session. ## **👉 Sign up now at:** [**https://go.cyberdrain.com/onboarding**](https://go.cyberdrain.com/onboarding) {% hint style="info" %} **Note**: Sponsorship is required for onboarding services, whether using a hosted or self-hosted instance of CIPP. Complete the sponsorship process to access full support. {% endhint %} *** ### **What to Prepare** To make the most of your session, have the following ready: #### **1. Administrative Access** * A **Global Administrator account** for your Partner Tenant. * Access to at least **two Customer Global Admin accounts** for GDAP testing. #### **2. CIPP Environment** * Verify access to the **CIPP Management Portal**: [https://management.cipp.app](https://management.cipp.app/). #### **3. Issues and Questions** * Prepare a list of: * Any **errors or challenges** you’ve encountered. * Screenshots of relevant issues (e.g., CIPP access failures, portal errors). #### **4. Notifications and Mailbox Setup** * Have a **mailbox licence** ready for the CIPP Service Account. * This will be converted into a **shared mailbox** during onboarding. *** ### **Session Flow** Here’s what you can expect during your onboarding session: #### **1. Welcome and Review** * Recap your current environment, goals, and any pre-identified issues. #### **2. Step-by-Step Setup** * Guided walkthrough of key configurations, starting with GDAP setup and validation. #### **3. Live Testing** * Test access to customer tenants using CIPP links. * Verify **notifications** and critical configurations. #### **4. Standards and Alerts** * Review and implement: * “AllTenants” Standard configurations. * Scripted alerts and audit log alerts with remediation workflows. #### **5. Q\&A and Wrap-Up** * Address any outstanding questions or unique requirements. * Ensure you’re confident replicating processes for additional tenants. *** ### **After the Session: Next Steps** To build on your onboarding success: 1. **Refine Your Standards**: * Adjust your **“AllTenants” Standard** to align with business needs. 2. **Finalise Notifications**: * Test and confirm email notifications for critical alerts. 3. **Expand GDAP**: * Use the **GDAP Invite Wizard** to onboard additional customers efficiently. 4. **Document and Train**: * Leverage your **session recording** to train team members and reinforce processes. *** ### **Helpful Resources** * [**GDAP Roles: Recommended Setup**](https://docs.cipp.app/setup/installation/recommended-roles) * [**GDAP Invite Wizard Guide**](https://docs.cipp.app/setup/installation/gdap-invite-wizard) * [**CIPP Standards Implementation**](https://docs.cipp.app/setup/implementation-guide/standards-setup) * [**Microsoft GDAP Permissions**](https://learn.microsoft.com/en-us/partner-center/customers/gdap-least-privileged-roles-by-task) *** ### **Sign Up Today** Ready to simplify your CIPP setup and take full advantage of its features? 👉 [**Sign Up for CIPP Onboarding**](https://go.cyberdrain.com/onboarding) If you have questions or need additional assistance before your session, reach out to our team—we’re here to help! # Sponsor Quick Start Welcome to your hosted instance of CIPP! {% hint style="success" %} If you need assistance with or aren't comfortable navigating these requirements alone, take a look at our [Professional Onboarding Services](/setup/resources/professional-onboarding-services) page, which offers a paid option for those who need a bit more hands on guidance with GDAP & CIPP deployment. {% endhint %} If you've started the sponsorship process and are ready to enhance your management of Microsoft 365 tenants with efficiency, this guide is designed to get you started. You can click through the flipbook experience starting with [Prerequisites](/setup/setting-up-cipp/index) or follow below. ## **Initial Sponsorship Actions** 1. **Subscription Activation**: Start by signing up for the $99 subscription using your GitHub account on the [GitHub Sponsorship](https://github.com/sponsors/KelvinTegelaar/sponsorships?tier_id=101398) page. 2. **Welcome Email**: Upon subscription, you will receive an email with detailed instructions to kickstart your deployment. This email will guide you to the [CIPP management portal ](https://management.cipp.app)for deployment steps. ## Deployment & Service Account Creation 3. **Configure CIPP Deployment:** Log in to your [management portal](https://management.cipp.app) using the GitHub credentials you used to initiate the sponsorship. This is where you can kick off your deployment, add custom domain names, and begin inviting users into CIPP. See [Installation](/setup/setting-up-cipp/install) for a walkthrough of this process. NOTE: If you sponsor with an organisation GitHub account, please send in a message to with your personal GitHub username so that we can manually add that user to the portal. You cannot log in to the management portal with organisation accounts. 4. **Service Account Creation**: Follow the instructions carefully on the [Creating the CIPP Service Account](/setup/installation/creating-the-cipp-service-account-gdap-ready) page to ensure there are no permission issues when connecting your tenants within CIPP in the subsequent steps. ## Accessing CIPP & Executing Setup Wizard 5. **Add Yourself to CIPP:** You'll complete the initial setup of Single Sign On and add your first user from the first time setup form when you open up your new instance. Get the URL from the management portal or in the email you receive when installation is complete. Further guidance can be found on the [Setting Up SSO and Getting Access to CIPP](/setup/setting-up-cipp/roles) page. 6. **Execute Setup Wizard:** Follow the instructions on the [Executing the Setup Wizard](/setup/installation/executing-the-setup-wizard) page once logged into your CIPP instance using your newly invited account, **NOT** the service account. The service account is only used during specific configuration steps within the Setup Wizard. ## **Managing Client Relationships** 7. **Onboard Existing Relationships:** If your GDAP relationships with clients are already configured and you do not need to create new invites, proceed to [Recommended First Steps](/setup/implementation-guide/recommended-first-steps) to start managing your clients immediately. 8. **Establish New Relationships:** If you need to establish new GDAP relationships for new clients, use the [Tenant Onboarding](/setup/installation/gdap-invite-wizard) wizard to generate invites and complete the necessary actions to onboard the client to CIPP. {% hint style="info" %} If you are unsure about whether your clients' environments are GDAP ready, or need more information about the process, continue to the [Tenant Onboarding](/setup/installation/gdap-invite-wizard) page for more granular details & next steps. {% endhint %} # Tutorials ### Executing the CIPP Setup Wizard First Time Setup {% @storylane/embed subdomain="app" url="" linkValue="vxdbaztterzq" %} ### What to do after installation? {% @storylane/embed subdomain="app" url="" linkValue="njewz3soejo5" %} ### Using the Intune Catalog {% @storylane/embed subdomain="app" url="" linkValue="939rpjvy23oy" %} ### Setting up an audit log alert {% @storylane/embed subdomain="app" url="" linkValue="6wxwpjesdsrx" %} ### Setting up a CIPP scripted alert {% @storylane/embed subdomain="app" url="" linkValue="9r1i7cklndrq" %} ### Offboarding users {% @storylane/embed subdomain="app" url="" linkValue="3flrrb5hvfn6" %} ### Setting up location-based alerting, without a P1 licence {% @storylane/embed subdomain="app" url="" linkValue="t5z84gfmzoec" %} ### Managing your clients' secure score {% @storylane/embed subdomain="app" url="" linkValue="7qpnbc1ockef" %} ### Adding a GDAP Tenant via the Setup Wizard {% @storylane/embed subdomain="app" url="" linkValue="p6cyd3t8w8ru" %} ### Adding a Direct Tenant via the Setup Wizard {% @storylane/embed subdomain="app" url="" linkValue="kcszcpgdcg6m" %} ### Using Custom Variables to Manage Standards Templates {% @storylane/embed subdomain="app" url="" linkValue="st9ulut6rls4" %} # Showcases ### Report Builder {% @storylane/embed subdomain="app" url="" linkValue="vcrohqu0snfg" %} ### Drift Management {% @storylane/embed subdomain="app" url="" linkValue="cqb21ohc9fgp" %} ### Drift Standard Creation {% @storylane/embed subdomain="app" url="" linkValue="gykd6vk1y7kr" %} ### Custom Tests {% @storylane/embed subdomain="app" url="" linkValue="qevotii3ats1" %} ### AI Powered Help {% @storylane/embed subdomain="app" url="" linkValue="ircpfbol1tpi" %} ### Using variables in templates and more {% @storylane/embed subdomain="app" url="" linkValue="x4vvtxxdhep7" %} ### Alerting {% @storylane/embed subdomain="app" url="" linkValue="qjg1soaldygv" %} ### Audit log searches {% @storylane/embed subdomain="app" url="" linkValue="x3xrv5qfgqpg" %} ### License Management {% @storylane/embed subdomain="app" url="" linkValue="ossqaogex1sw" %} ### Dashboard v2 {% @storylane/embed subdomain="app" url="" linkValue="zt4porabti6d" %} ### Graph Explorer {% @storylane/embed subdomain="app" url="" linkValue="p0ljufhpgkmb" %} ### Vacation Mode {% @storylane/embed subdomain="app" url="" linkValue="d7llhd4j78qv" %} # Shared Features # Menu Bar # Tenant Select The tenant selector sits at the top of CIPP and controls which tenant you are managing. Changing it reloads the data on the current page for the newly selected tenant, and cancels any requests still running for the previous one. ## Selecting a Tenant Tenants are listed as their display name followed by their default domain in brackets. Start typing to narrow the list by either part, then choose a tenant to switch to it. **\*All Tenants** is pinned to the top of the list. Selecting it shows data across every tenant you manage on pages that support it. Some pages behave differently under All Tenants, most notably tables, which always read from cached data in this mode. The tenant you are currently on stays in the list in its usual position, marked with a **Current** chip, and the list scrolls to it when you open the dropdown. The circular arrows button beside the selector reloads the tenant list. Use it when the list looks stale, for example after tenants have been added or removed since you opened CIPP. The selected tenant is reflected in the page address as a `tenantFilter` parameter, so any CIPP page can be linked to with a tenant already chosen. The parameter accepts the tenant's default domain, its initial `onmicrosoft.com` domain, or its tenant ID, and CIPP rewrites the address to the default domain once the page loads. {% hint style="info" %} Your selected tenant is remembered between sessions. If you open CIPP at a page with no tenant in its address, the tenant you last used is applied automatically. {% endhint %} ## Favourites and Recent Tenants The list is grouped, so the tenants you work with most sit at the top rather than buried in an alphabetical list of everything you manage. | Group | Description | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **Favorites** | Tenants you have starred, in the order you starred them. | | **Recent** | The tenants you have selected most recently, newest first, up to eight. A tenant that is already a favourite is not repeated here. | | **All tenants** | Everything else, sorted alphabetically. | Each row carries a star on the right. Select it to add that tenant to **Favorites**, or select it again to remove it. Selecting the star does not change tenant, so you can reorganise the list without leaving the page you are on. Recent tenants are tracked for you: choosing a tenant from the dropdown adds it to the top of the group. **\*All Tenants** is excluded from both groups and cannot be starred, since it is already pinned above them. {% hint style="info" %} Favourites and recent tenants are stored in your browser rather than in your CIPP user settings. They are specific to the browser and device you set them on, they do not follow you to another machine, and clearing your browser's site data removes them. Both lists update immediately in any other CIPP tab you have open. {% endhint %} ## Tenant Information The building icon to the left of the selector opens a flyout with details of the currently selected tenant, available from any page. It is unavailable while All Tenants is selected, and is not shown on narrow screens, where the selector moves into the mobile navigation menu. | Field | Description | | ---------------------------------------- | ------------------------------------------------------------------------------- | | Display Name | The tenant's display name. | | ID | The tenant's directory ID. | | Street | The street recorded on the tenant's address. | | Postal Code | The postal code recorded on the tenant's address. | | Technical Notification Mails | The technical contact addresses Microsoft uses for service notifications. | | On Premises Sync Enabled | Whether directory synchronisation from on-premises Active Directory is enabled. | | On Premises Last Sync Date Time | When the directory last synchronised. | | On Premises Last Password Sync Date Time | When passwords last synchronised. | ## Portal Shortcuts The same flyout lists shortcuts for jumping straight to the tenant's Microsoft portals, each opening with the selected tenant already in context. | Action | Description | | --------------------- | --------------------------------------------------------------------------------------------------- | | Manage Tenant | Opens the tenant's settings within CIPP. See [Edit Tenant](/user-documentation/tenant/manage/edit). | | M365 Admin Portal | Microsoft 365 admin center. | | Exchange Portal | Exchange admin center. | | Entra Portal | Microsoft Entra admin center. | | Teams Portal | Teams admin center. | | Azure Portal | Azure portal. | | Intune Portal | Microsoft Intune admin center. | | SharePoint Portal | SharePoint admin center. | | Security Portal | Microsoft Defender portal. | | Purview Portal | Microsoft Purview portal. | | Power Platform Portal | Power Platform admin center. | | Power BI Portal | Power BI admin portal. | Every portal other than **Manage Tenant** can be hidden from this list using the **Portal Links Configuration** settings described in [User Preferences](/user-documentation/shared-features/menu-bar/user-settings), so you can shorten it to the portals you actually use. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Universal Search Universal search finds records across every tenant you have access to from a single box, without switching tenant first. Search for a user by name and you get matches from all of your tenants at once, each labelled with the tenant it came from. ## Opening Search Two icons in the menu bar open the search dialog, each starting on a different search type. The globe icon opens it ready to search users and entities, and the magnifying glass opens it ready to search CIPP's own pages. Once open, you can switch between any of the search types from the dropdown on the left. | Shortcut | Action | | -------------------- | ---------------------------------------- | | Ctrl/Cmd + K | Opens search on **Pages**. | | Ctrl/Cmd + Shift + F | Opens search on **Users**. | | Ctrl/Cmd + Alt + K | Moves the cursor to the tenant selector. | ## Search Types | Type | What is searched | Selecting a result | | ------------ | --------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | Users | User principal name or display name. | Opens that user in the tenant they belong to. | | Groups | Display name, with the group's mail address and description shown alongside each match. | Opens that group in the tenant it belongs to. | | Applications | App registrations and enterprise applications, by name, application ID, or publisher. | Opens the matching app registration or enterprise application. | | Licences | SKU ID, part number, licence name, or service plan. | Opens a flyout with the full licence details. | | BitLocker | Recovery key ID or device ID, chosen from a second dropdown that appears for this type. | Opens a flyout with the recovery key details. | | Pages | Page names, tab names, paths, and whether a page is tenant-scoped or global. | Navigates to that page. | The licence search returns a description, its service plans, and the tenants holding it, which is useful for identifying a licence when you only have a partial reference such as a SKU part number from elsewhere. {% hint style="info" %} The **Pages** search only returns pages your CIPP permissions allow you to open, so the results differ between users. {% endhint %} ## Running a Search For **Pages** and **Licences**, matches appear as you type, because both are matched against data already held in the browser. For **Users**, **Groups**, **Applications** and **BitLocker**, type your terms and then press Enter or click **Search**. These types query across every tenant, so they run only when you ask rather than on each keystroke. In the results list, matching text is shown in bold, and each result is labelled with the tenant it was found in. Use the up and down arrow keys to move through the list and Enter to open the highlighted result, or click it. Where nothing matches, the list reads **No results found**. {% hint style="info" %} Results for users, groups, applications and licences come from the CIPP reporting database, so they are only as current as the last cache run. A record created moments ago will not appear until the cache next refreshes. Licence searches are matched first against the Microsoft SKU catalogue built into CIPP, and fall back to cached data only when the catalogue has no match. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Display Mode The moon or sun icon in the menu bar switches CIPP between light and dark mode. The icon shows the mode you will switch to, so a moon means clicking will move you to dark mode and a sun means clicking will move you back to light. ## Available Display Modes * Light mode * Dark mode Your choice applies immediately and is remembered on that device. Because it is stored locally rather than with your CIPP account, each browser and device keeps its own setting, so you can run dark mode on one machine and light on another. {% hint style="info" %} On narrow screens the icon is not shown in the menu bar. Use the **Light Mode** or **Dark Mode** entry in the account menu instead, reached from your avatar at the right of the menu bar. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Search {% hint style="info" %} This search is a duplication of [Universal Search](/user-documentation/shared-features/menu-bar/universal-search) but clicking the icon will preselect the Pages option. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Bookmarks Bookmarks give you quick access to the CIPP pages you use most, without navigating the menu each time. They are saved against your CIPP user account rather than your browser, so the same list follows you to any device you sign in from. You can hold up to fifty bookmarks. ## Adding a Bookmark There are two ways to bookmark a page. * Hover over the page's entry in the left-hand menu. A bookmark icon appears at the end of the row, and clicking it adds the page. * Open the page and click the bookmark button at the end of the breadcrumb trail. See breadcrumb-navigation.md. In both places an outlined bookmark means the page is not saved and a solid, coloured bookmark means it is. Clicking again removes it. The bookmark takes its name from the page's menu entry, and is filed under the top-level menu heading it belongs to, which is shown above the name in the list. {% hint style="info" %} Some pages cannot be bookmarked, and show no bookmark icon. Bookmarks store only the page address, so pages that identify a specific record in their address, such as an individual user or group, are excluded because the saved address would reopen an empty page. {% endhint %} Once you reach fifty bookmarks the button is disabled until you remove one, and hovering over it explains why. ## Where Bookmarks Appear Bookmarks are shown in a collapsible **Bookmarks** section in the left-hand menu, and can also be opened from a bookmark button in the top menu bar. The list and its controls behave identically in both places, and the section remembers whether you left it expanded or collapsed. Both locations are controlled by the **Show Sidebar Bookmarks** and **Show Popover Bookmarks** settings described in user-settings.md. The sidebar section is shown by default. With nothing saved, the list reads **No bookmarks added yet**. ## Managing Your Bookmarks Each entry shows the page name with its menu heading above it in smaller text. Clicking the name opens the page. Hovering over an entry reveals its controls at the right-hand end. | Control | Description | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Padlock | Locks or unlocks the list. While locked, the reorder and remove controls are hidden so bookmarks cannot be moved or deleted by accident as you click through the menu. | | Sort | Cycles the display order between **Custom order**, **A > Z** and **Z > A**. The icon reflects the order currently applied. | | Up and down arrows | Move an entry one position up or down. Shown when **Bookmark Reorder Mode** is set to Arrow Buttons. | | Drag handle | Drag an entry to a new position. Shown when **Bookmark Reorder Mode** is set to Drag and Drop, and works with both a mouse and touch. | | Cross | Removes the bookmark from your list. | {% hint style="warning" %} Reordering only takes effect while the list is in **Custom order**. If you try to move an entry while an alphabetical sort is applied, the sort icon flashes instead of the entry moving. Switch back to custom order first. {% endhint %} The list is locked by default. If you attempt to move or remove a bookmark while it is locked, the padlock flashes to show why nothing happened. Your custom order, sort choice and lock state are all remembered between sessions. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # User Preferences The Preferences page holds the interface settings that control how CIPP looks and behaves for you, along with defaults used elsewhere in the application. Most settings on this page can be saved either for your own account or for all users of the instance, chosen from the Actions card before saving. Where a setting is saved for all users, an individual user's own preference takes precedence over it. The page opens on whichever scope currently applies to you: your own settings if you have saved any, and the all-users settings if you have not. ## General Settings | Setting | Description | | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Default usage location for users | The country pre-selected as the usage location when creating a new user. Required. | | Default Page Size | How many rows tables show per page by default, chosen from 25, 50, 100, or 250. Required. | | Default test suite on the Home page | The test suite whose results are shown on the Home page by default, chosen from your saved test reports. | | Added Attributes when creating a new user | Additional user attributes to make available on the new user form. Anything selected here appears as an extra field when creating a user. The available attributes are `consentProvidedForMinor`, `employeeId`, `employeeHireDate`, `employeeLeaveDateTime`, `employeeType`, `faxNumber`, `legalAgeGroupClassification`, `officeLocation`, `otherMails`, `showInAddressList`, and `sponsor`. | | Save last used table filter | When enabled, the filter you last applied to a table is remembered and re-applied the next time you open it. | {% hint style="info" %} **Default Page Size** sets the starting value only. An individual table's own rows-per-page control offers 500 as well, and choosing it there applies for as long as you stay on that page. {% endhint %} ## Navigation Settings | Setting | Description | | ---------------------- | --------------------------------------------------------------------- | | Show Sidebar Bookmarks | Shows your bookmarked pages in the sidebar. | | Show Popover Bookmarks | Shows your bookmarked pages in a popover opened from the menu bar. | | Bookmark Reorder Mode | How bookmarks are reordered: with Arrow Buttons, or by Drag and Drop. | | Compact Navigation | Reduces the size of the navigation menu so more of it fits on screen. | ## Offboarding Default Settings Sets which offboarding options are pre-selected when you offboard a user, so that routine offboardings do not have to be configured each time. These are defaults only and can still be changed for an individual offboarding. A label on the card indicates which defaults are currently in effect: **Using Tenant Defaults**, **Using User Defaults**, **Using All Users Defaults**, or **Using Default Settings** where none have been saved. | Setting | Description | | --------------------------------------------- | ---------------------------------------------------------------------- | | Convert to Shared Mailbox | Converts the user's mailbox to a shared mailbox. | | Remove from all groups | Removes the user from every group they belong to. | | Hide from Global Address List | Hides the user's mailbox from the address list. | | Remove Licenses | Removes all licences assigned to the user. | | Cancel all calendar invites | Cancels the meetings the user has organised. | | Revoke all sessions | Signs the user out of all active sessions. | | Remove users mailbox permissions | Removes the permissions the user holds on other mailboxes. | | Remove users calendar permissions | Removes the permissions the user holds on other calendars. | | Remove all Rules | Removes the inbox rules on the user's mailbox. | | Reset Password | Resets the user's password. | | Keep copy of forwarded mail in source mailbox | Where mail is being forwarded, retains a copy in the original mailbox. | | Delete user | Deletes the user account. | | Remove all Mobile Devices | Removes the user's registered mobile devices. | | Disable Sign in | Blocks the user from signing in. | | Remove all MFA Devices | Removes the user's registered multi-factor authentication methods. | | Remove Teams Phone DID | Removes the phone number assigned to the user in Teams. | | Clear Immutable ID | Clears the user's immutable ID. | | Disable OneDrive Sharing Links | Disables the sharing links the user created in OneDrive. | A **Send results to** section chooses where the outcome of an offboarding is reported, with options for Webhook, E-mail, and PSA. ## Portal Links Configuration Chooses which Microsoft portal shortcuts appear in the tenant information flyout. All are enabled by default; switch off any you do not use to shorten the list. The available portals are M365, Exchange, Entra, Teams, Azure, Intune, SharePoint, Security, Purview, Power Platform, and Power BI. The **Manage Tenant** entry is always shown and cannot be switched off. See [Tenant Select](/user-documentation/shared-features/menu-bar/tenant-select). ## Developer Options Diagnostic options intended for troubleshooting and development. | Option | Description | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | TanStack Query Tools | Enables or disables the query developer tools, used for inspecting how data is fetched and cached. | | Advanced Views | Enables or disables advanced views, which reveal diagnostic pages that are otherwise hidden from day-to-day use, such as audit-log Search Coverage. | {% hint style="info" %} These two take effect the moment you click them, and are not part of what the **Save Changes** button commits. They are stored in the browser you are using, so they apply only to you on this device and cannot be set for all users. {% endhint %} ## CIPP Roles A read-only card lists the CIPP roles held by the account you are signed in as, so you can confirm what your access allows. Roles cannot be changed here. ## Saving Your Preferences The Actions card controls who your changes apply to and commits them. | Control | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User selector | Chooses whether the settings are saved for Current User or for All Users. Selecting a different option reloads the page's values to show the settings that apply to that scope. | | Save Changes | Saves the settings for the selected scope. The button is unavailable while any required field is empty or invalid, and a message confirms the save or reports an error. | *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Table Features Most list pages in CIPP share the same table component, so the toolbar, filtering, sorting and export behaviour described here applies across the application. Individual pages may hide features that do not apply to them, but where a feature is present it works the same way everywhere. ## Live and Cached Data Some tables can display either live data, pulled directly from Microsoft Graph, Exchange or another upstream service, or a cached copy held in CIPP's reporting database and refreshed periodically. The current mode is shown as a chip at the top of the page: | Chip | Meaning | | ---------- | ---------------------------------------------------------------- | | **Live** | Data is being retrieved from the upstream service on every load. | | **Cached** | Data is being read from CIPP's reporting database. | Where the page supports both modes, clicking the chip switches between them. On pages that only ever read from the reporting database the chip is not clickable, and hovering over it explains why. When the table is in cached mode a **Sync** button appears alongside the chip. This queues a background task to refresh the cache for the selected tenant, and the queue tracker will update the table once the sync completes. Cached mode also adds a **Cache Timestamp** column so you can see how old the data is. When AllTenants is selected, a **Tenant** column is added as well. {% hint style="info" %} AllTenants always uses cached data, even on pages that otherwise allow the toggle. The **Sync** button is disabled under AllTenants unless the page explicitly supports syncing every tenant at once. {% endhint %} ## Toolbar The toolbar sits above every table and holds the search box, filtering, column selection and export controls. ### Refresh The circular arrows button reloads the table data. While a request is in progress the icon spins and the button is disabled. If CIPP could not retrieve every page of a large result set the icon changes to a warning symbol, and clicking it retries the outstanding requests. ### Search Typing in the search box filters the table to rows containing the text you enter, matched against all visible columns. The search is applied shortly after you stop typing rather than on every keystroke, so large tables stay responsive. Clearing the box restores the full result set. {% hint style="info" %} For more precise matching, use column filters instead. These support a full range of operators, described under [#column-filtering-options](#column-filtering-options "mention"). {% endhint %} ### Filters The **Filters** button opens a menu of preset filters for the page you are viewing. When any filter is active the button is highlighted and shows a count, for example **Filters (2)**. | Menu entry | Description | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Show Column Filters / Hide Column Filters | Toggles the per-column filter row beneath the column headers. | | Reset all filters | Clears every active filter, the search box and any column selections made by a preset, returning the table to its default state. | | Edit filters | Opens the filter builder so you can construct or amend a query by hand. Only shown on pages backed by Graph Explorer. | | Graph filters | Presets that change the request sent upstream, for example by narrowing the properties returned or applying a server-side query. On Graph Explorer backed pages, any custom presets you have saved appear here alongside the built-in ones. | | Table filters | Presets that filter the rows already loaded into the table. | Graph filters and table filters occupy separate slots, so one of each can be active at the same time and their effects stack. Active presets are marked with a tick, and selecting a preset that is already active clears it. Within the table slot only one preset applies at a time, so choosing a new one replaces the previous selection. If you enable **Save last used table filter** in your user preferences, CIPP remembers the filters you had applied on each page and restores them the next time you visit. ### Columns The **Columns** button controls which columns are visible. | Menu entry | Description | | -------------------------- | --------------------------------------------------------------------------------------- | | Reset to preferred columns | Restores the column selection to the page defaults. | | Save as preferred columns | Saves the current selection so it is applied automatically whenever you open this page. | | Delete preferred columns | Removes your saved selection for this page. | | Column list | Tick or untick individual columns to show or hide them. | Preferred columns are stored per page in your browser's local storage, so they follow the browser and profile you are working in rather than your CIPP account. ### Export The **Export** button offers several ways to take the data out of CIPP. | Menu entry | Description | | ---------------------- | ----------------------------------------------------------------------------------------- | | Export to CSV | Downloads every filtered row, using the currently visible columns. | | Export to PDF | Produces a PDF report of every filtered row, using the currently visible columns. | | Export Selected to CSV | Downloads only the rows you have ticked. Shown when at least one row is selected. | | Export Selected to PDF | Produces a PDF of only the rows you have ticked. Shown when at least one row is selected. | | View API Response | Opens a flyout showing the raw JSON returned by the API call behind the table. | ### Queue Status When a page has queued a long-running background task, a queue status button appears on the right of the toolbar with a badge showing outstanding work. Clicking it opens a panel with the task name, progress and per-item results. When the task finishes, the table refreshes automatically. ### Narrow Screens On smaller viewports, and whenever the toolbar runs out of room, the **Filters**, **Columns** and **Export** buttons collapse into a single menu behind the vertical ellipsis. That menu also offers **Fullscreen**, which expands the table to fill the window, and **Exit Fullscreen** to return. ## Row Selection and Actions Most tables include an **Actions** column pinned to the right of the table. Clicking the ellipsis in a row opens the actions available for that row. Ticking the checkboxes at the left of one or more rows shows a count of the selected rows in the toolbar along with a **Bulk Actions** button, which applies a single action to every row you have selected. Only actions that support bulk operation appear in this menu. Where an action only applies to certain rows, the selection is narrowed automatically to the eligible ones. The selection checkbox column is pinned to the left and the actions column to the right, so both stay visible as you scroll horizontally. The column headers remain fixed as you scroll vertically. ## Column Options Clicking the menu icon in a column header opens the options for that column. | Option | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------- | | Clear sort | Removes any sorting applied to this column. | | Sort by \ ascending | Sorts the column from smallest to largest, 0 to 9, or A to Z. | | Sort by \ descending | Sorts the column from largest to smallest, 9 to 0, or Z to A. | | Clear filter | Clears any filter applied to this column. | | Filter by \ | Reveals the filter row and focuses this column's filter input. | | Pin to left | Freezes the column against the left edge of the table so it stays visible while scrolling horizontally. | | Pin to right | Freezes the column against the right edge of the table. | | Unpin | Returns a pinned column to its normal position in the column order. | | Hide \ column | Removes the column from view without changing your saved preferences. | | Show all columns | Makes every available column visible, including those hidden by default. | {% hint style="info" %} Dates, numbers and true/false values are sorted using rules appropriate to their type rather than as plain text, so dates order chronologically and numbers order by value. Rows with no value in the sorted column are always placed at the end, in both ascending and descending order. {% endhint %} ## Column Filtering Options Each column filter has an operator, chosen from the icon inside the filter input. The operators offered depend on the type of data in the column. | Filter | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Fuzzy | Returns all results where the value is similar to what is input. | | Contains | Returns all results where the value contains the input. | | Starts With | Returns all results where the value starts with the input. | | Ends With | Returns all results where the value ends with the input. | | Equals | Returns all results where the value exactly matches the input. | | Not Equals | Returns all results where the value does not match the input. | | Between | Returns all results where the value falls between the two inputs, excluding the inputs themselves. | | Between Inclusive | Returns all results where the value falls between the two inputs, including the inputs themselves. | | Greater Than | Returns all results where the value is greater than the input. | | Greater Than Or Equal To | Returns all results where the value is greater than or equal to the input. | | Less Than | Returns all results where the value is less than the input. | | Less Than Or Equal To | Returns all results where the value is less than or equal to the input. | | Empty | Returns all results where there is no value for this column. | | Not Empty | Returns all results where there is a value for this column. | | Not Contains | Returns all results where the value does not contain the input. | | Regex | Returns all results matching the regular expression you supply. Matching is case insensitive, and an invalid expression leaves the results unfiltered. | Columns holding true/false values present a drop-down in place of the text input, letting you filter on `Yes` for true and `No` for false. ## Value Display Some values are given a graphical representation for ease of reading. | Value type | Description | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Boolean | Displayed as a tick for `true` and a crossed circle for `false` rather than the words themselves. Exports render these as `Yes` and `No`. | | List of values | Displayed as a row of chips. The first four are shown, followed by a **+N more** link that expands the rest and a **Show less** link to collapse them again. Clicking a chip copies its value to the clipboard. | | Complex data | Displayed as a button showing the number of items it contains. Clicking the button opens a dialog with a second table listing the contents. Where there is nothing to show, the button reads **No items** and is disabled. | | Dates and times | Displayed as a relative time, for example "about 2 months ago". | ## Column Sizing Column widths are calculated when the table loads, based on the length of the column heading and a sample of the values in that column, within fixed minimum and maximum limits. Columns holding chips or item buttons are sized to suit that content rather than the underlying text. You can adjust a width yourself by hovering over the divider between two column headers and dragging it. Manual resizing is not saved and resets the next time the page loads. ## Pagination Tables are paged, with a control at the foot of the table for moving between pages and choosing how many rows are shown at a time. The available page sizes are 25, 50, 100, 250 and 500. The starting value comes from the **Default Page Size** setting in your user preferences. Only the rows and columns currently in view are rendered, which keeps large result sets responsive while scrolling. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Speed Dial The CIPP speed dial gives you quick access to help, feedback, and troubleshooting from anywhere in the application. It sits as a round button in the lower right corner of your browser window, and opens when you hover over it or click it. Clicking anywhere outside closes it again. ## Options | Option | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tutorials | Opens the tutorials list, described under [Tutorials](/demos/tutorials) below. | | Check the Documentation | Opens [docs.cipp.app](https://docs.cipp.app/) in a new tab, at the page matching the CIPP page you are currently on. | | Join the Discord! | Opens a new tab to join the [CyberDrain Discord server](https://discord.gg/cyberdrain). | | Request Feature | Opens a new tab to the GitHub feature request form. | | Report Bug | Opens a new tab to the GitHub bug report form. | | License | Opens CIPP's own licence page, showing the GNU Affero General Public License terms. | | Clear Cache and Reload | Clears CIPP's cached data from your browser and reloads the page. This is especially helpful if you recently updated CIPP and are still seeing an older version. | {% hint style="info" %} Feature requests can only be raised by sponsors at the required sponsorship level. Requests from non-sponsors are closed automatically. The form itself sets out the current requirement. {% endhint %} ## Tutorials The **Tutorials** option opens a list of guided walkthroughs that highlight parts of the interface and step you through them in place. Search the list to narrow it down, then choose a tutorial to start it. Your progress is tracked, with a count of how many tutorials you have completed shown at the foot of the list and completed entries marked. A reset control at the top of the dialog clears that progress so the tutorials can be taken again. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Keyboard Shortcuts CIPP has a small set of global keyboard shortcuts, plus keys that work within particular parts of the interface. ## Global Shortcuts These work from anywhere in CIPP. | Action | Windows | Mac | | ------------------------- | ---------------- | ---------------------- | | Search pages | Ctrl + K | Cmd(⌘) + K | | Search users and entities | Ctrl + Shift + F | Cmd(⌘) + Shift + F | | Highlight tenant selector | Ctrl + Alt + K | Cmd(⌘) + Option(⌥) + K | The first two both open the universal search dialog, and differ only in which search type it starts on. Once open, you can switch to any other type from the dropdown, so either shortcut will get you there. {% hint style="info" %} These shortcuts are active even while your cursor is in a text field, so pressing Ctrl + K while typing opens search rather than doing whatever that field would normally do. {% endhint %} ## Within Search Results | Key | Action | | ------------------ | -------------------------------------------------------------------------- | | Enter | Runs the search. Where a result is highlighted, opens that result instead. | | Up and Down arrows | Moves the highlight through the list of results. | | Escape | Closes the results list without leaving the dialog. | ## Within Breadcrumbs Breadcrumb entries can be reached with the Tab key and opened with either Enter or the space bar, so the trail can be navigated without a mouse. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Get Help Have an error that you're unsure how to handle? Errors in most pages of CIPP will return with a `Get Help` button to the right of the text. Click the button and a new tab will open allowing you to search the documentation for additional information. {% hint style="info" %} Note that not every Microsoft returned error will be included in the docs site. These can also have additional information available with a search of the internet/Microsoft documentation. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Variable Auto Complete Text fields throughout CIPP support variables, which are placeholders replaced with real values when the setting, template, or alert is actually used. Rather than remembering the exact spelling of each one, type `%` in a supporting field and an autocomplete list appears. Continue typing to narrow it down, then pick the variable you want and CIPP inserts it complete with its surrounding `%` characters. This ensures the variable name always matches exactly what CIPP expects. ## The Variable List Each entry shows the variable as it will be inserted, a short description of what it resolves to, and a tag marking it as either **reserved** or **custom**. | Type | Description | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reserved | Built into CIPP. These cover tenant details such as the tenant name, default domain, and tenant ID, along with partner and CIPP instance values. Some fields also offer system variables such as `%username%` and `%programfiles%`, for settings that are ultimately applied on a device. | | Custom | Variables you have defined yourself. Those set for All Tenants are available everywhere, and those set against a specific tenant apply only to that tenant. | Typing after the `%` filters the list on both the variable name and its description, so searching for a term such as "domain" will surface the variables whose descriptions mention it even where the name does not. {% hint style="info" %} The list is drawn for the tenant currently selected, so a custom variable defined for one tenant will not appear while a different tenant is selected. Where a custom variable shares its name with one set for All Tenants, the tenant's own value takes precedence. {% endhint %} ## Hotkey Support Navigating the list is supported by the following hotkeys. | Hotkey | Action | | ------------ | --------------------------------------------------------------- | | Arrow Down | Moves down the list, wrapping to the top from the last entry. | | Arrow Up | Moves up the list, wrapping to the bottom from the first entry. | | Tab or Enter | Accepts the selected variable in the list. | | Escape | Closes the autocomplete list. | You can also click an entry to insert it. {% hint style="info" %} The list closes on its own if what you type after the `%` stops looking like a variable name, for example when you type a space or punctuation. Type `%` again to bring it back. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Release Notes Notification After CIPP is updated, the release notes for the new version open automatically the first time you load the application, so you can see what has changed. You can also open them at any time from **View release notes** in the account menu, reached from your avatar at the right of the menu bar. ## Reading the Notes The dialog opens on the notes for the version you are running. A **Release** dropdown at the top lets you select any earlier release and read its notes instead, and the heading updates to show which release you are viewing. **Expand** widens the dialog to fill more of the screen, which helps with longer release notes. **Shrink** returns it to its normal size. {% hint style="info" %} The list of releases is fetched from GitHub. If it cannot be reached, the dialog says so and still shows the notes for your current version. {% endhint %} ## Dismissing the Notification Four options sit at the foot of the dialog. | Option | Description | | ----------------------------- | ---------------------------------------------------------------------- | | View release notes on GitHub | Opens the selected release on GitHub in a new tab. | | Don't show again | Suppresses the notification permanently, including for future updates. | | Remind me next time | Closes the dialog for now. It opens again the next time you load CIPP. | | Don't show until next release | Suppresses the notification until CIPP is updated to a newer release. | {% hint style="info" %} These choices are stored in the browser you are using, so they apply to that browser only. Opening CIPP elsewhere, or clearing your browser data, brings the notification back. Choosing **Remind me next time** or **Don't show until next release** also clears a previous **Don't show again**, so the notification is easy to reinstate without hunting through browser settings. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Breadcrumb Navigation Breadcrumb navigation appears at the top of CIPP, just beneath the top menu bar, and shows how you reached the page you are on. The bar has three parts: a mode toggle at the far left, the trail itself, and a bookmark button immediately after the last entry in the trail. ## Display Modes The icon at the far left of the breadcrumb bar switches between the two display modes. Hovering over it tells you which mode you will switch to. Your choice is saved to your preferences and applies the next time you sign in. ### Hierarchy Mode Hierarchy mode shows where the current page sits in the menu structure, exactly as if you had drilled down through the left-hand navigation to reach it. On pages with tabs, the tab you are viewing is included as the final entry. Each entry is clickable and takes you to that level. Grouping headers that have no page of their own are shown as plain text rather than links. ### History Mode History mode shows the pages you actually visited on the way to the current one, in the order you visited them. Clicking an earlier entry returns you to that page and discards everything you visited after it, so the trail always reflects a single path rather than a growing list. CIPP keeps the last twenty pages and displays the five most recent. The history is held for the current session only, so refreshing the browser or signing in again starts it over. {% hint style="info" %} Both modes ignore the tenant selection when building the trail, so switching tenants does not add duplicate entries or leave the tenant name embedded in a breadcrumb label. {% endhint %} ## Bookmark Button The bookmark button sits at the end of the breadcrumb trail and adds or removes the current page from your bookmarks. An outlined bookmark means the page is not yet saved, and a solid, coloured bookmark means it is. The bookmark takes its name from the last entry in the breadcrumb trail and is filed under the top-level menu heading that page belongs to, so renaming or restructuring the menu is reflected in new bookmarks automatically. {% hint style="info" %} The button is hidden on pages whose address identifies a specific record, such as an individual user or group, because bookmarks store only the page address and saving one of these would reopen an empty page. {% endhint %} For managing your saved bookmarks, see [Bookmarks](/user-documentation/shared-features/menu-bar/bookmarks). *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Global Page Icon Pages marked with this icon are not specific to any particular tenant. Settings, etc. managed on this page apply globally. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # CIPP Dashboard About the Dashboard which includes versions and quick links Welcome to the CIPP Dashboard. This page gives you both an overview of your client tenants and a way to assess them against security baselines. It is laid out in tabs, with different information on each. What the dashboard shows depends on the tenant selector. Choose a single tenant and you get that tenant's detail. Choose **All Tenants**, which is also where you land before picking a tenant, and the page swaps to an estate-wide view. {% hint style="warning" %} Much of the dashboard is built from data cached in CIPP's reporting database, refreshed by a scheduled job. The first time you load the dashboard for a tenant you may see little or nothing until that job has run. Use **Refresh** to collect the data immediately rather than waiting. {% endhint %} ## Walkthrough {% @storylane/embed subdomain="app" url="" linkValue="zt4porabti6d" %} ## All Tenants View Under All Tenants the dashboard is built entirely from cached data, with no live Graph calls, and is organised into three bands. Almost every figure links through to the page where you can investigate it. ### Portfolio A row of totals for tenants, users, mailboxes, and devices under management, each with the per-tenant average on hover. Selecting a tile opens the matching list page across all tenants. If the cache has never run, a note appears here in place of the figures. ### Security Posture
Secure score The portfolio average, how many tenants it covers, and the movement since the previous measurement, along with the best and worst scoring tenants. **View** opens the [Secure Score](/user-documentation/tenant/administration/securescore) page, which shows a full estate view under All Tenants.
Identity posture How many of your tenants are failing at least one identity check, followed by the checks failing across the most tenants. Counts are of tenants rather than users. **View** opens the [Identity](/user-documentation/dashboard/identity) tab.
Mail hygiene SPF, DKIM, DMARC, and DNSSEC coverage across the domains that have been analysed, shown as coverage meters with the domain count. **View** opens the [Domains Analyser](/user-documentation/tenant/standards/domains-analyser).
Standards alignment The portfolio average alignment score, with tenants grouped into bands of 90% and above, 75 to 89%, 50 to 74%, and below 50%. **View** opens the [Standards & Drift Alignment](/user-documentation/tenant/standards/alignment) page.
### Operations and Triage Four tiles cover what needs attention right now. | Tile | Description | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenants logging errors today | Tenants with Error or Critical log entries today, with the total entry count. Opens the [Logbook](/user-documentation/cipp/logs). | | Delegations expiring within 30 days | GDAP delegations nearing expiry, noting how many of those have no auto-extend. Opens GDAP [Relationships](/user-documentation/tenant/gdap-management/relationships). | | High-risk checks failing | High-risk test failures and how many tenants they span. Opens the [Identity](/user-documentation/dashboard/identity) tab. | | Standards deviations awaiting approval | Deviations pending approval and the number of tenants involved. Opens [Standards & Drift Alignment](/user-documentation/tenant/standards/alignment). | Below the tiles, three cards surface the tenants behind those numbers.
Tenants needing attention Tenants ranked worst first by delegation state and error activity, so the ones in trouble surface without hunting.
Delegation expiry horizon GDAP and CSP relationships grouped by time remaining: expired, 0 to 7 days, 8 to 30 days, 31 to 90 days, and over 90 days.
Cache freshness Counts of tenants that are fresh, stale, or never cached, alongside the tenants that have not synced recently. This catches tenants that quietly stopped collecting data, which would otherwise show as misleadingly clean elsewhere on the dashboard.
The Identity, Devices, and Custom tabs also switch to cross-tenant views under All Tenants. ## Overview Tab With a single tenant selected, the Overview tab opens with a row of controls, then the tenant's detail cards. ### Page Controls
Portals Quick links to the Microsoft portals for the selected tenant. Which portals appear is controlled by the **Portal Links Configuration** settings on the [User Preferences](/user-documentation/shared-features/menu-bar/user-settings) page. {% hint style="warning" %} These links take you out of CIPP, and require your own account, not the CIPP service account, to hold GDAP permissions for the resource. {% endhint %}
Executive Summary Generates a client-friendly summary report from CIPP's data, suitable for presenting to the client. It is fully brandable via [Branding](/user-documentation/cipp/settings/branding), and you can choose which sections to include before generating.
Report Builder Opens the [Report Builder](/user-documentation/tools/report-builder), where you can use the data collected by CIPP's test suites to produce custom client-facing reports.
{% hint style="info" %} On narrower screens **Executive Summary** and **Report Builder** collapse into a single **Dashboard Reports** menu. {% endhint %} ### Test Suite Controls The test suite you select drives the assessment figures on this tab and the contents of the Identity, Devices, and Custom tabs.
Select a test suite Choose which suite to assess the tenant against. Custom suites you have created are listed alongside the built-in ones. The refresh icon beside the box reloads the list of suites, which is useful after creating one. The dashboard opens on your preferred suite, falling back to the instance-wide preference and then to Zero Trust Network Access if neither has been set. To choose your preferred starting suite, set **Default test suite on the Home page** on the [User Preferences](/user-documentation/shared-features/menu-bar/user-settings) page.
Create Suite Build your own suite by selecting from the available Identity, Device, and Custom tests. Give it a name and description, choose the tests, and it becomes selectable alongside the built-in suites.
Refresh Collects fresh data for the tenant. You are asked what to refresh: | Mode | Description | | ------------------------------------------ | ----------------------------------------------------------- | | Cache & Tests (full refresh) | Collects tenant data and then re-runs the tests against it. | | Cache only (collect tenant data) | Refreshes the collected data without re-running tests. | | Tests only (re-run against existing cache) | Re-runs the tests against the data already collected. | A full refresh can take up to two hours. Tests-only is much faster where the cache is already populated. The work runs in the background, so you may need to return to the dashboard once it completes.
Edit Edits the selected custom test suite. Built-in suites cannot be edited, and the button is unavailable when one is selected.
Delete Deletes the selected custom test suite. Built-in suites cannot be deleted, and the button is unavailable when one is selected. Deletion cannot be undone.
### Available Built-In Test Suites * **ACSC Essential Eight**: Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model, eight mitigation strategies for adversary defence covering MFA, restricting administrative privileges, application control, patching applications and operating systems, Microsoft Office macro settings, user application hardening, and regular backups. CIPP tests cover what the Microsoft 365, Entra, Intune, and Defender APIs expose; lower-level enforcement controls that cannot be validated from cloud telemetry are flagged as manual. * **CIS Microsoft 365 Foundations Benchmark v7.0.0**: Center for Internet Security (CIS) Microsoft 365 Foundations Benchmark v7.0.0, a prescriptive technical baseline for securely configuring a Microsoft 365 tenant across the M365 admin centre, Defender, Purview, Intune, Entra, Exchange Online, SharePoint, and Teams. * **CISA ScubaGear Tests for Exchange Online**: Security configuration assessment tests based on CISA's Secure Cloud Business Applications (ScubaGear) project for Microsoft Exchange Online. These tests validate compliance with federal security baselines. * **EIDSCA (Entra ID Security Configuration Analyzer) Tests**: Comprehensive security assessment for Microsoft Entra ID covering authorisation policies, authentication methods, consent policies, password policies, and group settings. Based on Microsoft's EIDSCA framework for identity security best practices. * **Generic Tenant Tests**: Executive-level informational reports covering licensing, MFA posture, secure score trends, and tenant capabilities. These tests provide a clear snapshot of your tenant's current state without pass/fail criteria. * **Microsoft 365 Copilot Readiness Tests**: Assess tenant readiness for Microsoft 365 Copilot deployment. Tests cover prerequisite licensing, Copilot licence assignment, and active M365 app usage that determines which users would benefit most from Copilot. * **ORCA (Office 365 Recommended Configuration Analyzer) Tests**: Comprehensive security assessment for Microsoft Exchange Online and Office 365 security configurations. Tests cover anti-spam, anti-phish, anti-malware, safe links, safe attachments, DKIM, transport rules, and other Exchange Online security settings. * **SMB1001:2026 Cybersecurity Standard**: Dynamic Standards International (DSI) SMB1001:2026, a multi-tiered cybersecurity certification for small and medium-sized businesses, prescribing a five-level pathway across Technology Management, Access Management, Backup and Recovery, Policies/Processes/Plans, and Education and Training. CIPP tests cover the technical controls implementable against a Microsoft 365 tenant (Identity) and via Intune-managed workstations (Devices). * **Zero Trust Network Access Tests**: Microsoft's comprehensive security assessment covering identity and device compliance, conditional access policies, authentication methods, and endpoint protection aligned with Zero Trust principles. ### Dashboard Cards
Tenant The tenant's name, tenant ID, and primary domain. The tenant ID can be copied to the clipboard.
Tenant metrics Counts of Users, Guests, Groups, Service Principals, Devices, and Managed devices. {% hint style="info" %} Each metric is clickable and takes you to the corresponding area of CIPP for a deeper look. {% endhint %}
Assessment How the tenant scored against the selected test suite, broken down by Identity, Devices, and Custom, with an overall figure and a pass, fail, and skip split. The suite's name and description are shown on the card.
Alerts Alerts generated for the tenant, with counts for Active and Snoozed. Switch between the two to filter the list, and use the clock icon on a row to snooze an alert or remove an existing snooze. **Manage** opens the [Alert Configuration](/user-documentation/tenant/administration/alert-configuration) page.
Secure Score The historical trend of the Microsoft Secure Score collected for the tenant.
User authentication A chart of user authentication and MFA or Conditional Access status.
All users auth methods The authentication methods in use across the tenant's users. Clicking a category jumps to the MFA report with filtering applied, so you can see exactly which users are on that method and who needs moving to something stronger.
License Overview The licences present on the tenant, with assigned and available counts. {% hint style="info" %} To exclude a licence from this and all other reports in CIPP, add the licence in licenses.md. {% endhint %}
## Other Tabs The [Identity](/user-documentation/dashboard/identity), [Devices](/user-documentation/dashboard/devices), and [Custom](/user-documentation/dashboard/custom) tabs show the results of the test suite selected on this tab, including remediation guidance for failed tests. Each has its own page in this documentation. **Previous Dashboard Experience** returns you to the [Previous Dashboard Experience](/user-documentation/dashboard/dashboard). *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Identity This tab shows how the tenant performed against the identity checks in the selected test suite, and gives you the detail and remediation guidance for each one. The suite is chosen from the controls at the top of the tab, which behave exactly as they do on the Overview tab. Changing the suite here changes it across the whole dashboard. A description of the selected suite is shown above the table. ## Table Details | Column | Description | | ------ | -------------------------------------------------------------------------------------------------- | | Name | The name of the check that was run. | | Risk | How much risk this setting presents to the client if misconfigured, shown as High, Medium, or Low. | | Status | The outcome of the check: Passed, Failed, Investigate, or Skipped. | Additional columns can be shown from the **Columns** menu. See [Table Features](/user-documentation/shared-features/table-features). ## Filters Preset filters are available from the **Filters** button for each status and each risk level. | Filter | Description | | ----------- | ------------------------------------------------------------------------------------------------------ | | Passed | Checks the tenant satisfied. | | Failed | Checks the tenant did not satisfy. | | Investigate | Checks that could not be resolved to a pass or fail and need a human decision. | | Skipped | Checks that did not run, usually because the tenant lacks the licence or feature the check applies to. | | High Risk | Checks carrying a high risk rating, whatever their status. | | Medium Risk | Checks carrying a medium risk rating. | | Low Risk | Checks carrying a low risk rating. | A status filter and a risk filter cannot both be active at once, since both act on the table's columns. To combine them, apply one preset and then filter the other column manually. ## Test Detail Clicking anywhere on a row opens the Extended Info flyout with the full detail for that check. The up and down arrows at the top of the flyout move through the tests without closing it, and the cross closes it. ### Summary Four indicators run across the top of the flyout. | Indicator | Description | | ------------------ | --------------------------------------------------------------------------------------------- | | Risk | How much risk this setting presents to the client if misconfigured. | | User Impact | How much the recommended remediation will affect end users once applied. | | Effort | How much work the remediation is expected to take. | | Standard Available | Whether a CIPP standard exists that satisfies this check, with a count of matching standards. | ### CIPP Standards That Satisfy This Test Where CIPP standards exist that would remediate or enforce the check, they are listed here by name. This section is only shown when there is at least one match, and is the fastest route from a failed check to the standard that fixes it. ### Test Outcome The check's name and its status, followed by the detail of what was found in the tenant. For most checks this is a formatted explanation of the result, often including tables of the specific objects that passed or failed. ### What Did We Check The category the check belongs to, followed by a description of what the check looks for and why it matters. Where the check maps to vendor guidance, links to that documentation appear here. ## All Tenants View With the tenant selector on **All Tenants**, this tab shows identity results across every tenant instead. Four tiles summarise the estate. | Tile | Description | | ----------------------- | -------------------------------------------------------------------------------------------------- | | Tenants failing a check | How many tenants have at least one failing identity check, out of those with results. | | Failed checks | The total number of failed checks, with the total result count across the estate. | | High-risk failures | Failed checks carrying a high risk rating. | | Pass rate | Passed checks as a percentage of passed plus failed. Investigate and skipped results are excluded. | Below the tiles, a table lists the individual results. | Column | Description | | ----------- | ------------------------------------ | | Tenant Name | The tenant the result belongs to. | | Name | The name of the check that was run. | | Suite | The test suite the check comes from. | | Status | The outcome of the check. | | Risk | The risk rating of the check. | | Category | The category the check belongs to. | | Last Run | When the check last ran. | {% hint style="info" %} By default this table shows only Failed and Investigate results, and the heading reflects that. Use **Show all results** to include passed and skipped checks as well, which also adds Passed and Skipped to the available filters. The tiles are calculated across every status either way, so the figures do not change when you toggle the view. {% endhint %} Clicking a row opens the same detail flyout as the per-tenant view. The full detail for that one result is fetched when you open it, so there may be a brief pause before it appears. ### Table Actions
ActionDescriptionBulk Action Available
View tenant dashboardOpens this tab for the tenant the selected result belongs to.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Devices This tab shows how the tenant performed against the device checks in the selected test suite, and gives you the detail and remediation guidance for each one. The suite is chosen from the controls at the top of the tab, which behave exactly as they do on the Overview tab. Changing the suite here changes it across the whole dashboard. A description of the selected suite is shown above the table. {% hint style="info" %} Device checks are assessed against the tenant's Intune configuration, so a suite's device results depend on the tenant having devices enrolled and managed. Suites that cover only identity controls will show no results here. {% endhint %} ## Table Details | Column | Description | | ------ | -------------------------------------------------------------------------------------------------- | | Name | The name of the check that was run. | | Risk | How much risk this setting presents to the client if misconfigured, shown as High, Medium, or Low. | | Status | The outcome of the check: Passed, Failed, Investigate, or Skipped. | Additional columns can be shown from the **Columns** menu. See [Table Features](/user-documentation/shared-features/table-features). ## Filters Preset filters are available from the **Filters** button for each status and each risk level. | Filter | Description | | ----------- | ------------------------------------------------------------------------------------------------------ | | Passed | Checks the tenant satisfied. | | Failed | Checks the tenant did not satisfy. | | Investigate | Checks that could not be resolved to a pass or fail and need a human decision. | | Skipped | Checks that did not run, usually because the tenant lacks the licence or feature the check applies to. | | High Risk | Checks carrying a high risk rating, whatever their status. | | Medium Risk | Checks carrying a medium risk rating. | | Low Risk | Checks carrying a low risk rating. | A status filter and a risk filter cannot both be active at once, since both act on the table's columns. To combine them, apply one preset and then filter the other column manually. ## Test Detail Clicking anywhere on a row opens the Extended Info flyout with the full detail for that check. The up and down arrows at the top of the flyout move through the tests without closing it, and the cross closes it. ### Summary Four indicators run across the top of the flyout. | Indicator | Description | | ------------------ | --------------------------------------------------------------------------------------------- | | Risk | How much risk this setting presents to the client if misconfigured. | | User Impact | How much the recommended remediation will affect end users once applied. | | Effort | How much work the remediation is expected to take. | | Standard Available | Whether a CIPP standard exists that satisfies this check, with a count of matching standards. | ### CIPP Standards That Satisfy This Test Where CIPP standards exist that would remediate or enforce the check, they are listed here by name. This section is only shown when there is at least one match, and is the fastest route from a failed check to the standard that fixes it. ### Test Outcome The check's name and its status, followed by the detail of what was found in the tenant. For most checks this is a formatted explanation of the result, often including tables of the specific devices or policies that passed or failed. ### What Did We Check The category the check belongs to, followed by a description of what the check looks for and why it matters. Where the check maps to vendor guidance, links to that documentation appear here. ## All Tenants View With the tenant selector on **All Tenants**, this tab shows device results across every tenant instead. Four tiles summarise the estate. | Tile | Description | | ----------------------- | -------------------------------------------------------------------------------------------------- | | Tenants failing a check | How many tenants have at least one failing device check, out of those with results. | | Failed checks | The total number of failed checks, with the total result count across the estate. | | High-risk failures | Failed checks carrying a high risk rating. | | Pass rate | Passed checks as a percentage of passed plus failed. Investigate and skipped results are excluded. | Below the tiles, a table lists the individual results. | Column | Description | | ----------- | ------------------------------------ | | Tenant Name | The tenant the result belongs to. | | Name | The name of the check that was run. | | Suite | The test suite the check comes from. | | Status | The outcome of the check. | | Risk | The risk rating of the check. | | Category | The category the check belongs to. | | Last Run | When the check last ran. | {% hint style="info" %} By default this table shows only Failed and Investigate results, and the heading reflects that. Use **Show all results** to include passed and skipped checks as well, which also adds Passed and Skipped to the available filters. The tiles are calculated across every status either way, so the figures do not change when you toggle the view. {% endhint %} Clicking a row opens the same detail flyout as the per-tenant view. The full detail for that one result is fetched when you open it, so there may be a brief pause before it appears. ### Table Actions
ActionDescriptionBulk Action Available
View tenant dashboardOpens this tab for the tenant the selected result belongs to.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Custom This tab shows the results of the custom tests in the selected test suite, and gives you the detail for each one. Custom tests are ones you have written yourself rather than checks CIPP ships. They only appear here if the selected suite includes them, so a built-in suite will normally show nothing on this tab. To write custom tests or add them to a suite, see [Custom Tests](/user-documentation/tools/custom-tests). The suite is chosen from the controls at the top of the tab, which behave exactly as they do on the Overview tab. Changing the suite here changes it across the whole dashboard. A description of the selected suite is shown above the table. ## Table Details | Column | Description | | -------- | -------------------------------------------------------------------------------------------------- | | Name | The name of the check that was run. | | Category | The category assigned to the check when it was written. | | Risk | How much risk this setting presents to the client if misconfigured, shown as High, Medium, or Low. | | Status | The outcome of the check: Passed, Failed, Investigate, or Skipped. | Additional columns can be shown from the **Columns** menu. See [Table Features](/user-documentation/shared-features/table-features). ## Filters Preset filters are available from the **Filters** button for each status and each risk level. | Filter | Description | | ----------- | ------------------------------------------------------------------------------ | | Passed | Checks the tenant satisfied. | | Failed | Checks the tenant did not satisfy. | | Investigate | Checks that could not be resolved to a pass or fail and need a human decision. | | Skipped | Checks that did not run. | | High Risk | Checks carrying a high risk rating, whatever their status. | | Medium Risk | Checks carrying a medium risk rating. | | Low Risk | Checks carrying a low risk rating. | A status filter and a risk filter cannot both be active at once, since both act on the table's columns. To combine them, apply one preset and then filter the other column manually. ## Test Detail Clicking anywhere on a row opens the Extended Info flyout with the full detail for that check. The up and down arrows at the top of the flyout move through the tests without closing it, and the cross closes it. ### Summary Four indicators run across the top of the flyout. | Indicator | Description | | ------------------ | --------------------------------------------------------------------------------------------- | | Risk | How much risk this setting presents to the client if misconfigured. | | User Impact | How much the recommended remediation will affect end users once applied. | | Effort | How much work the remediation is expected to take. | | Standard Available | Whether a CIPP standard exists that satisfies this check, with a count of matching standards. | ### Test Outcome The check's name and its status, followed by whatever the test returned. How this is presented depends on how the test was written. | Test output | How it is shown | | --------------------------------- | -------------------------------------------------------------------------------------------- | | A markdown result | Rendered as formatted text, including any tables, lists, and links the test produced. | | Raw data with a markdown template | The template is filled in with values from the returned data and rendered as formatted text. | | Raw data returning JSON | Shown as a formatted, syntax-highlighted JSON code block. | {% hint style="info" %} If a custom test returns nothing usable, this section does not appear at all. Where a test is producing no output, check the script's return value and its markdown template. {% endhint %} ### What Did We Check The category assigned to the check, followed by the description recorded against it. Because both come from the test definition rather than from CIPP, how useful this section is depends on how the test was written. A description written in markdown is rendered as formatted text, and any links it contains open in a new tab. ## All Tenants View With the tenant selector on **All Tenants**, this tab shows custom test results across every tenant instead. Four tiles summarise the estate. | Tile | Description | | ----------------------- | -------------------------------------------------------------------------------------------------- | | Tenants failing a check | How many tenants have at least one failing custom check, out of those with results. | | Failed checks | The total number of failed checks, with the total result count across the estate. | | High-risk failures | Failed checks carrying a high risk rating. | | Pass rate | Passed checks as a percentage of passed plus failed. Investigate and skipped results are excluded. | Below the tiles, a table lists the individual results. | Column | Description | | ----------- | ------------------------------------ | | Tenant Name | The tenant the result belongs to. | | Name | The name of the check that was run. | | Suite | The test suite the check comes from. | | Status | The outcome of the check. | | Risk | The risk rating of the check. | | Category | The category the check belongs to. | | Last Run | When the check last ran. | {% hint style="info" %} By default this table shows only Failed and Investigate results, and the heading reflects that. Use **Show all results** to include passed and skipped checks as well, which also adds Passed and Skipped to the available filters. The tiles are calculated across every status either way, so the figures do not change when you toggle the view. {% endhint %} Clicking a row opens the same detail flyout as the per-tenant view. The full detail for that one result is fetched when you open it, so there may be a brief pause before it appears. ### Table Actions
ActionDescriptionBulk Action Available
View tenant dashboardOpens this tab for the tenant the selected result belongs to.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Previous Dashboard Experience About the Dashboard which includes versions and quick links This is the previous version of the CIPP dashboard, kept available while the current dashboard settles. It gives a single-page overview of the selected tenant, without the tabbed assessment views of the current dashboard. {% hint style="warning" %} This dashboard is retained for continuity and will be removed in a future release. New functionality is only being added to the current dashboard. {% endhint %} {% hint style="info" %} Unlike the current dashboard, this page does not support **All Tenants**. Select a specific tenant to see anything here. {% endhint %} ## Page Controls A bar across the top of the page holds three controls.
Portals Quick links to the Microsoft administration centers for the selected tenant. Which portals appear is controlled by the **Portal Links Configuration** settings on the [User Preferences](/user-documentation/shared-features/menu-bar/user-settings) page.
Executive Report Creates a report of key metrics to guide conversations with your client about their Microsoft tenant's security and setup. Before downloading, you can review the report's sections and switch individual ones on or off until the output is what you want. Reports can be custom branded via [Branding](/user-documentation/cipp/settings/branding).
Search Searches for users across any tenant by user principal name or display name. {% hint style="warning" %} This search depends on Microsoft 365 Lighthouse and only returns results if Lighthouse has been onboarded on your partner tenant. The current dashboard's search does not have this dependency, so if this returns nothing, use universal-search.md instead. {% endhint %}
## Current Tenant A bar beneath the controls shows the essentials for the selected tenant. The tenant ID and default domain can each be copied to the clipboard. | Field | Description | | --------------- | ------------------------------------------------------------------------------- | | Tenant Name | The tenant's display name. | | Tenant ID | The tenant's directory ID. | | Default Domain | The domain marked as default on the tenant. | | AD Sync Enabled | Whether directory synchronisation from on-premises Active Directory is enabled. | ## Charts Three charts sit below the tenant bar.
User Statistics A pie chart breaking the tenant's users into Licensed Users, Unlicensed Users, Guests, and Global Admins, with the total user count in the centre. {% hint style="info" %} The chart labels are clickable and filter the chart, so you can isolate a segment to read it more easily. {% endhint %}
Drift Monitoring Where drift data exists for the tenant, a doughnut chart splitting its standards into Aligned Policies, Accepted Deviations, Current Deviations, and Customer Specific Deviations. Where the tenant has no drift data, this card changes to **Standards Set** instead, showing a bar chart of the standards templates configured across the instance by action: Remediation, Alert, and Report.
SharePoint Quota A doughnut chart of the tenant's SharePoint storage, split into free and used, with the actual sizes shown in the labels.
## Detail Cards Three cards complete the page.
Domain Names The verified domains on the tenant. The first three are shown, with **See more...** revealing the rest and **See less** collapsing them again. Each domain can be copied to the clipboard.
Partner Relationships The cross-tenant access partners configured on the tenant, each shown as a display name and default domain. As with domains, the first three are shown, with **See more...** revealing the rest.
Tenant Capabilities The enabled services on the tenant, drawn from its assigned plans. Only Exchange, AAD Premium, and Windows Defender are reported here.
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Identity Management # Administration # Users Interact with Microsoft 365 users. The Users page lists the users in the selected tenant and is the starting point for day to day account management. It covers the same ground as [Microsoft 365 admin center > Active Users](https://admin.microsoft.com/Adminportal/Home#/users), and extends it with actions that would otherwise need the Microsoft Entra admin center, Exchange Online PowerShell or the SharePoint admin center. ## Action Buttons
Add User Creates a single user in the selected tenant. **Create User** submits the form, and once a user has been created the button changes to **Create Another User** so the drawer can be reused. **Starting point** | Field | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Copy properties from another user | Pre-fills the form from an existing user's name, job, address and contact details. Licences and group memberships are not copied by this selector. | | User Template (optional) | Applies a saved user template, filling in the properties, licences, groups and shared access it defines. Templates are managed on the [User Defaults](/user-documentation/tenant/manage/user-defaults) page. | **Identity** | Field | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | First Name | The user's given name. | | Last Name | The user's surname. | | Display Name | The name shown throughout Microsoft 365. Built from the first and last name until it is edited manually. | | Username | The part before the @ symbol. Limited to 64 characters, and may contain letters, numbers and the characters `'` `.` `-` `_` `!` `#` `^` `~`. | | Primary Domain name | The domain used after the @ symbol, chosen from the tenant's verified domains. | | Add Aliases | Additional addresses, one per line, entered without the domain. | **Settings** | Setting | Description | | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Create password manually | When off, CIPP generates a password and returns it in the result. When on, a **Password** field appears for a password of your own. | | Require password change at next logon | Forces the user to set a new password the first time they sign in. | | Usage Location | The country the account is licensed in. Required before licences can be assigned, and defaults to the usage location set in your preferences. | | Licenses | The licences to assign. Each option shows how many units are currently available. | | Remove all licenses | Strips every licence from the account, which is mainly useful when a template or a copied user has brought licences in that are not wanted. | {% hint style="info" %} When the sherweb.md integration is enabled and a selected licence shows `(0 available)`, a **Purchase new licence?** switch appears along with a **Sherweb License** selector. Choosing this purchases a new licence under your terms with Sherweb and assigns it to the user once it becomes available. {% endhint %} **Contact and organisation** | Field | Description | | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Job Title, Department, Company Name | Organisational details written to the directory and shown in the address list. | | Street, City, State/Province, Postal Code, Country | The user's postal address. | | Mobile #, Business # | Contact numbers. | | Alternate Email Addresses | Secondary addresses, separated by commas. | | Set Manager | The user recorded as this account's manager. | | Set Sponsor | The user recorded as this account's sponsor. Only shown when `sponsor` has been added to the attribute list in your preferences. | | Copy groups from user | Adds the new account to the same groups as the chosen user. | | Add to Groups | Adds the new account to specific groups chosen from the tenant. | {% hint style="info" %} Extra directory attributes can be added to this form under [User Preferences](/user-documentation/shared-features/menu-bar/user-settings). The list offers `consentProvidedForMinor`, `employeeId`, `employeeHireDate`, `employeeLeaveDateTime`, `employeeType`, `faxNumber`, `legalAgeGroupClassification`, `officeLocation`, `otherMails`, `showInAddressList` and `sponsor`, and each selection adds its own field to the form. Every attribute except `sponsor` appears as a plain text field; `sponsor` appears as the **Set Sponsor** user selector. {% endhint %} **Shared mailboxes and calendars** | Field | Description | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Shared Mailboxes | The shared mailboxes the new user should be given access to. Only shared mailboxes in the tenant can be selected. | | Shared Mailbox Permissions | Any combination of `Full Access`, `Send As` and `Send on Behalf`. Defaults to `Full Access`, which also automaps the mailbox so Outlook adds it on its own. | | Shared Calendars | The shared mailboxes whose calendar the user should be given access to. | | Shared Calendar Permission | The access level granted on those calendars: `Editor`, `Reviewer`, `Limited Details` or `Availability Only`. Defaults to `Editor`. | {% hint style="info" %} Exchange cannot add a calendar to someone's Outlook directly, so CIPP grants calendar access with a sharing invitation, which the user accepts by clicking the link in the email they receive. Mailbox access needs no invitation: with Full Access, automapping adds the mailbox to Outlook by itself. Only the permission levels listed above are offered for calendars, as those are the ones Exchange sends an invitation for. A newly created user is not a usable Exchange recipient for the first few minutes, so both grants are queued as scheduled tasks that run 15 minutes after creation. Their progress, and any failure, can be followed on the [Scheduler](/user-documentation/tools/scheduler)page. {% endhint %} **Scheduling and notifications** | Setting | Description | | -------------------------------------- | -------------------------------------------------------------------------------------------------- | | Schedule user creation | Defers creation to a chosen date instead of running it immediately. | | Scheduled creation Date | The date the creation task should run. | | Send results to Webhook / E-mail / PSA | Delivers the outcome of the scheduled task to the notification channels configured for the tenant. | | Reference | Free text added to the notification title so the task can be recognised later. |
Bulk Add Users Creates several users at once from a CSV file or from rows entered by hand. Set the **Usage Location** and any licences under **Assign License** first, as these apply to every user in the batch. **Download Example CSV** produces a file with the expected column headers: `givenName`, `surName`, `displayName`, `mailNickName`, `domain`, `JobTitle`, `streetAddress`, `PostalCode`, `City`, `State`, `Department`, `MobilePhone` and `businessPhones`, plus any extra attributes added in your preferences. Upload the completed file, or use **Add User Manually** to add rows individually. Every row appears in the **User Preview** table, where it can be checked and removed before submitting. **Create Users** submits the batch.
Invite Guest Invites a single external user as a guest in the tenant. | Field | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name the guest appears under in the directory. | | E-mail Address | The address the invitation is sent to and the account is based on. | | Redirect URL | Where the guest lands after redeeming the invitation. Defaults to `https://myapps.microsoft.com` when left blank. | | Custom invite message | Optional text included in the invitation email. | | Send invite via e-mail | Controls whether Microsoft sends the standard guest invitation email. When off, the guest account is created but no email goes out. |
Bulk Invite Guests Invites several guests at once. **Send invite via e-mail** and **Custom invite message** apply to the whole batch. **Download Example CSV** produces a file with the columns `displayName`, `mail` and `redirectUri`. Upload the completed file, or use **Add Guest Manually** to add rows individually. Rows appear in the **Guest Preview** table for checking before the invitations are sent.
View Logs Opens a flyout showing the CIPP log entries recorded for user actions in this tenant. Entries written by scheduled tasks are excluded, so this shows the actions taken from the interface.
## Filters The **Filters** menu offers presets that narrow the rows already loaded into the table. See table-features.md for how filters behave generally. | Filter | Shows | | ---------------- | ------------------------------------------------ | | Account Enabled | Accounts that are able to sign in. | | Account Disabled | Accounts that have been blocked from signing in. | | Guest Accounts | Accounts with a user type of Guest. | ## Table Details The properties returned are for the Graph resource type `user`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties). ## Table Actions
ActionDescriptionBulk Action Available
View UserOpens the /pages/C7PqnSgE3Acg6S8snUiC page for the selected user.false
Edit UserOpens the /pages/jbP9ceYqEM10TNf6aetj page, where properties, licences and group memberships can be changed.false
Create Template from UserCreates a reusable user template from this account, copying its job title, department, location, licences and group memberships. Prompts for a template name and whether the template becomes the default for the tenant.true
Research Compromised AccountOpens the /pages/EGPbyWqFtAVEtdgnFb5i view, which gathers the common indicators of compromise for the account in one place.false
Create Temporary Access PassIssues a time limited passcode the user can sign in with, typically to enrol a passwordless method. The lifetime is validated against the tenant's policy, one-time use can be requested, and the pass can be set to become valid at a future date and time.true
Re-require MFA registrationClears the user's registered multi-factor methods so they must register again.true
Send MFA PushSends an approval request to the user's registered devices, which is useful for confirming their setup works.true
Set Per-User MFASets the legacy per-user MFA state to Enforced, Enabled or Disabled, independently of any Conditional Access policy.true
Convert MailboxConverts the mailbox to a User, Shared, Room or Equipment mailbox, keeping its existing content.true
Enable Online ArchiveTurns on the archive mailbox so older mail can be moved out of the primary mailbox.true
Set Out of OfficeSets automatic replies to Enabled, Disabled or Scheduled, with separate internal and external messages. When scheduled, the period can also block the user's calendar, decline new invitations, and decline and cancel meetings already booked.true
Add to GroupAdds the user to one or more groups in the tenant.true
Manage LicensesAdds, removes or replaces licences on the account, with the option to remove or replace everything currently assigned.true
Disable Email ForwardingClears any forwarding set on the mailbox, both internal and external.true
Pre-provision OneDriveCreates the user's OneDrive ahead of their first sign-in, so it is ready when they need it.true
Set OneDrive External SharingSets how far the user's OneDrive can be shared outside the organisation: no external sharing, signed-in guests only, anyone links, or existing guests only.true
Add OneDrive ShortcutAdds a shortcut to a chosen SharePoint site into the user's OneDrive.true
Set Sign In StateBlocks or restores the account's ability to sign in. The current state is pre-selected, and submitting an unchanged state is rejected.true
Reset PasswordSets a new random password and returns it in the result, optionally requiring a change at the next sign-in.true
Set Password ExpirationEnables or disables password expiry for the account. With expiry enabled, a password older than the organisation's expiry period prompts the user to change it at their next sign-in.true
Clear Immutable IDClears the on-premises anchor so the account can be matched to a different directory object. Only offered for accounts that are no longer synchronised but still hold an immutable ID. Greyed out for accounts that are still synchronised, and for those with no immutable ID to clear.true
Set Source of AuthoritySwitches the account between Cloud Managed and On-Premises Managed. Only offered for accounts that are, or once were, synchronised, and a move back to on-premises takes until the next sync cycle to appear. Greyed out for cloud-native accounts that have never been synchronised.true
Reprocess License AssignmentsAsks Entra to re-evaluate the group-based licences that apply to the user, adding or removing licences as the group membership dictates.true
Revoke all user sessionsInvalidates the account's refresh tokens so every device has to sign in again.true
Delete UserDeletes the account. Deleted accounts remain recoverable from Deleted Items for 30 days.true
Edit PropertiesOpens the patch-wizard.md with the selected users loaded, for changing the same properties across all of them.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="info" %} Most of these actions present a confirmation dialog before anything is sent, and any options the action needs are set in that dialog. Actions you do not have permission for stay in the menu but are greyed out. Convert Mailbox, Enable Online Archive, Set Out of Office and Disable Email Forwarding need Exchange mailbox write access, Add to Group needs group write access, and most of the rest need user write access. Send MFA Push, Research Compromised Account and Set Source of Authority carry no permission condition of their own. {% endhint %} {% hint style="warning" %} Temporary Access Pass must be enabled in the tenant's authentication method policy before a pass can be created, otherwise the action fails. CIPP checks the policy when the dialog opens and warns you if it is not enabled. See [Configure Temporary Access Pass to register passwordless authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass) for the tenant side of the configuration. {% endhint %} ## Add User Query String Support The Add User page at `/identity/administration/users/add` can be pre-filled from the URL, which makes it possible to launch user creation from a PSA or documentation system with the details already populated. The page is reached by URL only, as user creation from the Users page now opens the Add User drawer instead. Any query string parameter matching a form field name is applied to the form, for example: {% code overflow="wrap" %} ``` https://yourcipp.app/identity/administration/users/add?tenantFilter=contoso.onmicrosoft.com&city=Rotterdam ``` {% endcode %} | Query string | Field | | ------------------ | ------------------------------------------------------------------------------------------------------------ | | tenantFilter | Selects the tenant. Accepts the default domain name, the tenant ID or the initial `.onmicrosoft.com` domain. | | givenName | First Name | | surname | Last Name | | displayName | Display Name | | username | Username, the part before the @ symbol | | primDomain | Primary Domain name | | addedAliases | Aliases, one per line, separated by `%0A` | | jobTitle | Job Title | | department | Department | | companyName | Company Name | | streetAddress | Street | | city | City | | state | State/Province | | postalCode | Postal Code | | country | Country | | mobilePhone | Mobile # | | businessPhones\[0] | Business #, encoded as `businessPhones%5B0%5D` | | otherMails | Alternate Email Addresses | | usageLocation | Usage Location, as a two-letter country code | | MustChangePass | Require password change at next logon | {% hint style="info" %} Values are applied to the matching form fields when the page loads, so check the fields backed by a dropdown, such as Primary Domain name and Usage Location, before submitting. {% endhint %} ### AutoTask LiveLink The query string below can be used as the basis of an AutoTask LiveLink, substituting the AutoTask variables for your own. {% code overflow="wrap" %} ``` ?tenantFilter=&primDomain=&usageLocation=NL&city=&country=&streetAddress=&companyName=&businessPhones%5B0%5D=&postalCode=&givenName=&surname= ``` {% endcode %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # View Individual User This page brings together everything CIPP knows about a single user, and is where most investigation starts before an action is taken. The header shows the user's display name along with their user principal name, object ID and creation date, each of which can be copied, and a **View in Entra** button that opens the same account in the Microsoft Entra admin center. The **Actions** menu in the header offers the same [Users](/user-documentation/identity/administration/users#table-actions) available from the Users list, minus the ones that navigate elsewhere: View User, Edit User and Research Compromised Account are reachable from the tabs instead. Apart from the profile photo, the MFA method controls and the role removal action described below, everything on this page is read only. Use the Edit User tab to change the account. ## Tabs {% content-ref url="/pages/jbP9ceYqEM10TNf6aetj" %} [Edit User](/user-documentation/identity/administration/users/user/edit) {% endcontent-ref %} {% content-ref url="/pages/BItSvgOgmXx96BOpMCvc" %} [Exchange Settings](/user-documentation/identity/administration/users/user/exchange) {% endcontent-ref %} {% content-ref url="/pages/EGPbyWqFtAVEtdgnFb5i" %} [Compromise Remediation](/user-documentation/identity/administration/users/user/bec) {% endcontent-ref %} {% content-ref url="/pages/fUkBG00F4M84qUETEsmQ" %} [Conditional Access](/user-documentation/identity/administration/users/user/conditional-access) {% endcontent-ref %} ## User Details The card on the left holds the account's directory properties. The work, contact and address sections only show the fields that have a value, and display a short placeholder when the account has none of them. | Field | Description | | ----------------------------------------------------------- | --------------------------------------------------------------------------- | | Profile photo | The user's Entra ID photo, or their initials when no photo is set. | | Account Enabled | Whether the account is currently able to sign in. | | Synced from AD | Whether the account is synchronised from on-premises Active Directory. | | Display Name | The name shown throughout Microsoft 365. | | Email Address | The addresses on the account, taken from its proxy addresses. | | User Principal Name | The sign-in name for the account. | | Licenses | The licences currently assigned. A note is shown when the account has none. | | Job Title, Company Name, Department, Manager | The account's work information. | | Mobile Phone, Business Phones | The contact numbers on the account. | | Street Address, City, Postal Code, Country, Office Location | The account's address information. | {% hint style="info" %} Buttons below the photo change or remove it. Uploads must be JPEG or PNG and no larger than 4 MB, and the new photo appears as soon as it has been written to Entra ID. {% endhint %} ## Latest Logon The most recent sign-in recorded for the user, shown as success or failure along with the address it came from and the application that was signed in to. Expanding the entry adds the client app used, the operating system or browser detected, the MFA method used and any additional detail Entra recorded against the result. When the sign-in carries location data, the expanded view also plots it on a map alongside the city, state and country or region. **More Sign-In Logs** opens a dialog with the user's last 50 sign-ins, listing the time, result, IP address, client app, target resource, error code and location for each. The location is a button that opens a map of where the sign-in came from. {% hint style="info" %} Sign-in logs require Microsoft Entra ID P1 or higher. Without it this card reports an error rather than data, and the same applies to the Applied Conditional Access Policies card, which is built from the same sign-in record. {% endhint %} ## Applied Conditional Access Policies The Conditional Access policies that applied successfully during the sign-in shown above. This is a record of one sign-in rather than a list of every policy targeting the user, so a policy that did not apply on that occasion will not appear here. Expanding an entry shows the grant controls and session controls the policy enforced, and the conditions that were satisfied. The card reports separately when the sign-in applied no policies at all and when no policy data is available. {% hint style="info" %} To see how a policy would behave for this user rather than how one behaved on a single sign-in, use the conditional-access.md tab. {% endhint %} ## Multi-Factor Authentication Devices Every authentication method registered against the account, other than the password itself. Each entry names the method type and the detail that distinguishes it, and shows when the method was last used where Graph reports it. | Method | Shown alongside the method name | | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | Microsoft Authenticator | The device name registered with the app. | | Microsoft Authenticator (passwordless) | The device name. This registration type has been retired by Graph but still appears on users who registered before the two were merged. | | Phone | The number and which slot it occupies, such as mobile, alternate mobile or office. | | Passkey (FIDO2) | The key's model, or its name where no model is reported. | | Software OATH token | The name given to the registration. Any app producing time-based codes appears here, not just Microsoft Authenticator. | | Hardware OATH token | The token's serial number, which Graph only returns when the device relationship is expanded. | | Email | The address used for verification. | | Windows Hello for Business | The name of the registration. | | Platform credential | The name, or the platform where no name is set. | | Temporary Access Pass | Nothing further, as Graph returns no identifying detail. | | QR code | Nothing further, as Graph returns only the identifier and last used date. | | External provider | The name of the registration. | A method type CIPP does not yet recognise still appears, labelled with the type name Graph returned. Two markers can appear on a method: | Marker | Meaning | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------ | | User default | The method matches the user's chosen second factor. | | System-preferred | The method matches the one Microsoft would select while system-preferred multifactor authentication is enabled for the tenant. | Both preferences are held against a method type rather than an individual registration, so every method of a preferred type carries the marker. A mobile number backs both SMS and voice, for example, so it is marked for either. Expanding a method shows its device name, app version, creation date and the underlying Graph method type. ### Managing methods The bin icon on a method removes that single registration, leaving the user's other methods intact. **Set Default MFA Method** sets the user's preferred second factor. The list only offers preferences the user can actually satisfy, drawn from what they have registered: Microsoft Authenticator push, an authenticator app or hardware token code, SMS, and voice calls to the mobile, alternate mobile or office number. Methods such as passkeys, Windows Hello for Business, email and Temporary Access Pass cannot be a default second factor, so a user registered only with those has the button disabled. Both controls require user write permissions. {% hint style="warning" %} While system-preferred multifactor authentication is enabled, Microsoft selects the strongest registered method at sign-in and the user's chosen default is not used. {% endhint %} ## Memberships Two cards list what the account belongs to, each showing a count in its header. **Groups** lists the groups the user is a member of, with the group name, its types, and whether it is security enabled and mail enabled. The row action opens the [Edit Group](/user-documentation/identity/administration/groups/edit) page for that group, where the membership itself can be changed. **Admin Roles** lists the directory roles assigned to the user, with the role name and description. The row action removes the user from that role, and requires role write permissions. ## Managed Devices The Intune managed devices registered to this user, matched on their user principal name. Each row shows the device name, operating system, OS version and management type, and the row action opens the device.md page. The card reports separately when the user has no managed devices and when the device lookup failed. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit User This page changes an existing user's properties, licences and group memberships in one submission. The header carries the same details as the [View Individual User](/user-documentation/identity/administration/users/user) tab: display name, user principal name, object ID, creation date and a **View in Entra** button. **Submit** applies every change on the page at once. {% hint style="danger" %} An account synchronised from on-premises Active Directory shows a warning at the top of the page. Graph accepts some of these edits, but the next directory synchronisation overwrites them, so changes to a synced account belong in the on-premises environment. {% endhint %} ## Identity | Field | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | First Name | The user's given name. | | Last Name | The user's surname. | | Display Name | The name shown throughout Microsoft 365. Unlike the Add User form, this is not rebuilt from the first and last name, so it keeps whatever it is set to. | | Username | The part before the @ symbol. Limited to 64 characters, and may contain letters, numbers and the characters `'` `.` `-` `_` `!` `#` `^` `~`. | | Primary Domain name | The domain used after the @ symbol, chosen from the tenant's verified domains. | | Add Aliases | Additional addresses, one per line, entered without the domain. | {% hint style="warning" %} The user principal name is rebuilt from **Username** and **Primary Domain name** on every submission, so changing either renames the account's sign-in name. The old address remains as an alias, but anything keyed to the sign-in name, including saved credentials and existing sessions, is affected. {% endhint %} {% hint style="info" %} Aliases entered here are added to the account. This form does not remove aliases, so clearing the box leaves the existing ones in place. {% endhint %} ## Settings | Setting | Description | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Create password manually | Reveals a **Password** field. The password is only changed when one is entered here, so an edit that leaves this off makes no change to the existing password. | | Require password change at next logon | Forces the user to set a new password the next time they sign in. | | Usage Location | The country the account is licensed in. Required before licences can be assigned, and falls back to the usage location set in your preferences when the account has none. | | Licenses | The licences the account should hold after the edit. Anything selected is added and anything currently assigned but not selected is removed. | | Remove all licenses | Strips every licence from the account and ignores whatever is selected in the licence box. | {% hint style="info" %} Emptying the **Licenses** box on its own does nothing, because an edit with no licences selected and this switch off is treated as no licence change at all. Use **Remove all licenses** to take the last licence off an account. {% endhint %} {% hint style="info" %} When the [Sherweb](/user-documentation/cipp/integrations/sherweb)d integration is enabled and a selected licence shows `(0 available)`, a **Purchase new licence?** switch and a **Sherweb License** selector appear. The purchase is placed immediately and the assignment is queued as a scheduled task, so the licence lands on the account shortly afterwards rather than as part of this submission. {% endhint %} ## Contact and organisation | Field | Description | | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Job Title, Department, Company Name | Organisational details written to the directory and shown in the address list. | | Street, City, State/Province, Postal Code, Country | The user's postal address. | | Mobile #, Business # | Contact numbers. | | Alternate Email Addresses | Secondary addresses, separated by commas. | | Set Manager | The user recorded as this account's manager. | | Set Sponsor | The user recorded as this account's sponsor. Only shown when `sponsor` has been added to the attribute list in your preferences. | {% hint style="info" %} Emptying one of these boxes clears the property in Entra ID, rather than leaving it as it was. This applies only to fields you actually edit during this visit: a field that was already empty when the page loaded is left alone, so the form does not wipe properties it was never asked about. The fields that behave this way are First Name, Last Name, Job Title, Department, Company Name, Mobile #, Business #, Street, City, State/Province, Postal Code, Country and Alternate Email Addresses. Display Name cannot be cleared this way. {% endhint %} ## Group membership | Field | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Copy groups from user | Copies another user's group memberships onto this account. Groups that cannot be copied, such as dynamic groups, synchronised groups and memberships the user already holds, are reported in the result rather than silently skipped. | | Add to Groups | Adds the account to the groups selected. The list only offers groups the user is not already a member of. | | Remove from Groups | Removes the account from the groups selected, chosen from the groups it currently belongs to. | {% hint style="info" %} Group changes are applied in the order they appear above: the copy runs first, then additions, then removals. Distribution lists and mail-enabled security groups are handled through Exchange rather than Graph, which CIPP works out per group at the time of the change. {% endhint %} ## Custom attributes and custom data Any directory attributes added under [User Preferences](/user-documentation/shared-features/menu-bar/user-settings) appear here as their own fields, pre-filled with the account's current values. [Custom Data](/user-documentation/cipp/custom-data) attributes mapped for manual entry against users in this tenant appear under a **Custom Data** heading, with the field type matching how the attribute was defined. ## Scheduling and notifications | Setting | Description | | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Schedule this user edit | Defers the edit to a chosen date instead of applying it immediately, which suits changes tied to a start date or a departure. | | Scheduled edit date | The date the edit should run. | | Send results to Webhook / E-mail / PSA | Delivers the outcome of the scheduled edit to the notification channels configured for the tenant. | | Reference | Free text added to the notification title so the task can be recognised later. | *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Exchange Settings This page displays information about the user's Exchange settings. This page brings together the mailbox side of a user's account: the mailbox's own settings, who has access to it, what it has access to, the rules and sender lists it carries, and the forwarding and automatic reply configuration. The header carries the same details as the [View Individual User](/user-documentation/identity/administration/users/user) tab, with an **Actions** menu that acts on this mailbox. {% hint style="info" %} When the account has no mailbox, the page reports that rather than showing empty cards, with a **Show Details** button that reveals the underlying Exchange error. The usual cause is that the account is not licensed for Exchange Online. {% endhint %} ## Actions ## Actions The **Actions** menu acts on this mailbox. Some entries are greyed out rather than hidden when they do not apply, so the menu always shows the same list and the state of the mailbox decides what can be run. The whole menu is unavailable until the mailbox details have loaded. | Action | Description | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Bulk Add Mailbox Permissions | Grants other users `Full Access`, `Send As` or `Send on Behalf` on this mailbox, with an automapping option for `Full Access`. | | Send MFA Push | Sends an approval request to the user's registered devices, which is a quick way to confirm you are speaking to the right person. | | Convert Mailbox | Converts the mailbox to a User, Shared, Room or Equipment mailbox. | | Enable Online Archive | Turns on the archive mailbox. Greyed out once the mailbox has an archive. | | Set Retention Policy | Applies one of the tenant's retention policies to the mailbox. | | Enable Auto-Expanding Archive | Allows the archive to grow beyond its initial quota. Greyed out until the archive is enabled, and it cannot be turned off again. | | Set Global Address List visibility | Hides the mailbox from the Global Address List, or shows it again. | | Start Managed Folder Assistant | Runs the assistant against the mailbox so retention settings and archiving are applied without waiting for the next scheduled pass. | | Delete Mailbox | Deletes the mailbox. | | Set Copy Sent Items for Delegated Mailboxes | Controls whether mail sent as, or on behalf of, this mailbox is also copied into its Sent Items. Greyed out for anything other than a user or shared mailbox. | | Set Litigation Hold | Places the mailbox on litigation hold for a chosen number of days, or lifts an existing hold with the **Disable Litigation Hold** switch. Greyed out when the mailbox is not licensed for litigation hold. | | Set Retention Hold | Places the mailbox on retention hold, or lifts one with the **Disable Retention Hold** switch. | | Set Mailbox Locale | Sets the mailbox language and regional format, for example `en-GB` or `da-DK`. | | Set Max Send/Receive Size | Sets the largest message the mailbox may send and receive, in MB. | | Set Send Quota | Sets the size at which the mailbox is stopped from sending. | | Set Send and Receive Quota | Sets the size at which the mailbox is stopped from sending and receiving. | | Set Quota Warning Level | Sets the size at which the user is warned that the mailbox is filling up. | | Set Calendar Processing | Configures how the resource handles booking requests, covering automatic processing and acceptance, conflict handling, meeting duration and booking window limits, what is stripped from the meeting item, and the response text sent back to organisers. Greyed out for anything other than a room or equipment mailbox. | ## Exchange Information The card on the left summarises the mailbox. Its header carries a refresh button, and a warning appears above the details when Microsoft has blocked the mailbox for spam. | Field | Description | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Mailbox Type | The Exchange recipient type, such as `UserMailbox` or `SharedMailbox`. | | Hidden from GAL | Whether the mailbox is hidden from the Global Address List. | | Blocked For Spam | Whether Microsoft has blocked the mailbox from sending because of spam activity. | | Retention Policy | The retention policy applied to the mailbox. | | Mailbox Usage | How much of the send and receive quota is in use, shown as a bar with the size used and the quota. | | Forwarding Status | Whether forwarding is off, or set to an internal or external address. | | Keep Copy in Mailbox | Whether forwarded mail is also delivered to this mailbox. Shown only when forwarding is configured. | | Forwarding Address | The address mail is forwarded to. Shown only when forwarding is configured. | | Archive Mailbox Enabled | Whether the archive mailbox exists. | | Auto Expanding Archive | Whether the archive can grow past its initial quota. The label reads **Auto Expanding Archive: (org)** when the setting comes from the organisation rather than the mailbox. Shown only when the archive is enabled. | | Total Archive Item Size | The size of the archive in GB. Shown only when the archive is enabled. | | Total Archive Item Count | The number of items in the archive. Shown only when the archive is enabled. | | Mailbox Holds | Which holds apply to the mailbox: compliance tag, retention, litigation, in-place, eDiscovery and Purview retention holds, and whether the mailbox is excluded from an organisation-wide hold. | | Mailbox Protocols | Which access protocols are enabled: EWS, MAPI, OWA, IMAP, POP, ActiveSync and SMTP client authentication. | {% hint style="info" %} The SMTP entry spells out its state rather than relying on the chip colour, because the underlying property records whether SMTP client authentication is *disabled*. A green **SMTP Disabled** chip is the secure outcome, **SMTP Enabled** is the one worth acting on, and **SMTP Unknown** means Exchange did not report the setting. {% endhint %} ## Proxy Addresses Every address on the mailbox, listed with its type and whether it comes from Entra ID, Exchange or both. **Add Alias** opens a dialog where an address is built from a prefix and one of the tenant's domains, and several can be queued before submitting. Row actions promote an address to primary, or remove it. {% hint style="info" %} When an address appears in only one of Entra ID or Exchange, the card says so. This is usually a recent change that Microsoft is still propagating rather than a fault, so it is worth refreshing before acting on it. {% endhint %} ## Mailbox Permissions Who else can get into this mailbox, listed by user or group, access rights and the type of principal. **Add Permissions** opens a dialog offering Full Access, with an automapping switch so Outlook adds the mailbox on its own, along with Send As and Send on Behalf. A toggle in the dialog widens the picker to include mail-enabled security groups. The row action removes a permission. ## Mailbox Access The other mailboxes this user can get into, listed with the mailbox name, its address and the rights held. The row action removes the user's access to the selected mailbox. {% hint style="info" %} This card is built from the cached mailbox permission report rather than a live Exchange query, which is what makes it fast enough to show a whole tenant's delegations. It only reflects what was true at the last cache sync, and reports an error asking you to sync the cache when no report data exists yet. {% endhint %} ## Calendar Permissions Who has access to this mailbox's calendar folders, listed by user or group, access rights, folder name and principal type. **Add Permissions** opens a dialog offering the full set of Exchange folder levels: Owner, Publishing Editor, Editor, Publishing Author, Author, Non Editing Author, Reviewer, Contributor, Limited Details, Availability Only and None. A **Delegate with Private item access** switch is available with Editor, which turns the grant into delegate access and lets the delegate see items marked private. The row action removes a permission. ## Contact Permissions The same arrangement applied to the mailbox's contact folders, with the same permission levels and the same row action. ## Current Mailbox Rules The inbox rules on the mailbox, listed with whether each is enabled, its name, description and priority. Row actions enable, disable or delete a rule. {% hint style="info" %} This card is worth a look during a compromise investigation, since rules that move or forward mail are a common way for an intruder to hide their activity. The bec.md tab gathers this alongside the other indicators. {% endhint %} ## Trusted and Blocked Senders/Domains The user's own safe and blocked sender lists, listed by type and value. The row action removes an entry. ## Mailbox Forwarding Sets where the mailbox's mail goes. | Field | Description | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Forward to Internal Address | Forwards to another recipient in the tenant, chosen from users and contacts. | | Forward to External Address | Forwards to an address outside the tenant. The tenant's remote domain settings have to allow automatic forwarding for this to take effect. | | Disable Email Forwarding | Clears the forwarding configuration. | | Keep a Copy of the Forwarded Mail in the Source Mailbox | Delivers the message to this mailbox as well as forwarding it. Without this, forwarded mail leaves no copy behind. | ## Out Of Office Sets the mailbox's automatic replies. | Field | Description | | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Auto Reply State | Enabled, Disabled, or Scheduled for a fixed period. | | Start Date/Time, End Date/Time | The period replies are sent for. Only used when the state is Scheduled. | | Internal Message | The reply sent to people inside the organisation. | | External Message | The reply sent to people outside the organisation. | | Block my calendar for this period | Creates a calendar event covering the absence, with a subject of your choosing. Only offered for a scheduled reply. | | Automatically decline new invitations during this period | Declines invitations that arrive for the absence. Only offered for a scheduled reply. | | Decline and cancel my meetings during this period | Declines and cancels meetings already in the calendar, with an optional message to organisers. Only offered for a scheduled reply. | ## Recipient Limits Sets the largest number of recipients the mailbox may address in a single message, which is a practical brake on a compromised account being used to send in bulk. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Compromise Remediation Single pane of glass review of common Indicators of Compromise (IoC) This page gathers the signals worth checking when a mailbox is suspected of being compromised, so an investigation does not mean opening the Entra, Exchange, and Purview portals in turn. Opening the page starts an analysis of the user, and each check appears as a collapsible card with a count of what it found. A count is a prompt to look, not a verdict. {% hint style="warning" %} Nothing on this page is proof of a compromise. The checks surface the information that usually matters during an investigation, and several of them return results on perfectly healthy accounts. Read the findings alongside what you already know about the user and the tenant. {% endhint %} ## Running the analysis The analysis runs as a background job. The first visit queues it and the page polls until it finishes, which can take up to ten minutes on a tenant with a lot of log data. The result is then cached against the user, so returning to the page shows the earlier run rather than starting a new one. The **Log information** card at the top of the checks reports whether the audit log extraction succeeded and when the data was pulled. It is the first thing to read, because the outcome shapes everything below it. {% hint style="danger" %} Most checks depend on the unified audit log. When it is disabled for the tenant, the Log information card says so and the checks that read from it come back empty rather than clean. An empty result in that state means nothing was available to search, not that nothing happened. {% endhint %} ## Checks Every check covers the seven days before the analysis ran, apart from the MFA device list and the Intune device list, which show the account's current registrations and devices regardless of age. | Check | What it looks for | | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Check 1: Mailbox Rules | The inbox rules currently on the mailbox, and any rule created, changed, or removed in the last seven days. A rule that moves mail into an `RSS` folder raises a potential breach message, as it is a long-standing trick for hiding replies. Rules whose names match a recent audit event are marked as changed in the last seven days and sorted to the top. | | Check 2: Recently added users | Accounts created in the tenant during the window, listed with their creation date. | | Check 3: New Applications | Service principals registered during the window, listed with their application ID and creation date. | | Check 4: Mailbox permission changes | Mailbox permission and delegation changes across the tenant, listed with who made the change, the operation, and the rights involved. Covers permissions being added or removed, calendar delegation updates, and folder permission grants. | | Check 5: Sent Messages | Messages sent by the mailbox during the window, from the message trace, with the subject, recipient, delivery status, time received, and originating IP address. | | Check 6: MFA Devices | The authentication methods registered on the account, other than its password, listed with the method type, name, and registration date. | | Check 7: Password Changes | Accounts across the tenant whose password changed during the window, listed with the change time. | | Check 8: Trusted & Blocked Senders | The mailbox's own trusted and blocked sender and domain lists, along with any changes to them in the last seven days. | | Check 9: Intune Devices | Every Intune-managed device enrolled under the account, newest enrolment first. The card's count is the number enrolled in the last seven days rather than the total, so a zero here still leaves a device list worth reading. A device standing up during the window can mean an intruder enrolling a virtual machine or personal endpoint under the identity, which is also a route to registering Windows Hello for Business as a persistence mechanism. | {% hint style="info" %} Checks 2, 3, 4, and 7 are tenant-wide rather than scoped to this user. That is deliberate: an intruder who has taken one mailbox often leaves traces elsewhere, so a new account or an unfamiliar application appearing in the same window is worth knowing about even though it has nothing to do with the mailbox in front of you. {% endhint %} {% hint style="info" %} Inbox rules carry no timestamp of their own, so a rule is marked as recently changed by matching its name against audit events from the last seven days. Rules changed from the Outlook client are recorded without a rule name, so a rule altered that way stays unmarked even though the change appears under the rule change entries. {% endhint %} ### Intune device actions Each row in Check 9 carries its own actions, so a suspect device can be dealt with without leaving the investigation. | Action | Description | | ------------------------------- | --------------------------------------------------------------------------------------- | | View Device | Opens the device's page within CIPP. | | View in Intune | Opens the device in the Microsoft Intune admin center in a new tab. | | Retire device | Removes company data and the Intune management profile, leaving personal data in place. | | Wipe device (remove enrollment) | Returns the device to factory settings, removing all data and the Intune enrolment. | {% hint style="danger" %} **Wipe device (remove enrollment)** is a full factory wipe, not the lighter wipe that keeps user or enrolment data. It cannot be undone, and it will take the device out of service for whoever is holding it. Confirm the device is genuinely the intruder's before running it. {% endhint %} Both actions need write permission for device management, and the list does not update on its own afterwards. Use **Refresh Data** to see the result. {% hint style="warning" %} If CIPP cannot read the tenant's Intune devices, the card says so in red and shows no count. That is not the same as the user having no devices, and it usually points at missing permissions or licensing rather than a clean result. Fix the underlying problem and refresh rather than reading the empty card as an all-clear. {% endhint %} ## Actions | Action | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Refresh Data | Discards the cached result and runs the analysis again. Use it when the cached data predates something you need to see, such as a rule created in the last few minutes or a device you have just retired. The page returns to its waiting state while the new run completes. | | Remediate User | Runs the containment steps listed on the overview card in one go: blocks sign-in, resets the password, disconnects all current sessions, removes every MFA method, disables all inbox rules, and disables OneDrive sharing. A confirmation dialog appears first. | | Generate PDF Report | Opens a preview of a formatted report covering the findings, written to be readable by managers and end users as well as technicians, and suitable for attaching to a compliance record. **Download PDF** saves it. Long result sets are truncated in the PDF, which points to the JSON export for the full list. | | Download JSON | Saves the complete analysis as a JSON file, including data the cards do not display. | {% hint style="warning" %} Removing every MFA method leaves the account with no second factor registered. Once sign-in is unblocked and the password reset, the user has to register a method again, so plan how they will do that before running the remediation on someone who is not sitting next to you. {% endhint %} {% hint style="info" %} **Remediate User** does not touch the user's devices. If Check 9 has turned up an enrolment you do not recognise, retiring or wiping it is a separate decision and a separate action. {% endhint %} {% hint style="info" %} The JSON export carries three data sets that no card displays: the last fifty sign-ins for the tenant, the user's most recent sign-in, and the mobile devices attached to the mailbox. If the investigation turns on sign-in origin or an unrecognised device, that is where to look. The Intune device list in the export also holds the manufacturer, model, owner type, and assigned user, none of which the card shows. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Conditional Access This page runs a Conditional Access "what if" evaluation for the user: you describe a sign-in, and CIPP reports which of the tenant's policies would apply to it and why. It is the quickest way to answer questions like whether a new policy would lock someone out, or why an existing one is not catching the sign-ins you expected. {% hint style="info" %} The evaluation is a simulation. No sign-in takes place, nothing is written to the tenant, and the user is not affected in any way, so it is safe to run against a live account at any time. The results table reports each policy's state alongside the outcome, so a policy that would apply in report-only mode can be told apart from one that would be enforced. {% endhint %} ## Test Conditional Access Policy {% stepper %} {% step %} ### Select the application to test The application the simulated sign-in is directed at, chosen from the service principals in the tenant. This is the only required field. {% endstep %} {% step %} ### Set any optional conditions Anything left blank is simply not included in the evaluation, so start with the application alone and add conditions as you narrow down the behaviour you are chasing. The options are described below. {% endstep %} {% step %} ### Select **Test policies** The evaluation runs against Entra ID and the results replace whatever is in the table. {% endstep %} {% step %} ### Review the results Work through the table on the right, described in #ca-test-results. {% endstep %} {% endstepper %} ## Optional Parameters | Field | Description | | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Select the device platform to test | The operating system the sign-in comes from: Windows, iOS, Android, MacOS or Linux. | | Select the client application type to test | How the sign-in reaches Microsoft 365: All, Browser, Mobile apps and desktop clients, Exchange ActiveSync, EAS supported, or Other clients. Legacy authentication policies usually turn on this condition. | | Select the authentication flow | Whether the sign-in uses a flow that policies can target separately: None, Device code flow or Authentication transfer. | | Test from this IP | The address the sign-in appears to originate from, entered in the form `8.8.8.8`. Use this to check policies built on named locations. | | Test from this country | The country the sign-in appears to originate from. | | Select the sign-in risk level of the user signing in | The risk Entra ID Protection would assign to the sign-in itself: Low, Medium, High or None. | | Select the user risk level of the user signing in | The risk Entra ID Protection would assign to the account: Low, Medium, High or None. | {% hint style="info" %} The two risk conditions describe risk the evaluation should assume, not risk the account currently carries. Setting them is how you test a risk-based policy without waiting for Entra ID Protection to flag someone, and the policies themselves still need the licensing that risk-based Conditional Access requires before they will do anything in production. {% endhint %} ## CA Test Results Each of the tenant's Conditional Access policies is listed with what the evaluation decided about it. | Column | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name of the policy. | | State | Whether the policy is enabled, disabled, or enabled in report-only mode. | | Policy Applies | Whether the policy would apply to the sign-in as described. | | Analysis Reasons | Why the evaluation reached that conclusion, which for a policy that does not apply names the condition that ruled it out. | {% hint style="info" %} Analysis Reasons is the column that earns its keep. A policy showing as not applying will usually name the single condition responsible, so it points straight at the assignment or condition to change rather than leaving you to compare the policy against your test settings by hand. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit Properties Wizard This wizard applies the same property change to many users at once. It is reached from the **Edit Properties** action on the [Users](/user-documentation/identity/administration/users) page, which carries the selected users across, so there is no way to pick users from within the wizard itself. {% hint style="info" %} The selection is handed over in session storage and cleared as soon as the wizard reads it. Reloading the page loses the list and leaves you with nothing to update, so go back to the Users page and start the action again rather than refreshing. {% endhint %} {% stepper %} {% step %} ### Review Users The users carried over from the Users page are listed with their display name, user principal name, job title and department. The **Remove from List** row action drops a user from the run, which is the moment to catch anyone caught by an over-broad selection or filter. The wizard will not continue with an empty list. {% endstep %} {% step %} ### Select Properties **Properties to update** is a multi-select listing everything that can be changed, with a **Select All** entry at the top. Each property you tick adds its own input below, and the input matches the property: a text box for most, a switch for **Show in Address List**, a user picker for **Manager** and **Sponsor**, and a domain picker for **UPN Domain Suffix**. {% endstep %} {% step %} ### Confirmation The properties and the values you set are listed together, followed by the users the change will be applied to. **Submit** applies everything in one operation. Once it has run the button becomes **Resubmit**, and the results appear below it. {% endstep %} {% endstepper %} ## Properties | Property | Graph property | Notes | | ----------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Business Phone | `businessPhones` | Holds a list in Graph, but the wizard writes the single value entered, replacing any numbers already on the account. | | City | `city` | | | Company Name | `companyName` | | | Country | `country` | The country name held on the profile. This is not what licences are assigned against, which is Usage Location below. | | Department | `department` | | | Employee Type | `employeeType` | Free text, commonly used for values such as Employee, Contractor or Vendor. | | Fax Number | `faxNumber` | | | Job Title | `jobTitle` | | | Manager | `manager` | A directory relationship rather than a property, so it is set in a separate operation from the rest of the patch and reports its own result. | | Mobile Phone | `mobilePhone` | | | Office Location | `officeLocation` | | | Postal Code | `postalCode` | | | Preferred Data Location | `preferredDataLocation` | Only has an effect in a multi-geo tenant, where it decides which region the user's data is stored in. | | Preferred Language | `preferredLanguage` | A language code such as `en-GB`, not a language name. | | Show in Address List | `showInAddressList` | A switch rather than a text value. See the note below on setting it to No. | | Sponsor | `sponsor` | A directory relationship, handled the same way as Manager. | | State/Province | `state` | | | Street Address | `streetAddress` | | | Usage Location | `usageLocation` | A two-letter country code such as `GB` or `US`. This is the field licence assignment depends on, so a wrong value blocks licensing rather than just looking untidy. | | UPN Domain Suffix | `userPrincipalName` | Changes the part of the sign-in name after the @ symbol, keeping each user's existing prefix. Only offered when every selected user belongs to the same tenant. | Custom data attributes mapped for manual entry against users also appear in the list, labelled **(Custom)**, and write to the attribute they are mapped to. Attributes that hold more than one value are left out, as the wizard writes a single value to every selected user. {% hint style="warning" %} Usage Location, Country, Preferred Language and Preferred Data Location are plain text boxes here, unlike the Add User and Edit User forms where they are chosen from a list. Whatever is typed is sent to Graph as it stands, so a value in the wrong format is rejected for every user in the run, or worse, accepted and wrong. Copy the format from an account that is already correct if you are unsure. {% endhint %} {% hint style="warning" %} A property with no value entered is skipped rather than cleared, so the wizard can set and change properties but cannot empty them. To clear a property across several users, use the edit.md page one user at a time, where emptying a field you have edited does clear it. **Show in Address List** is the exception worth watching. The switch only contributes a value once it has been touched, so setting the property to No means toggling it on and then off again. Leaving it untouched sends nothing at all. {% endhint %} {% hint style="danger" %} Changing the UPN domain suffix signs every affected user out, and they have to sign in again with the new address. Anything keyed to the old sign-in name, including saved credentials and any system that matches users by UPN, needs to be considered before running this across a group. {% endhint %} {% hint style="info" %} When the selection spans tenants, the users are grouped by tenant and updated tenant by tenant. Two limits follow from that. UPN Domain Suffix is withdrawn from the property list entirely, since a domain from one tenant means nothing in another. Manager and Sponsor stay available, but their picker only lists users from the first tenant in the selection, and the assignment will only succeed where an account with that name also exists in the other tenants. The wizard warns about both on screen. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Risky Users This page lists the accounts Microsoft Entra ID Protection currently holds a risk assessment for, so a tenant's flagged users can be reviewed and cleared without opening the Entra portal. The table is sorted with the most recently updated risk first. ## Table Details The properties returned are for the Graph resource type `riskyUser`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/riskyuser?view=graph-rest-1.0#properties). ## Filters | Filter | Shows | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | Users at Risk | Accounts whose risk is still open and has not been acted on. | | Dismissed Users | Accounts whose risk has been dismissed, either here or in the Entra portal. | | Remediated Users | Accounts whose risk was resolved by the user meeting a remediation requirement, such as a self-service password reset or a risky sign-in policy. | ## Table Actions
ActionDescriptionBulk Action Available
Dismiss RiskMarks the account's risk as dismissed, which tells Entra ID Protection the activity was legitimate and returns the account to a normal state.true
Research Compromised AccountOpens the Compromise Remediation tab for the account, where the usual indicators of compromise are gathered in one place.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} Dismissing a risk closes it without changing anything about the account. It does not reset a password, revoke a session or remove whatever caused the detection, so an account that really is compromised stays compromised with its warning cleared. Investigate before dismissing, and remediate through the [Compromise Remediation](/user-documentation/identity/administration/users/user/bec) page or the Users list where the account turns out to be at risk. {% endhint %} {% hint style="info" %} This page depends on Microsoft Entra ID Protection, which needs Entra ID P2 licensing. Tenants without it return no risk data, so an empty table means the feature is unavailable rather than that no user is at risk. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Groups Interact with Microsoft 365 groups. The Groups page lists every group in the tenant and is where group membership, mail behaviour and lifecycle are managed. It covers the same ground as [Microsoft 365 admin center > Active teams and groups](https://admin.microsoft.com/#/groups), and extends it with actions that would otherwise need Exchange Online PowerShell. ## Action Buttons
Show Members Adds a column listing the members of each group. You may need to select the column from the table's column selector as well. Showing members and showing owners are mutually exclusive, because Graph accepts only one expansion per request, so turning one on turns the other off. Both buttons are hidden while the table is showing cached data.
Show Owners Adds a column listing the owners of each group, under the same one-at-a-time restriction as Show Members.
{% content-ref url="/pages/2YzVatfRdJvMLBoOArDd" %} [Add Group](/user-documentation/identity/administration/groups/add) {% endcontent-ref %} {% content-ref url="/pages/ohUXxLKZmJg2kEuCBOKE" %} [Edit Group](/user-documentation/identity/administration/groups/edit) {% endcontent-ref %} ## Table Details | Column | Description | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name of the group as it appears throughout Microsoft 365. | | Description | The group's description. | | Mail | The group's email address, where it has one. | | Mail Enabled | Whether the group can receive email. | | Mail Nickname | The alias the group's address is built from. | | Group Type | The kind of group, worked out by CIPP from the group's underlying flags: Microsoft 365, Mail-Enabled Security, Security or Distribution List. | | Assigned Licenses | Licences assigned to the group for group-based licensing. | | License Processing State | How far Entra has got with applying group-based licences to the members. | | Visibility | Whether the group is public or private. | | On Premises Sam Account Name | The account name the group carries when it is synchronised from on-premises Active Directory. | | Membership Rule | The rule that decides membership, for a dynamic group. | | On Premises Sync Enabled | Whether the group is synchronised from on-premises Active Directory. | Showing members or owners adds a further column listing them. In cached mode a **Cache Timestamp** column records when the cache was last refreshed, and a **Tenant** column is added when the tenant selector is set to All Tenants. {% hint style="info" %} Group Type is composed by CIPP rather than returned by Graph, which reports the same information across the `groupTypes`, `mailEnabled` and `securityEnabled` properties. A group is Microsoft 365 when its `groupTypes` include `Unified`, Mail-Enabled Security when it is both mail and security enabled, Security when it is security enabled alone, and a Distribution List when it is mail enabled alone. This matters when comparing against Graph output or the Entra portal, where no single equivalent field exists. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
View GroupOpens the /pages/vIxl1Jx87MF2PPteq8wf page for the group, covering its membership, owners and settings.false
Edit GroupOpens the /pages/ohUXxLKZmJg2kEuCBOKE page, where membership, owners and group settings can be changed.false
Set Global Address List VisibilityHides the group from the Global Address List or shows it again. Has no effect on a group synchronised from on-premises Active Directory.true
Only allow messages from people inside the organisationRequires sender authentication, so the group only accepts mail from within the tenant. Has no effect on a group synchronised from on-premises Active Directory.true
Allow messages from people inside and outside the organisationDrops the sender authentication requirement, so the group accepts mail from external senders as well. Has no effect on a group synchronised from on-premises Active Directory.true
Set Source of AuthoritySwitches the group between Cloud Managed and On-Premises Managed. Greyed out for cloud-native groups that have never been synchronised, and a move back to on-premises takes until the next sync cycle to appear.true
Create template based on groupCreates a reusable group template from this group, copying its name, description, type, membership rule, alias and external sender setting.true
Create Team from GroupTurns the group into a Microsoft Teams team, with the member, messaging and fun settings set in the dialog. Greyed out for anything other than a Microsoft 365 group.true
Delete GroupDeletes the group.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="info" %} A group has to be at least fifteen minutes old before **Create Team from Group** will work, as Microsoft needs the group to have finished provisioning first. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add Group This page creates a new group in the selected tenant. Complete the shared details, choose a group type, then fill in any additional settings that appear for that type. Selecting **Submit** creates the group immediately, with no confirmation step. ## Group Details These fields apply to every group type. | Field | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name shown for the group in the Microsoft 365 admin center, address lists, and CIPP. | | Description | A free-text description of the group's purpose. | | Username | The mail nickname for the group, entered without a domain. Combined with the primary domain to form the group's email address for group types that are mail-enabled. | | Primary Domain name | The verified domain used for the group's email address. Only verified domains for the tenant are listed, and the tenant's default domain is selected automatically. | | Owners | One or more users who will be able to manage the group. | | Members | One or more users to add to the group when it is created. | {% hint style="info" %} Security groups and Azure role groups are not mail-enabled, so **Username** and **Primary Domain name** are not used for those types. A random mail nickname is generated instead. Any characters other than letters, numbers, hyphens and underscores are stripped from the username before it becomes the mail nickname. {% endhint %} ## Group Type Select one group type. The type determines which additional settings appear below the selector. | Group Type | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | Azure Role Group | A role-assignable security group, used to assign Entra ID directory roles to a group of users. Role assignability cannot be enabled after creation. | | Security Group | A standard security group, used for granting access to resources and for group-based licensing. | | Microsoft 365 Group | A Microsoft 365 (unified) group with a shared mailbox, calendar, and associated SharePoint site. | | Dynamic Group | A security group whose membership is calculated automatically from a membership rule. | | Dynamic Distribution Group | An Exchange Online distribution group whose membership is resolved at send time from a recipient filter. | | Distribution List | An Exchange Online distribution group for delivering mail to a static list of recipients. | | Mail Enabled Security Group | A security group that can also receive mail, allowing it to be used both for permissions and for mail delivery. | ## Additional Settings These settings appear only for the group types listed against them. | Setting | Group Types | Description | | --------------------------------------------------------------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Disable group nesting (prevent other groups from being members) | Azure Role Group, Security Group, Microsoft 365 Group, Dynamic Group | Prevents other groups from being added as members, so the group can only contain users. | | Licenses (optional) | Security Group | Assigns one or more licences to the group, so members inherit them through group-based licensing. Each licence is listed with the number of units currently available. | | Let people outside the organization email the group | Distribution List, Dynamic Distribution Group | Allows senders outside the organisation to email the group. When left off, only authenticated internal senders can deliver to it. | | Email Aliases | Distribution List, Mail Enabled Security Group | Additional email addresses for the group, entered one per line as full SMTP addresses. These are added as secondary addresses alongside the primary address. | | Hide this group from the Global Address List (GAL) | Distribution List, Mail Enabled Security Group | Hides the group from address lists, so it does not appear when users browse or search for recipients. | | Subscribe members to receive group emails | Microsoft 365 Group | Automatically subscribes new members to the group's conversations, so group mail is delivered to their own inbox as well as the group mailbox. | | Dynamic Group Parameters | Dynamic Group, Dynamic Distribution Group | The rule that determines membership. Dynamic groups use Entra ID membership rule syntax; dynamic distribution groups use an Exchange Online recipient filter. | {% hint style="info" %} An example membership rule for a dynamic group, excluding guests and external users: `(user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest")` {% endhint %} {% hint style="warning" %} Members entered on this page are ignored for a **Dynamic Group**, because membership is calculated from the rule rather than assigned directly. Owners are still applied. A **Dynamic Distribution Group** goes further and ignores owners, members and the description as well. Only the display name, the recipient filter, the email address and the external sender setting are used at creation, so anything else needed on the group has to be set afterwards from the edit.md page or Exchange Online. {% endhint %} {% hint style="warning" %} Group-based licensing requires the tenant to be licensed for Entra ID P1 or higher. Assigning licences through a group without the appropriate licensing is not compliant with Microsoft's licensing terms. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit Group The Edit Group page changes the properties, membership, and settings of an existing group. Membership is managed by adding and removing users, groups, contacts, and devices rather than by editing a list, so each save applies the additions and removals you have specified. Which fields appear depends on the group's type, since not every setting applies to every kind of group. {% hint style="danger" %} A group synchronised from on-premises Active Directory shows a warning at the top of the page. Changes to those groups belong in the on-premises environment, as edits made here are overwritten by the next synchronisation. {% endhint %} ## Viewing current membership A button beside the page title switches between the editing form and a read-only view of the group's current membership. Select **View members** to see who is currently in the group, and **Edit Membership** to return to the form. | Column | Description | | ------------------- | ----------------------------------------------------------------- | | Type | Whether the entry is an Owner, a Member, or a Contact. | | User Principal Name | The sign-in name of the user, or the email address for a contact. | | Display Name | The name of the user or contact. | ## Group Properties | Setting | Description | | ---------------- | ----------------------------------------------------------------------------------------------------------- | | Display Name | The name of the group as it appears to users. | | Description | A description of the group's purpose. | | Mail Nickname | The alias used in the group's email address. | | Membership Rules | The rule that determines which objects belong to the group. Shown only for groups using dynamic membership. | ## Add Members Anything selected here is added to the group when you save. Objects that already belong to the group are filtered out of the lists, so the same member cannot be added twice. | Setting | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Add Members (Users or Groups) | Adds users or other groups as members. Several can be selected at once. | | Add Owners | Adds users as owners of the group. | | Add Contacts | Adds mail contacts as members. Only Distribution Lists and Mail-Enabled Security groups accept contacts. | | Add Devices | Adds devices as members. Devices are listed by name, with the operating system shown alongside where it is known. Not offered for Distribution List or Mail-Enabled Security groups, which cannot contain devices. | {% hint style="info" %} The **Add Contacts** field is offered for every group type, but Entra ID only allows contacts in Distribution Lists and Mail-Enabled Security groups. Selecting a contact for a Security or Microsoft 365 group returns an error for that contact when you save, while the rest of the changes still apply. {% endhint %} ## Remove Members Anything selected here is removed from the group when you save. The lists show only the group's current members, owners, and contacts. | Setting | Description | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | Remove Members (Users or Groups) | Removes the selected users or groups from the group. Users are listed with their sign-in name, and nested groups with their group type. | | Remove Owners | Removes the selected users as owners. | | Remove Contacts | Removes the selected mail contacts. | ## Group Settings These settings apply to mail-enabled groups, and which of them appear depends on the group's type. | Setting | Description | Shown for | | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | | Group visibility | Whether the group is Public, so anyone can see its content and join, or Private, so membership is controlled by the owners. | Microsoft 365 | | Let people outside the organization email the group | Allows senders from outside your organisation to email the group. | Microsoft 365, Distribution List | | Send Copies of team emails and events to team members inboxes | Delivers a copy of the group's messages and calendar events to each member's own mailbox. | Microsoft 365 | | Hide group mailbox from Outlook | Hides the group's mailbox from Outlook clients. | Microsoft 365 | | Security Enabled | Marks the group as security enabled, so it can be used to grant access to resources as well as for mail. | Microsoft 365 | ## Licenses Licences assigned to a group are applied automatically to everyone in it, which is how group-based licensing is managed. Changes can take a few minutes to take effect. This section is shown for Security groups that are not synchronised from on-premises Active Directory, and the licences the group currently holds are listed above the fields. | Setting | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------- | | Add Licenses | Assigns one or more licences to the group, which are then applied to all of its members. | | Remove Licenses | Removes one or more of the licences currently assigned to the group. The list contains only the licences the group already has. | ## Saving **Submit** applies your changes. Additions and removals are processed together, and each is reported separately in the result, so a change that cannot be applied is listed as an error while the rest still go through. {% hint style="info" %} The five settings under Group Settings are only sent when you have actually changed them, so a toggle you leave alone is not written back. The properties under Group Properties behave differently and are submitted every time, whatever their current value. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # View Group This page brings together everything CIPP knows about a single group: its properties, who is in it, who owns it, and what it belongs to. The header shows the group's display name along with its email address, object ID and creation date, each of which can be copied, and a **View in Entra** button that opens the same group in the Microsoft Entra admin center. {% hint style="info" %} Opening a group in Entra uses your own account rather than the CIPP service account, so you need rights in that tenant to see it: direct assignment in the partner tenant, or a GDAP relationship for a client tenant. {% endhint %} ## Actions The **Actions** menu acts on this group. Entries are greyed out rather than hidden when they do not apply. | Action | Description | | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Edit Group | Opens the [Edit Group](/user-documentation/identity/administration/groups/edit) page, where properties, membership and group settings can be changed. | | Set Global Address List Visibility | Hides the group from the Global Address List, or shows it again. Has no effect on a group synchronised from on-premises Active Directory. | | Only allow messages from people inside the organisation | Requires sender authentication, so the group only accepts mail from within the tenant. | | Allow messages from people inside and outside the organisation | Drops the sender authentication requirement, so the group accepts mail from external senders as well. | | Set Source of Authority | Switches the group between Cloud Managed and On-Premises Managed. Greyed out for cloud-native groups that have never been synchronised, and a move back to on-premises takes until the next sync cycle to appear. | | Create template based on group | Creates a reusable group template from this group, copying its name, description, type, membership rule, alias and external sender setting. | | Create Team from Group | Turns the group into a Microsoft Teams team, with the member, messaging and fun settings set in the dialog. Greyed out for anything other than a Microsoft 365 group. | | Delete Group | Deletes the group. | {% hint style="info" %} A group has to be at least fifteen minutes old before **Create Team from Group** will work, as Microsoft needs the group to have finished provisioning first. {% endhint %} ## Group Details The card on the left summarises the group, opening with its display name and type. | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name of the group as it appears to users. | | Group ID | The group's object ID in Entra ID. | | Email Address | The group's email address. Shown only when the group has one. | | Description | The group's description. Shown only when one is set. | | Group Type | The kind of group, worked out from the group's underlying flags: Microsoft 365, Security, Mail-Enabled Security or Distribution List. | | Mail Enabled | Whether the group can receive email. | | Security Enabled | Whether the group can be used to grant access to resources. | | Created Date | When the group was created. | | Synced from AD | Shown only when the group is synchronised from on-premises Active Directory. | {% hint style="info" %} Group Type is composed rather than returned by Graph, which spreads the same information across the `groupTypes`, `mailEnabled` and `securityEnabled` properties. A group is Microsoft 365 when its `groupTypes` include `Unified`, Mail-Enabled Security when it is both mail and security enabled, Security when it is security enabled alone, and a Distribution List when it is mail enabled alone. {% endhint %} ## Members The group's members, listed with their display name, sign-in name, email address and object type. The row action opens the [View Individual User](/user-documentation/identity/administration/users/user) page, and is available for members that are users, since the same table also lists nested groups, devices and contacts. ## Owners The group's owners listed the same way, with the same row action through to the user's own page. ## Memberships The groups this group belongs to, listed with the group name, its types, and whether it is security enabled and mail enabled. Row actions open the group's own page or its edit page. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Group Templates Group templates hold the settings for a group so the same group can be created repeatedly, in one tenant or across many. A template records the group's name, description, type and the settings that apply to that type, and is then applied from the deploy page. Templates are stored in CIPP rather than in a tenant, so the list is the same whichever tenant is selected. ## Action Buttons {% content-ref url="/pages/6Rk6cebzBET9AXB7TQm0" %} [Add Group Template](/user-documentation/identity/administration/group-templates/add) {% endcontent-ref %} {% content-ref url="/pages/zeS3ZVn7WiEZbC3TNVrj" %} [Deploy Group Templates](/user-documentation/identity/administration/group-templates/deploy) {% endcontent-ref %} ## Table Details | Column | Description | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name the group is given when the template is applied. | | Description | The description the group is given when the template is applied. | | Group Type | The kind of group the template creates, shown as its stored value: `m365`, `generic` for a security group, `security` for a mail-enabled security group, `distribution`, `dynamic`, `dynamicDistribution` or `azureRole`. | | GUID | The template's unique identifier in CIPP, used when the template is referenced elsewhere. | Everything else the template holds is shown in the Extended Info flyout, including the membership rule, the mail nickname, any licences and aliases, whether external senders are allowed, whether the group is hidden from the Global Address List, and where the template came from. {% hint style="info" %} The Group Type column shows the stored value rather than the friendly name used on the Add Group Template page, so a plain security group reads as `generic` while a mail-enabled security group reads as `security`. Templates saved by older CIPP versions are normalised to these values when the list is built, so an older template still reports a recognisable type. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Edit TemplateOpens the /pages/qwYUWhBNEVoziw50wSGR page for the selected template.false
Save to GitHubUploads the template to one of your GitHub repositories, prompting for the repository and a commit message. Only repositories you have write access to are offered. Greyed out unless the GitHub integration is enabled.true
Delete TemplateDeletes the template from CIPP. Groups already created from it are unaffected.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add Group Template This page creates a group template, which records the settings for a group so the same group can be created again later, in one tenant or across many. Complete the shared details, choose a group type, then fill in any additional settings that appear for that type. Templates are applied from the deploy.md page. ## Template Details These fields apply to every group type. | Field | Description | | ------------ | -------------------------------------------------------------------- | | Display Name | The name the group is given when the template is applied. Required. | | Description | The description the group is given when the template is applied. | | Username | The mail nickname the group's email address is built from. Required. | {% hint style="warning" %} Username is the Microsoft 365 mail nickname, which has to be unique within a tenant. A template built from an existing group carries that group's nickname, so it needs overwriting before the template is used in the same tenant. {% endhint %} {% hint style="info" %} **Username** and **Email Aliases** accept variables, so a single template can produce tenant-appropriate addresses. `%tenantfilter%` is replaced with the target tenant's domain when the template is applied, as in `postmaster@%tenantfilter%`. {% endhint %} ## Group Type Select one group type. The type determines which additional settings appear below the selector. | Group Type | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------- | | Azure Role Group | A role-assignable security group, used to assign Entra ID directory roles to a group of users. | | Security Group | A standard security group, used for granting access to resources and for group-based licensing. | | Microsoft 365 Group | A Microsoft 365 (unified) group with a shared mailbox, calendar, and associated SharePoint site. | | Dynamic Group | A security group whose membership is calculated automatically from a membership rule. | | Dynamic Distribution Group | An Exchange Online distribution group whose membership is resolved at send time from a recipient filter. | | Distribution List | An Exchange Online distribution group for delivering mail to a static list of recipients. | | Mail Enabled Security Group | A security group that can also receive mail, allowing it to be used both for permissions and for mail delivery. | ## Additional Settings These settings appear only for the group types listed against them. | Setting | Group Types | Description | | --------------------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Licenses (optional) | Security Group | Licences assigned to the group, so members inherit them through group-based licensing. Group-based licensing requires the tenant to be licensed for Entra ID P1 or higher. Assigning licences through a group without the appropriate licensing is not compliant with Microsoft's licensing terms. | | Let people outside the organization email the group | Distribution List, Dynamic Distribution Group | Allows senders outside the organisation to email the group. When left off, only authenticated internal senders can deliver to it. | | Email Aliases | Distribution List, Mail Enabled Security Group | Additional email addresses for the group, entered one per line. Added as secondary addresses alongside the primary address. | | Hide this group from the Global Address List (GAL) | Distribution List, Mail Enabled Security Group | Hides the group from address lists, so it does not appear when users browse or search for recipients. | | Dynamic Group Parameters | Dynamic Group, Dynamic Distribution Group | The rule that determines membership. Dynamic groups use Entra ID membership rule syntax; dynamic distribution groups use an Exchange Online recipient filter. | {% hint style="info" %} An example membership rule for a dynamic group, excluding guests and external users: `(user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest")` {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Deploy Group Templates Streamline group creation across multiple tenants in Microsoft 365 This wizard applies a saved group template to one or more tenants, creating the same group in each. Templates are managed on the [Group Templates](/user-documentation/identity/administration/group-templates) page, and the values a template supplies can be adjusted for this deployment without changing the stored template. {% stepper %} {% step %} ### Tenant Selection Choose the tenants the group should be created in. Several can be selected, and the group is created separately in each. There is no All Tenants option here, so the tenants have to be picked individually. {% endstep %} {% step %} ### Choose Template **Choose a Template** lists the saved templates by name and group type. Selecting one fills in the fields below, which can then be edited for this deployment. A template is not required: the fields can be completed by hand instead. | Field | Description | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Group Type | The kind of group to create: Dynamic Group, Dynamic Distribution Group, Security Group, Distribution Group, Azure Role Group or Mail Enabled Security Group. Required, and it decides which of the settings below appear. | | Group Display Name | The name the group is created with. Required. | | Group Description | A description for the group. | | Group Username | The mail nickname the group's email address is built from. | | Allow external emails to the group | Allows senders outside the organisation to email the group. Shown for a Distribution Group. | | Membership Rules | The rule that decides membership. Shown for a Dynamic Group or Dynamic Distribution Group, and required for both. | | Email Aliases | Additional email addresses, one per line. Shown for a Distribution Group or Mail Enabled Security Group. | | Hide this group from the Global Address List (GAL) | Hides the group from address lists. Shown for a Distribution Group or Mail Enabled Security Group. | | {% endstep %} | | {% step %} ### Confirmation Review the values and submit. The group is created in every tenant selected in the first step. {% endstep %} {% endstepper %} {% hint style="info" %} **Group Username** and **Email Aliases** accept variables, so one template can produce tenant-appropriate addresses across a multi-tenant deployment. `%tenantfilter%` is replaced with the target tenant's domain, as in `postmaster@%tenantfilter%`. {% endhint %} {% hint style="info" %} Licences held on a template are carried into the deployment even though this wizard does not display them, so a Security Group template with group-based licensing attached still assigns those licences. To see or change which licences a template holds, edit the template itself. {% endhint %} {% hint style="warning" %} The Group Type list here does not include Microsoft 365 Group, so a Microsoft 365 template cannot be deployed from this wizard. Selecting one leaves the group type unset and the wizard will not continue. Create Microsoft 365 groups from the [Add Group](/user-documentation/identity/administration/groups/add) page in the meantime. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit Group Template This page changes a saved group template. It opens the template's stored values in the same form used to create one. The fields and the settings that appear for each group type are described on [Add Group Template](/user-documentation/identity/administration/group-templates/add). Saving overwrites the existing template in place rather than creating a second one, because the template keeps its identifier through the edit. {% hint style="info" %} Groups already created from a template are not affected by editing it. A template only supplies values at the moment it is applied, so changes here take effect the next time the template is deployed. {% endhint %} {% hint style="warning" %} Changing the group type on an existing template changes which settings apply to it. Values belonging to the previous type stay on the record but stop being offered, so a template switched from a Distribution List to a Security Group keeps its aliases without any way to see or clear them from this page. Where the type is wrong it is usually cleaner to create a new template and delete the old one. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Devices This page lists the devices registered in the tenant's directory, covering everything Entra ID knows about regardless of whether it is managed by Intune. It is the place to check a device's join type and sign-in state, block a device that should no longer authenticate, or retrieve its recovery key. ## Table Details The properties returned are for the Graph resource type `device`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/device?view=graph-rest-beta#properties). ## Table Actions
ActionDescriptionBulk Action Available
View in EntraOpens the device in the Microsoft Entra admin center in a new tab.false
Enable DeviceAllows the device to authenticate with tenant credentials again. Greyed out for a device that is already enabled.true
Disable DeviceBlocks the device from authenticating with tenant credentials, without removing it from the directory. Greyed out for a device that is already disabled.true
Retrieve BitLocker KeysReturns the device's BitLocker recovery key from Entra ID, displayed in the result.true
Delete DeviceRemoves the device from Entra ID. Any recovery keys held against it are lost with it, so retrieve them first if they may still be needed.true
{% hint style="warning" %} Retrieving a BitLocker key returns a live recovery key in plain text, so treat the result as sensitive and avoid leaving it in a ticket or a chat message. Each retrieval is written to the CIPP audit log, recording who asked for it and when. {% endhint %} {% hint style="info" %} Disabling a device stops it authenticating but leaves the object in place, so the action can be reversed and the device's recovery keys stay available. Deleting is the destructive option, and a device that is still in use will simply register itself again the next time it is joined. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Deleted Items Lists all deleted users, groups and applications in the tenant This page lists the directory objects that have been soft-deleted in the tenant and are still recoverable. Nine object types are gathered into one table, so a deletion can be reversed or made permanent without knowing in advance which kind of object it was. ## Table Details CIPP queries each deleted object type separately and combines the results, adding the Type column so the rows can be told apart. | Column | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name the object had when it was deleted. | | Type | The kind of object, added by CIPP: Administrative Unit, Application, Certificate Authority Detail, Certificate Based Auth Pki, External User Profile, Group, Pending External User Profile, Service Principal or User. | | User Principal Name | The sign-in name, for deleted users. Empty for object types that do not have one. | | Deleted On | When the object was deleted. | | On Premises Sync Enabled | Whether the object was synchronised from on-premises Active Directory. | {% hint style="info" %} Because the table combines nine different Graph resource types, the properties available beyond the columns above differ from row to row. A deleted user carries the full set of user properties, while an administrative unit or a certificate authority record carries its own. The Extended Info flyout is oriented towards deleted users and shows their contact, licence and synchronisation details, so it will be sparse for the other types. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Restore ObjectReturns the object to the directory with its original identifier, group memberships and licence assignments intact.true
Permanently Delete ObjectRemoves the object from the recycle bin. This cannot be undone.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} Entra ID keeps soft-deleted objects for 30 days, after which they are removed automatically and cannot be recovered. Anything on this page that still matters should be restored before that window closes. {% endhint %} {% hint style="info" %} Restoring a user does not restore their mailbox content by itself. Exchange Online reconnects the mailbox when the account is restored within the retention window and still holds a licence, so check the mailbox afterwards rather than assuming it came back with the account. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Roles Explore and review members for M365 roles This page lists every Entra ID role definition in the tenant along with who currently holds each one, so role assignments can be reviewed in one place rather than role by role in the portal. Roles with no members are listed too, which makes it useful for confirming that a sensitive role is genuinely empty. ## Table Details CIPP builds this table by combining the tenant's role definitions with its role assignments and resolving each assigned principal, so the members appear alongside the role rather than as a separate lookup. | Column | Description | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name of the role. | | Description | What the role grants, as described by Microsoft for built-in roles. | | Members | The users and other principals currently assigned the role, each shown with their sign-in name where they have one. Empty for a role nobody holds. | | Is Built In | Whether the role is one of Microsoft's built-in definitions or a custom role created in the tenant. | {% hint style="info" %} A principal assigned the same role at more than one scope, for example at tenant level and again over an administrative unit, is listed once rather than repeatedly. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Remove MembersOpens a dialog listing the role's current members so one or more can be selected and removed. Greyed out for a role with no members, for custom roles, and without role write permissions.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="info" %} Custom roles cannot have their members removed from this page, because the removal runs against the built-in role definitions and a custom role has no matching template to act on. Manage those assignments in the Microsoft Entra admin center. {% endhint %} {% hint style="warning" %} This page covers Entra ID directory roles. Permissions granted through Exchange Online role groups, Azure resource roles, or Microsoft Purview are held elsewhere and do not appear here, so a review of who holds administrative access needs to take in those as well. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # JIT Admin JIT Admin creates administrative accounts that expire on their own, so temporary elevation does not turn into a permanent standing privilege. Each account is created with a chosen set of roles and an expiry, and CIPP removes the roles or disables the account when the window closes. This page lists the accounts CIPP is tracking, whether they are currently active, and what they were created for. ## Action Buttons {% content-ref url="/pages/MxjcVNJMnMLYxo1jlq8L" %} [Add JIT Admin](/user-documentation/identity/administration/jit-admin/add) {% endcontent-ref %} ## Filters | Filter | Shows | | ----------------- | ----------------------------------------------------------- | | Active JIT Admins | Accounts whose JIT elevation is currently in force. | | Expired/Disabled | Accounts whose elevation has ended or has not been enabled. | ## Table Details | Column | Description | | -------------------- | ------------------------------------------------------------------------------------------------ | | User Principal Name | The sign-in name of the account. | | Display Name | The name of the account. | | Account Enabled | Whether the account itself can sign in, separate from whether its elevation is active. | | Jit Admin Enabled | Whether the JIT elevation is currently in force. | | Jit Admin Start Date | When the elevation was scheduled to begin. | | Jit Admin Expiration | When the elevation ends, at which point CIPP acts on the account. | | Jit Admin Reason | The reason recorded when the account was created, which is what makes the list reviewable later. | | Jit Admin Created By | Who set the elevation up. | | Member Of | The directory roles the account currently holds. | {% hint style="info" %} The JIT columns are not standard Entra ID properties. CIPP stores them in a schema extension on the user object, which is how the elevation details survive between sessions and how the expiry job knows which accounts to act on. An account elevated outside CIPP will not appear here. {% endhint %} {% hint style="info" %} This table has no per-row actions. Elevation is granted from the Add JIT Admin page, and ends automatically at the expiry, so there is nothing to act on from the list itself. {% endhint %} {% hint style="warning" %} Under All Tenants the list is served from a cache rather than queried live. The first time it is opened, CIPP queues a background job to collect the data from every tenant and reports that it is still loading, so come back after a few minutes. Once built, the cache is reused for an hour before a fresh collection runs. Single-tenant views are always live. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add JIT Admin This page grants time-limited administrative access. You choose who gets it, what they get, and when it ends, and CIPP acts on the account automatically at expiry. The result appears on the [JIT Admin](/user-documentation/identity/administration/jit-admin)README.md page for as long as CIPP is tracking it. ## Tenant and template | Field | Description | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Select a tenant to create the JIT Admin in | The tenant the access is granted in. Required, and it has to be chosen before the template list and the tenant's Temporary Access Pass policy can be read. | | JIT Admin Template (optional) | Applies a saved template, filling in the rest of the form. Templates are managed on the [JIT Admin Templates](/user-documentation/identity/administration/jit-admin-templates) page. | {% hint style="info" %} A default template is applied on its own once a tenant is selected. A template marked as the default for that specific tenant wins; failing that, a template marked as the default across All Tenants is used. Anything a template fills in can still be changed before submitting. {% endhint %} ## User **Would you like to create a new user or assign permissions to an existing user?** decides which fields follow. Creating a new account keeps the elevated access separate from someone's day-to-day account, which is usually the point of doing this. | Field | Description | | --------------------- | --------------------------------------------------------------------------------------------------------- | | First Name, Last Name | The new account's name. Shown for a new user. | | Username | The part before the @ symbol. Shown for a new user. | | Domain Name | The domain the account is created under, chosen from the tenant's verified domains. Shown for a new user. | | Usage Location | The country the account is licensed in. Shown for a new user. | | User | The existing account the access is granted to. Shown when assigning to an existing user. | ## Access window | Field | Description | | ---------- | ----------------------------------------------------------------------------------------------------- | | Start Date | When the access begins. Required. | | End Date | When the access ends and the expiration action runs. Required, and it has to be after the start date. | ## Roles and groups **Admin Roles** and **Group Membership** are switches, and each reveals its own selector. At least one entry is required in whichever selector is turned on. | Field | Description | | ------ | -------------------------------------------------------------------------------------------------------------------------------- | | Roles | The Entra ID directory roles to assign for the duration of the access. | | Groups | The groups to add the account to for the duration of the access. | | Reason | Why the access was granted. Required, and it is shown on the JIT Admin list, which is what makes the list reviewable afterwards. | {% hint style="warning" %} Apply least privilege here. Grant the narrowest role that covers the work rather than reaching for Global Administrator, and keep the window as short as the task allows. {% endhint %} ## Temporary Access Pass **Generate TAP** issues a Temporary Access Pass so the account can sign in and satisfy a strong authentication requirement without a registered method. The pass lifetime is worked out from the access window rather than entered, then clamped to what the tenant's policy allows. The form states how long the pass will be valid once both dates are set, and warns before you submit if Temporary Access Pass is not enabled in the tenant, in which case generation fails. {% hint style="info" %} Temporary Access Pass has to be enabled in the tenant's authentication methods policy first. The templates include an "Enable Temporary Access Passwords" standard that turns it on. {% endhint %} ## Expiry and notification | Field | Description | | ------------------- | ------------------------------------------------------------------------------------------- | | Expiration Action | What happens to the account when the window closes. Required. | | Notification Action | How you are told the JIT admin was created: Webhook, Email or PSA. Several can be selected. | The expiration action offers **Delete User** and **Disable User** for any grant. Depending on which switches are on, it also offers **Remove Roles**, **Remove Groups**, or **Remove Roles and Groups**, so the account itself survives and only the elevation is taken away. Changing the switches after choosing clears the selection, since the option may no longer apply. {% hint style="info" %} Notification channels only deliver if they are configured in CIPP's [Notifications](/user-documentation/cipp/settings/notifications) settings first. Selecting one that is not set up produces no notification rather than an error. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # JIT Admin Templates JIT Admin templates hold the settings for a just-in-time admin grant so the same elevation can be requested repeatedly without rebuilding it each time. A template records the roles, duration, expiry behaviour and notification choices, and is then selected on the add.md page. ## Action Buttons
Add JIT Admin Template Links to [Add JIT Admin Template](/user-documentation/identity/administration/jit-admin-templates/add-jit-admin-template)
## Table Details | Column | Description | | ----------------------------- | -------------------------------------------------------------------------------------------------------------- | | Template Name | The name given to the template. | | Default For Tenant | Whether this template is applied automatically when the JIT admin form is opened for the tenant it belongs to. | | Tenant | The tenant the template belongs to, or All Tenants for one available everywhere. | | Default Duration - Label | How long the elevation lasts, which sets the end date on the form. | | Default Roles | The Entra ID directory roles the template assigns. | | Generate TAP By Default | Whether a Temporary Access Pass is issued with the grant. | | Default Expire Action - Label | What happens to the account when the elevation ends. | | Default Notification Actions | Which channels are notified when the grant is created. | | Reason Template | The reason text the template pre-fills, which the requester can then adjust. | {% hint style="info" %} This list is scoped to the tenant selected in the tenant selector, and shows that tenant's own templates alongside any created for All Tenants. Choosing All Tenants narrows the list to the All Tenants templates only, so a template created for one customer will not appear while a different customer is selected. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Edit TemplateOpens the selected template for editing in /pages/7kgWHuVsauPXZ6afwiFp.false
Save to GitHubUploads the template to one of your GitHub repositories, prompting for the repository and a commit message. Only repositories you have write access to are offered. Greyed out unless the GitHub integration is enabled.true
Delete TemplateDeletes the template from CIPP. Grants already created from it are unaffected and still expire as scheduled.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} Only one template should be marked as the default for a given tenant. Where both a tenant-specific default and an All Tenants default exist, the tenant-specific one is applied. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add JIT Admin Template This page creates a JIT Admin template, which stores the settings for a just-in-time admin grant so the same elevation can be requested repeatedly without rebuilding it. Templates are selected on the [Add JIT Admin](/user-documentation/identity/administration/jit-admin/add) page, and everything a template fills in can still be changed before the grant is submitted. {% hint style="info" %} The template is created for the tenant selected in the top menu; there is no tenant field on the form. Select All Tenants before opening this page to create a template available everywhere. {% endhint %} ## Template Information | Field | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Template Name | The name the template is listed under. Required. | | Default for Tenant | Applies this template automatically when the JIT admin form is opened for this tenant. A tenant-specific default takes precedence over an All Tenants default. | ## Default JIT Admin Settings **Admin Roles** and **Group Membership** are switches, and each reveals its own selector. At least one has to be turned on, and the form says so until one is. | Field | Description | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Default Roles | The Entra ID directory roles the template assigns. | | Default Groups | The groups the account is added to. Not available on an All Tenants template, since group identifiers do not carry between tenants. | | Default Duration | How long the elevation lasts, which sets the end date on the JIT admin form. Optional. | | Default Expiration Action | What happens to the account when the elevation ends. Required. | | Default Notification Actions | Which channels are notified when the grant is created: Webhook, Email or PSA. Several can be selected. | | Generate TAP by Default | Issues a Temporary Access Pass with the grant. | | Reason Template | Reason text the template pre-fills, which the requester can adjust. | The duration list offers 1 hour, 4 hours, 8 hours, 1 day, 3 days, 7 days, 14 days and 30 days. A value of your own can be typed instead, in [ISO 8601](https://iso8601.com/) duration format, so `PT2H30M` gives two and a half hours and `P1D` gives a day. The expiration action offers **Delete User** and **Disable User** whatever the switches are set to. It also offers **Remove Roles**, **Remove Groups** or **Remove Roles and Groups**, matching whichever switches are on, so the account survives and only the elevation is taken away. Changing the switches after choosing clears the selection, since the option may no longer apply. ## User Creation Settings **Default User Action** decides whether the template creates a new account or elevates an existing one, and which fields follow. | Field | Description | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Default First Name, Default Last Name | The new account's name. Shown for a new user, and optional. | | Default Username | The part before the @ symbol. Shown for a new user, and optional. | | Default Domain | The domain the account is created under. Shown for a new user, and not available on an All Tenants template. | | Default Usage Location | The country the account is licensed in. Shown for a new user, and optional. | | Default User | The account the elevation is granted to. Shown when the template targets an existing user, and not available on an All Tenants template. | {% hint style="warning" %} An All Tenants template can only create a new user. The Existing User option is not offered, because a specific account exists in one tenant and means nothing in the others. Domain and group selection are withdrawn for the same reason, so an All Tenants template covers the roles, timing and expiry behaviour while the tenant-specific details are supplied when the grant is made. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit JIT Admin Template This page changes a saved JIT Admin template. It is reached from the **Edit Template** action on the [JIT Admin Templates](/user-documentation/identity/administration/jit-admin-templates) page, and opens the template's stored values in the same form used to create one. The fields and the settings that appear for each choice are described on [Add JIT Admin Template](/user-documentation/identity/administration/jit-admin-templates/add-jit-admin-template). Saving overwrites the existing template in place rather than creating a second one, because the template keeps its identifier through the edit. Who created the template and when is preserved, and CIPP additionally records who last modified it. {% hint style="info" %} The template stays with the tenant it was created for. Unlike the Add page, which takes its tenant from the top menu, this page uses the tenant stored on the template, so an All Tenants template shows the All Tenants restrictions even while a specific customer is selected. A template cannot be moved between tenants by editing it. {% endhint %} {% hint style="info" %} Turning on **Default for Tenant** clears the flag from whichever template previously held it for that tenant, so there is no need to unset the old default first. {% endhint %} {% hint style="warning" %} Template names have to be unique within a tenant. Saving a name already used by another template for the same tenant is rejected, and the reason is reported in the result. {% endhint %} {% hint style="warning" %} Only the fields belonging to the selected **Default User Action** are kept. Switching a template from creating a new user to using an existing one discards the stored name, username, domain and usage location, and switching the other way discards the stored user. Change this setting only when you intend to rebuild that part of the template. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Vacation Mode Vacation Mode schedules temporary changes to a user's access and mailbox for a fixed period, then reverses them automatically when the period ends. It covers Conditional Access exclusions, mailbox delegation, mail forwarding and out of office replies, so a single schedule can cover everything that needs to change while someone is away. Each vacation produces a pair of scheduled tasks for every change: one that applies it at the start date and one that reverses it at the end date. This page lists those tasks. ## Vacation Mode In Action {% @storylane/embed subdomain="app" url="" linkValue="d7llhd4j78qv" %} ## Action Buttons
Add Vacation Schedule Opens the add-vacation-schedule.md wizard, where the users, the changes to apply and the dates are chosen.
## Filters | Filter | Shows | | ------------------- | ---------------------------------------------------------------------------------------- | | Running | Tasks currently executing. | | Planned | Tasks scheduled but not yet run, which includes every reversal waiting for its end date. | | Failed | Tasks that did not complete. | | Completed | Tasks that have run successfully. | | CA Exclusion | Tasks that add or remove a Conditional Access policy exclusion. | | Mailbox Permissions | Tasks that grant or revoke mailbox delegation. | | Mail Forwarding | Tasks that set or clear mail forwarding. | | Out of Office | Tasks that enable or disable automatic replies. | ## Table Details | Column | Description | | -------------- | ------------------------------------------------------------------------------------------------------------ | | Tenant | The tenant the task runs against. | | Name | What the task does, including whether it applies or reverses the change and which user or policy it affects. | | Reference | The reference entered when the schedule was created, which ties the tasks of one vacation together. | | Task State | Whether the task is planned, running, completed or failed. | | Scheduled Time | When the task is due to run. | | Executed Time | When the task actually ran. Empty for a task still waiting. | ## Table Actions
ActionDescriptionBulk Action Available
View Task DetailsOpens the /pages/9IEli4WfY24X5AdGicij page for the selected task, showing its full parameters and results.false
Cancel Vacation ModeRemoves the selected scheduled task so it never runs.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="danger" %} Cancelling is per task, not per vacation. Cancelling the task that reverses a change leaves that change in place permanently: an excluded user stays excluded, a delegate keeps their access, forwarding keeps forwarding. To call off a vacation that has already started, cancel the reversal only if you intend the change to be permanent, and otherwise let it run or undo the change by hand. {% endhint %} {% hint style="info" %} Because a vacation is several independent tasks rather than one object, use the **Reference** column to find every task belonging to the same schedule before cancelling anything. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add Vacation Schedule This wizard schedules a set of temporary changes for one or more users and the reversal of each, so a period of absence is set up once and undone automatically. Four kinds of change are available and any combination can be used, but at least one has to be enabled before the wizard will continue. {% stepper %} {% step %} ### Tenant Selection The tenant the changes apply to. This defaults to the tenant selected in the top menu and can be changed here. {% endstep %} {% step %} ### User Selection The users the vacation applies to. Several can be selected, and the changes below are applied to each of them. {% endstep %} {% step %} ### Vacation Actions Four switches, each revealing its own settings. Enable whichever apply. #### Enable CA Policy Exclusion Excludes the selected users from Conditional Access policies for the duration. | Field | Description | | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Conditional Access Policies | The policies to exclude the users from. At least one is required. The list is read from the tenant chosen in step one, so a tenant has to be selected before it populates. | | Exclude from location-based audit log alerts | Suppresses the alerts that would otherwise fire on sign-ins from an unusual location. | | Create temporary travel policy | Creates a named location for the travel destination and a policy that blocks sign-ins from everywhere else, then deletes both at the end date. | | Travel destination countries | The countries the users are travelling to. Required when a travel policy is being created. | {% hint style="warning" %} Excluding someone from a Conditional Access policy allows sign-ins from anywhere, which is a wider gap than the trip usually warrants. The temporary travel policy is there to close it, restricting sign-ins to the destination for the same period. {% endhint %} #### Enable Mailbox Permissions Grants delegates temporary access to the users' mailboxes. | Field | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Delegates | The users receiving access. At least one is required. | | Permission Types | Any combination of `Full Access`, `Send As`, and `Send On Behalf`. At least one is required. | | Auto-Map Mailbox | Lets Outlook add the mailbox on its own for the delegate. Offered with `Full Access`. | | Include Calendar Permissions | Grants access to the calendar as well as the mailbox. | | Calendar Permission Level | The access level on the calendar: `Owner`, `Publishing Editor`, `Editor`, `Publishing Author`, `Author`, `Non Editing Author`, `Reviewer`, `Contributor`, `Limited Details`, or `Available Only`. | | Can View Private Items | Allows the delegate to see items marked private. | #### Enable Mail Forwarding Forwards the users' mail for the duration. | Field | Description | | --------------------------------------------------------- | ------------------------------------------------------------------------------ | | Forward to Internal Address / Forward to External Address | Whether mail goes to another recipient in the tenant or to an outside address. | | External Email Address | The outside address to forward to. | | Keep a Copy of the Forwarded Mail in the Source Mailbox | Delivers the message to the user's own mailbox as well as forwarding it. | {% hint style="warning" %} Forwarding is turned off at the end date rather than returned to how it was. Any forwarding the mailbox had configured beforehand is not restored, so check that first if the user already had a forward set. {% endhint %} #### Enable Out of Office Sets automatic replies for the duration. | Field | Description | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | Internal Message | The reply sent to people inside the organisation. Pre-filled with the mailbox's current message where one is set. | | External Message (optional) | The reply sent to people outside the organisation. | | Block my calendar for this period | Creates a calendar event covering the absence, with a subject of your choosing. | | Automatically decline new invitations during this period | Declines invitations arriving during the absence. | | Decline and cancel my meetings during this period | Declines and cancels meetings already booked, with an optional message to organisers. | {% hint style="info" %} Turning automatic replies off at the end date preserves whatever the message says at that point, so a user who edits their own reply while away does not have it overwritten. {% endhint %} {% endstep %} {% step %} ### Schedule | Field | Description | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scheduled Start Date | When the changes are applied. | | Scheduled End Date | When they are reversed. | | Post Execution Actions | Which channels are notified as the tasks run: Webhook, Email, or PSA. | | Reference | Free text carried onto every task the vacation creates, which is what ties them together on the [Vacation Mode](/user-documentation/identity/administration/vacation-mode) page. | | {% endstep %} | | {% step %} ### Review & Submit A summary of everything selected. Submitting creates the scheduled tasks. {% endstep %} {% endstepper %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Offboarding Wizard Offboard the selected user with standard requirements The Offboarding Wizard applies a standard set of leaver actions to one or more users, either immediately or on a scheduled date. This page lists the offboarding jobs already submitted, and **Start Offboarding** opens the wizard. ## Using the wizard {% stepper %} {% step %} ### Tenant Selection The tenant the users belong to. One tenant at a time, defaulting to the tenant selected in the top menu. {% endstep %} {% step %} ### User Selection The users to offboard. Several can be selected, and every option chosen in the next step is applied to each of them. {% endstep %} {% step %} ### Offboarding Options Three groups of settings, described below. {% endstep %} {% step %} ### Confirmation A summary of everything selected. Submitting creates the offboarding job. {% endstep %} {% endstepper %} {% hint style="info" %} The options are pre-filled from your saved offboarding defaults each time the tenant changes. A tenant with its own defaults takes precedence over your personal ones, and the wizard states which set it has applied at the top of the Offboarding Settings card. You can manage these defaults using [User Preferences](/user-documentation/shared-features/menu-bar/user-settings). {% endhint %} ## Offboarding Settings | Setting | Description | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- | | Convert to Shared Mailbox | Converts the user's mailbox to a shared mailbox, so it can be kept without a licence. | | Hide from Global Address List | Hides the user from address lists. | | Cancel all calendar invites | Cancels upcoming meetings the user organised. | | Remove user's mailbox permissions | Removes the user's access to every other mailbox. | | Remove user's calendar permissions | Removes the user's access to every other calendar. | | Remove all Rules | Deletes the inbox rules on the user's mailbox. | | Remove all Mobile Devices | Removes the mobile devices registered against the mailbox. | | Remove from all groups | Removes the user from every group they belong to. | | Remove Licenses | Strips every licence from the account. | | Revoke all sessions | Invalidates the account's tokens so every device has to sign in again. | | Disable Sign in | Blocks the account from signing in. | | Clear Immutable ID | Clears the on-premises anchor. Only effective once the account is no longer synchronised from Active Directory. | | Reset Password | Sets a new random password. | | Remove all MFA Devices | Removes every registered authentication method. | | Remove Teams Phone DID | Releases the phone number assigned to the user in Teams. | | Disable OneDrive Sharing Links | Revokes the sharing links the user created in OneDrive. | | Delete user | Deletes the account. | {% hint style="warning" %} Deleting the user removes the mailbox with it, so it cannot be combined with converting to a shared mailbox. Where the mailbox needs to be kept, convert it and leave the account in place. {% endhint %} {% hint style="warning" %} Converting a mailbox that is at or near 50 GB may fail, and a converted mailbox over that size stops receiving mail once its licence is removed unless an Exchange Online Plan 2 licence is assigned. The wizard checks the size of the selected mailboxes and warns before you submit. {% endhint %} ## Permissions and forwarding | Setting | Description | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | | Grant Full Access (no automap) | Gives the selected users full access to the mailbox without Outlook adding it automatically. | | Grant Full Access (automap) | Gives full access and lets Outlook add the mailbox on its own. | | Grant Onedrive Full Access | Gives the selected users full access to the user's OneDrive. | | Disable Email Forwarding | Clears any forwarding already set on the mailbox. Turning this on empties the forwarding fields below, since the two work against each other. | | Forward Email To | The recipient the user's mail is forwarded to. | | Keep a copy of forwarded mail | Delivers the message to the offboarded mailbox as well as forwarding it. | | Out of Office Message | The automatic reply set on the mailbox, composed in a rich text editor. | {% hint style="info" %} When the account is being deleted, its OneDrive is retained for 30 days by default, so granting OneDrive access is still worth doing if the contents may be needed. {% endhint %} ## Scheduling & Notifications | Setting | Description | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Schedule this offboarding | Defers the job to a chosen date instead of running it immediately, and reveals the settings below. | | Scheduled Offboarding Date | When the job should run. | | Webhook, E-mail, PSA | Which channels are notified when the job completes. Each has to be configured in CIPP's notification settings to deliver. | | Reference | Free text added to the notification so the job can be recognised later. | {% hint style="info" %} Selecting three or more users turns scheduling on by itself, since a large offboarding is better queued than run against every account at once. The date can still be set to whatever suits. {% endhint %} ## Filters | Filter | Shows | | --------- | -------------------------------- | | Running | Jobs currently executing. | | Planned | Jobs scheduled but not yet run. | | Failed | Jobs that did not complete. | | Completed | Jobs that have run successfully. | ## Table Details | Column | Description | | --------------------- | --------------------------------------------------------- | | Tenant | The tenant the job runs against. | | Parameters - Username | The user being offboarded. | | Task State | Whether the job is planned, running, completed or failed. | | Scheduled Time | When the job is due to run. | | Executed Time | When the job actually ran. Empty for a job still waiting. | ## Table Actions
ActionDescriptionBulk Action Available
View Task DetailsOpens the /pages/9IEli4WfY24X5AdGicij page for the selected job, showing its full parameters and results. Requires scheduler read permissions.false
Run NowRuns the selected job immediately rather than waiting for its scheduled date. Requires scheduler write permissions.true
Delete JobRemoves the job so it never runs. Requires scheduler write permissions.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Reports Reports available within CIPP - Identity Management # MFA Report This report shows how every user in the tenant is protected by multifactor authentication, combining Entra's own registration report with per-user MFA state and Conditional Access coverage. It answers the question a single portal blade cannot: whether a given account would actually be challenged at sign-in, and by what. {% hint style="info" %} The registration and Conditional Access parts of this report need Microsoft Entra ID P1 or higher. Per-user MFA state is reported regardless, so an unlicensed tenant still produces a usable report with those columns empty. {% endhint %} ## MFA Protection Criteria A user is protected when at least one of the following applies. Reading the three together is the point of the report, because each covers a different set of sign-ins. * **Per-User MFA** is set directly on the account, and challenges every sign-in regardless of conditions. * **Covered by Security Defaults** protects the user through Microsoft's baseline settings, which enforce MFA when a sign-in is judged risky. * **Covered by Conditional Access** protects the user through a policy, subject to whatever conditions that policy sets. ## Filters | Filter | Shows | | ----------------------------------- | ---------------------------------------------------------------------------------- | | Enabled, licensed users | Active accounts holding a licence, which is usually the population that matters. | | Enabled, licensed users missing MFA | The same population with no MFA methods registered. This is the list to work from. | | No MFA methods registered | Every account with nothing registered, including disabled and unlicensed ones. | | MFA methods registered | Accounts with at least one method registered. | | Admin Users | Accounts holding a directory role. | ## Table Details | Column | Description | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenant | The tenant the user belongs to. Shown when All Tenants is selected. | | UPN | The user's sign-in name. | | Account Enabled | Whether the account can sign in. | | Is Licensed | Whether the account holds a licence. | | MFA Registration | Whether Entra reports the user as having registered for MFA. | | Per User | The legacy per-user MFA state on the account: enforced, enabled or disabled. | | Covered By SD | Whether Security Defaults are protecting the user. | | Covered By CA | Whether a Conditional Access policy would enforce MFA, distinguishing a policy that covers all applications from one scoped to specific applications. | | MFA Methods | The authentication methods the user has registered. | | CA Policies | The Conditional Access policies evaluated for this user, including whether they were included or excluded and how. | | Is Admin | Whether the user holds a directory role. | | User Type | Whether the account is a member or a guest. | | Cache Timestamp | When the cached report was last refreshed. | {% hint style="warning" %} **Covered By CA** reports that a policy targeting the user is enabled, not that the policy requires MFA under the conditions of a given sign-in. A policy scoped to specific applications leaves everything outside that scope unprotected, which is why the column distinguishes the two cases. Treat "Enforced - Specific Apps" as a prompt to check what the policy actually covers. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Set Per-User MFASets the legacy per-user MFA state to Enforced, Enabled or Disabled, independently of any Conditional Access policy.true
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Inactive Users This report lists accounts that have not signed in for six months or more, so licences sitting on dormant accounts can be found and reclaimed. Both interactive and non-interactive sign-ins are taken into account, and the most recent of the two decides whether an account counts as inactive. {% hint style="info" %} Accounts that have never signed in at all are included, since an account with no sign-in history has by definition not signed in during the period. Days Since Last Sign In is empty for those. {% endhint %} {% hint style="info" %} Disabled accounts and guests are left out. A disabled account is already handled, and guest activity is recorded differently, so including either would add noise to a list meant to drive licence reclamation. {% endhint %} ## Table Details | Column | Description | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenant | The tenant the user belongs to. Shown when All Tenants is selected. | | Tenant Display Name | The tenant's name. | | User Principal Name | The user's sign-in name. | | Display Name | The user's name. | | Last Sign In Date Time | The most recent interactive sign-in, where the user signed in themselves. | | Last Non Interactive Sign In Date Time | The most recent sign-in performed by a client on the user's behalf, such as a mail client refreshing a token. See [Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-noninteractive-sign-ins) for what counts. | | Number Of Assigned Licenses | How many licences the account holds, which is the figure that turns this report into a reclamation list. | | Days Since Last Sign In | How long the account has been dormant, counted from the later of the two sign-in dates. | | Last Refreshed Date Time | When this report was produced. | ## Table Actions
ActionDescriptionBulk Action Available
View UserOpens the full details page for the selected user.false
Edit UserOpens the Edit User page for the selected user.false
Block Sign InBlocks the account from signing in, without removing it or its data.true
Delete UserDeletes the account. Deleted accounts remain recoverable from Deleted Items for 30 days.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} Removing a licence from a dormant account starts a clock on the data attached to it. A mailbox left unlicensed stops receiving mail and is eventually removed, and OneDrive content follows its own retention schedule. Where the data still matters, convert the mailbox to shared or run the account through the offboarding-wizard.md rather than simply stripping the licence. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Sign-in Report This report queries the tenant's sign-in logs directly, so a specific sign-in can be found and examined without leaving CIPP. By default it returns interactive user sign-ins from the last seven days, and the filter card above the table changes what is asked for. {% hint style="warning" %} Sign-in logs require Microsoft Entra ID P1 or higher. Without that licensing Microsoft returns no data, so an empty table means the logs are unavailable rather than that nobody signed in. {% endhint %} ## Filter Options The filter card is collapsed until opened. Changing a value does nothing until **Apply Filter** is selected, at which point the table is re-queried and the card collapses again. | Field | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Days | How far back to look. Defaults to 7. | | Results per page ($top) | How many records to request at a time. Defaults to 500, and lowering it helps when the report is slow to load. | | Sign-In Event Type | Which kinds of sign-in to include: Interactive, Non-Interactive, Service Principal or Managed Identity. Defaults to Interactive, and more than one can be selected. | | User (startsWith UPN) | Narrows to users whose sign-in name begins with the text entered. | | App (startsWith display name) | Narrows to applications whose name begins with the text entered. | | Conditional Access Result | Narrows to sign-ins where Conditional Access returned Success, Failure or Not Applied. | | Error Codes | Narrows to specific sign-in error codes, listed with their meanings. Leave empty to include every result, successful or not. | | Hide Directory Sync Account | Excludes the On-Premises Directory Synchronization Service Account, which otherwise dominates the results on a synchronised tenant. On by default. | {% hint style="info" %} The columns shown depend on the event types selected. User sign-ins show the user principal name, client app and authentication requirement; service principal and managed identity sign-ins show the service principal, application and target resource instead. Selecting both kinds shows the columns for both. {% endhint %} **Save as Preset** stores the current filter as a Graph Explorer preset under a name of your choosing, so a query you expect to run again can be reached from there. The saved preset records the number of days rather than the dates it resolved to, so it stays relative and returns the last seven days whenever it is next run rather than the same week forever. ## Table Details The properties returned are for the Graph resource type `signIn`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/signin?view=graph-rest-beta#properties). ## Table Actions
ActionDescriptionBulk Action Available
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="info" %} The flyout on this page shows the complete sign-in record as raw JSON rather than a summarised list of fields. That is where the detail an investigation needs sits, including the Conditional Access policies evaluated and their individual results, the device and client details, and the full authentication method breakdown. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Microsoft Entra Connect Report This report lists the users, contacts and groups synchronised from on-premises Active Directory together with any provisioning errors Entra ID has recorded against them. Objects carrying an error are the ones to act on: a provisioning error means the object failed to synchronise correctly, commonly because of a duplicate attribute or an invalid value that has to be corrected on-premises. ## Table Details CIPP queries users, contacts and groups separately and combines the results, adding the Object Type column so the rows can be told apart. | Column | Description | | ------------------------------- | -------------------------------------------------------------------------------------------------- | | Display Name | The name of the object. | | Object Type | Whether the row is a User, Contact or Group. | | Created Date Time | When the object was created. | | On Premises Provisioning Errors | The synchronisation errors recorded against the object. Empty for an object synchronising cleanly. | {% hint style="info" %} Sort or filter on **On Premises Provisioning Errors** to bring the objects that need attention to the top, since the table lists every user, contact and group rather than only the ones in error. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Risk Detections This report lists the risk detections Microsoft Entra ID Protection has raised, with the most recent first. Each row is a single detection rather than a user, so one account under investigation may appear several times with different detection types and timings. ## Table Details The properties returned are for the Graph resource type `riskDetection`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-beta#properties). {% hint style="info" %} The **Location** column is a button rather than plain text. Selecting it opens a Location Details dialog plotting the detection on a map, with the city, state and country listed alongside, which is usually the quickest way to judge whether a detection is a genuine anomaly or the user travelling. {% endhint %} ## Filters | Filter | Shows | | --------------------- | --------------------------------------------------------------------------------------------------------- | | Users at Risk | Detections still open and not yet acted on. | | Confirmed Compromised | Detections an administrator has confirmed as a genuine compromise. | | Confirmed Safe | Detections an administrator has marked as legitimate activity. | | Remediated | Detections resolved by the user meeting a remediation requirement, such as a self-service password reset. | ## Table Actions
ActionDescriptionBulk Action Available
Research Compromised AccountOpens the /pages/EGPbyWqFtAVEtdgnFb5i tab for the account the detection relates to, where the usual indicators of compromise are gathered in one place.false
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="info" %} Risk state is held against the user rather than the individual detection, so marking a user as safe or compromised in Entra ID Protection changes the state shown on every detection for that account. The [Risky Users](/user-documentation/identity/administration/risky-users) page is where a user's overall risk is reviewed and dismissed. {% endhint %} {% hint style="warning" %} Entra ID Protection needs Entra ID P2 licensing to report detections in full. Tenants without it see limited or no detection data, so an empty table means the feature is unavailable rather than that no risk was detected. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Tenant Administration # Administration # Tenants View and manage your Microsoft 365 CSP tenants. {% hint style="warning" %} When you select one of the portal links, the permissions of the currently logged in user are the ones that matter. The user's GDAP permissions will apply, not the CIPP service account. {% endhint %} Lists every tenant CIPP manages and gives you a one click jump into each Microsoft administration centre for that customer. The portal links open in the context of the selected tenant using your own partner credentials, so you land in the target administration centre already scoped to that customer rather than having to switch context manually. Alongside the links, the row actions cover the tenant level maintenance tasks: editing the tenant's alias and group membership, managing its configuration backup schedule, and clearing its cached capability data. Tenants are served from CIPP's own cache rather than being read from Partner Center on every page load. If a newly added tenant is missing, or the display name or default domain looks out of date, clear the tenant cache from the Cache card in [Application Settings](/user-documentation/cipp/settings) using the **Clear Cache** button with **Only Clear the Tenant Cache** enabled. That queues a tenant refresh in the background. Refreshing your browser afterwards is worth doing so the page picks up the new data. ## Table Details | Column | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The tenant's name as it appears in Microsoft 365. If you have set a tenant alias, that alias is shown instead. | | Default Domain Name | The tenant's default domain, used throughout CIPP as the tenant identifier. | | M365 | Opens the Microsoft 365 admin center for the tenant. | | Exchange | Opens the Exchange admin center for the tenant. | | Entra | Opens the Microsoft Entra admin center for the tenant. | | SharePoint | Opens the SharePoint admin center for the tenant. Unlike the other portals, the SharePoint admin host name cannot be derived from the tenant, so the first use resolves it through Graph and caches it for later. | | Teams | Opens the Teams admin center for the tenant. | | Azure | Opens the Azure portal for the tenant. | | Intune | Opens the Intune admin center for the tenant. | | Security | Opens the Microsoft Defender portal for the tenant. | | Purview | Opens the Microsoft Purview portal for the tenant. | | Power Platform | Opens the Power Platform admin center for the tenant. | | Power BI | Opens the Power BI admin portal for the tenant. | {% hint style="info" %} A tenant that repeatedly fails to return data from Graph accumulates errors against its record and is eventually dropped from the standard tenant list. If a tenant you expect to see is missing entirely, check its relationship health and permissions before assuming it is a caching problem. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Edit TenantOpens the /pages/1ZV3BhClz8uInwOqOfzK page, where you can set a tenant alias, manage tenant group membership, define custom variables, and configure offboarding defaults.false
Configure BackupOpens the /pages/ZKgu0M3X1z3NlVCg1T5F page for the tenant, where you can review the backup schedule, choose which components are included, and trigger a backup.false
Delete Capabilities CacheClears the cached licence capability data CIPP holds for the tenant, so the next request re-evaluates what the tenant is licensed for. Useful after a licence change has not yet been reflected in CIPP. You are asked to confirm before the cache is removed.true
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Tenant Groups Lists your custom tenant groups and gives you the tools to create and maintain them. Tenant groups are logical groupings of managed tenants that can be selected anywhere CIPP asks for a tenant filter, which saves you picking the same set of tenants by hand every time. A group is either static, where you choose its members explicitly, or dynamic, where CIPP evaluates a set of rules against your tenants and works out the membership for you. ## Action Buttons
Add Tenant Group Opens a flyout to create a new tenant group. Set the group name, description, and group type, then either pick the initial member tenants for a static group or build the membership rules for a dynamic group. Dynamic groups also offer the option to exclude the partner tenant from the group even when the membership rules would otherwise include it. The fields are the same as those on the edit page, so see edit.md for the full detail on configuring a group.
Show Usage / Hide Usage Toggles the Usage column in the table. Leaving it off keeps the page quicker to load, since working out usage means reading through your templates, tasks, rules, roles, and mappings. See the Usage entry under Table Details for what it reports.
Create Default Groups Creates a predefined set of dynamic tenant groups provided by CIPP, intended as ready made starting points for standards templates. Any group whose name already exists is skipped rather than overwritten, so it is safe to run more than once. You are asked to confirm before the groups are created. | Name | What it matches | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | Not Intune and Entra Premium Capable | Tenants with neither a Microsoft Intune service plan nor a Microsoft Entra ID P1 service plan available. | | Business Premium License available | Tenants with at least one Microsoft 365 Business Premium licence available, including the no Teams, EEA, and donation variants. | | Entra Premium Capable, Not Intune Capable | Tenants with a Microsoft Entra ID P1 service plan available but no Microsoft Intune service plan. | | Entra ID Premium and Intune Capable | Tenants with both Microsoft Intune and Microsoft Entra ID P1 service plans available. | | All Tenants (Excluding Partner) | Every tenant managed through a GDAP or direct relationship, with the partner tenant itself excluded. |
View Logs Opens a flyout showing CIPP's own log entries for tenant group activity, covering things like dynamic rule runs, group creation, and any failures encountered while processing them.
## How to Make a Dynamic Tenant Group {% @storylane/embed subdomain="app" url="" linkValue="idk6ryipa9ch" %} ## Table Details | Column | Description | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | The name of the group. | | Description | The description set for the group. | | Group Type | Whether the group is `static`, with membership you set explicitly, or `dynamic`, with membership evaluated from rules. | | Members | The tenants currently in the group. For a dynamic group this reflects the last rule evaluation rather than a live check. | | Usage | Where the group is currently referenced elsewhere in CIPP, naming each item and how it is used. Covers standards templates, scheduled tasks, alert rules, custom roles, custom data mappings, and the rules of other dynamic groups. Only shown when Show Usage is toggled on. | {% hint style="info" %} Check the Usage column before deleting a group. A group that is still referenced by a standards template or a custom role will leave that reference pointing at nothing once removed. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Edit GroupOpens the edit.md page for the selected group, where you can change its name, description, and membership or rules.false
Run Dynamic RulesForces an immediate re-evaluation of the group's membership rules rather than waiting for the next scheduled run. Only offered on groups with a dynamic group type. You are asked to confirm before the rules are run.true
Delete GroupPermanently removes the selected group. You are asked to confirm before the group is deleted.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Edit Tenant Group Tenant groups let you organise your tenants into named collections that can be targeted elsewhere in CIPP. The Edit Tenant Group page is where you create a new group or change an existing one. Every group is one of two types: **Static**, where you choose the member tenants by hand, or **Dynamic**, where membership is resolved automatically from rules you define. The Group Type you select controls which settings appear on the rest of the page. ## Properties These settings apply to every group, regardless of type. | Setting | Description | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Group Name | The name for the group. Required, and must be at least two characters long. | | Group Description | An optional description recording the purpose of the group. | | Group Type | Choose Static to pick member tenants by hand, or Dynamic to build membership from rules. This choice determines which settings appear below. | ## Static Group Members Shown when Group Type is set to Static. Select one or more tenants from the picker to make up the group. A static group contains exactly the tenants you choose here and does not change until you edit it. ## Dynamic Group Rules Shown when Group Type is set to Dynamic. A dynamic group has no fixed member list; instead, CIPP evaluates the rules you define and includes every tenant that matches. | Setting | Description | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Exclude Partner Tenant from this group | When enabled, your own partner tenant is kept out of the group even if it would otherwise match the rules. | | Rule Logic | Determines how multiple rules combine. AND requires a tenant to match every rule to be included; OR includes a tenant that matches any single rule. | | Rules | Each rule is made up of a Property, an Operator, and a Value. Add as many rules as you need and remove any you no longer want. The operators and the type of value input available change depending on the property you select. | ## Rule Properties The following properties can be used to build dynamic membership rules. The value input and the operators available depend on the property selected. | Property | Description | Value Input | Available Operators | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | | Available License | Matches tenants that have the selected licence available. | Licence dropdown | Equals, Not Equals, In, Not In | | Available Service Plan | Matches tenants that have the selected service plan available. | Service plan dropdown | Equals, Not Equals, In, Not In | | Delegated Access Status | Matches tenants by how you have access to them. | Dropdown: Granular Delegated Admin Privileges or Direct Tenant | Equals, Not Equals | | Member of Tenant Group | Matches tenants that belong, or do not belong, to another tenant group, letting you compose groups from other groups. | Dropdown of existing tenant groups (dynamic groups are labelled as such) | In, Not In | | Custom Variable | Matches tenants by the value of a custom variable. | Variable Name and Expected Value fields | Equals, Not Equals, Contains, Does Not Contain | | GDAP Relationship Age (days) | Matches tenants by how many days old their GDAP relationship is. | Number of days | Greater Than, Greater Than or Equal, Less Than, Less Than or Equal, Equals, Not Equals | ## How Dynamic Membership Is Evaluated CIPP re-evaluates dynamic groups on a schedule and updates their membership automatically. When it does: * Rules are combined using the Rule Logic setting (AND or OR). * GDAP Relationship Age is measured from the activation date of the tenant's oldest active GDAP relationship, so the age does not reset when a newer or replacement relationship is later accepted. Terminated and expired relationships are ignored. Tenants with no active GDAP relationship are never matched by an age rule, so direct tenants will not fall into a "younger than" group. * Member of Tenant Group rules are resolved against current group membership, so a group can build on the results of another group. ## Saving Select Save to write your changes. For a static group this stores the member list you selected; for a dynamic group it stores the rule set and logic, and membership is resolved automatically from that point forward. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Global Variables Global variables are key-value pairs that can be used to store additional information for All Tenants. These are applied to templates in standards using the format %variablename%. If a tenant has a custom variable with the same name, the tenant's variable will take precedence. These variables can be used in any type of template and will be replaced automatically. Tenant custom variables can be set in the [Edit Tenant](/user-documentation/tenant/manage/edit#custom-variables) box, shown while editing a Tenant. {% hint style="danger" %} Given the differences in how various systems treat the variable name, we recommend using all lowercase when naming variables, e.g. variablename. {% endhint %} ## Automatically Replaced Variables The following variables will be automatically replaced by CIPP: * `%initialdomain%` * `%tenantfilter%` * `%tenantid%` * `%tenantname%` ## Reserved Variables The following variables are reserved and will not be used: * `%cippurl%` * `%cippuserschema%` * `%defaultdomain%` * `%partnertenantid%` * `%programdata%` * `%programfiles%` * `%programfiles(x86)%` * `%samappid%` * `%serial%` * `%systemdrive%` * `%systemroot%` * `%temp%` * `%userdomain%` * `%username%` * `%userprofile%` * `%windir%` ## Unresolved Variables CIPP replaces only the variables that exist for the tenant being processed, which is the global set combined with that tenant's own variables. A variable that has neither a global value nor a tenant value is not resolved, and nothing blocks or validates the template beforehand. The token is left in place as the literal text `%variablename%` and is sent to Microsoft Graph exactly as written. Graph rejects the malformed value, so the standard fails for that tenant and the failure is recorded in the Standards logs for that tenant only. Tenants that do have a value for the variable continue to deploy normally, which is why this typically shows up as a template that works everywhere except for a handful of tenants. When you see an unexpected Graph error on a Standards deployment, check that every tenant in scope has a value for each variable the template uses. {% hint style="warning" %} Always give a variable a global value when it is used in a template deployed through Standards, even if you intend every tenant to override it. The global value acts as a fallback, so a tenant that has not been given its own value still deploys a valid value instead of failing. Choose a global default that is safe to apply to any tenant, because it is used wherever a tenant-specific value is missing. {% endhint %} The reserved variables listed above behave differently: they are deliberately passed through untouched so the target system can resolve them, and they are not a sign of a missing value. {% hint style="info" %} If you want to see how to combine Custom Variables and Tenant Groups to provide a way to "graduate" tenants through standards, see Using Custom Variables to Manage Standards Templates. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Alert Configuration Alerts in CIPP come in two flavours, and both are listed here. Audit log alerts watch the Microsoft 365 audit log and fire as matching entries arrive. Scripted alerts run on a recurring schedule and check a specific condition each time they execute. This page shows every configured alert rule of both kinds, with the tenants they cover and what happens when they trigger, and lets you edit, clone or remove them. ## Action Buttons Use [Add Alert](/user-documentation/tenant/administration/alert-configuration/alert) to create a new alert rule of either type. ## Table Details | Column | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenants | The tenants or tenant groups the alert is scoped to. | | Event Type | Whether the rule is an audit log alert (`Audit log Alert`) or a scripted alert that runs on a schedule (`Scheduled Task`). | | Conditions | For audit log alerts, the configured conditions written out in plain language, joined with "and" when more than one is set. For scripted alerts, the name of the alert being run. | | Repeats Every | How often the alert runs. Audit log alerts show `When received`, as they fire as matching log entries arrive; scripted alerts show their configured recurrence. | | Actions | What CIPP does when the alert triggers. For audit log alerts this is the list of chosen response actions, such as generating a ticket or disabling the user in the log entry. For scripted alerts it is the configured delivery method. | | Alert Comment | The optional free-text comment saved with the alert. | | Excluded Tenants | Any tenants or tenant groups left out of the alert's scope. | {% hint style="info" %} Excluded tenants only apply where the alert is scoped broadly, such as to all tenants or to a tenant group. A scripted alert that names its tenants individually has nothing to exclude, so this column stays empty. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
View Task DetailsOpens the underlying scheduled task, showing its run history and results. Only available for rows with an Event Type of Scheduled Task.false
Edit AlertOpens the alert for editing so its tenants, conditions, schedule and actions can be adjusted and saved back over the existing rule.false
Clone & Edit AlertOpens a copy of the alert for editing, saving it as a new rule and leaving the original untouched. Useful for applying the same alert to a different set of tenants.false
Delete AlertRemoves the alert rule after confirmation. The alert stops firing immediately and cannot be recovered.true
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Add Alert Manage scheduled tenant alerts. CIPP offers a set of alert checks that run against your tenants and notify you through your configured channels. Some duplicate Microsoft Alerts functionality in a more MSP-friendly manner, and some are not available as a Microsoft Alert at all. Similar to standards, you choose the alert type, select one or more tenants or tenant groups, configure the criteria, then decide how you want to be notified. {% hint style="info" %} This same page is used for the Edit Alert and Clone & Edit Alert actions, with the selected alert's configuration loaded in for you to review, alter and save. {% endhint %} ## Alert Types Within CIPP, there are two types of alerts. Choose one of the two cards at the top of the page to reveal the matching form. * **Audit Log Alert** - Creates an alert based on a received Microsoft audit log entry. * **Scripted CIPP Alert** - Creates an alert based on data processed by CIPP, pulling from sources other than the audit logs. ## Alert Timing * **Audit Log Alerts** - Processed in near real-time, but a small delay of up to 15 minutes is normal. * **Scripted CIPP Alerts** - Each alert comes with a default recurrence suggested by the CIPP team, which you can adjust as needed. The available recurrences are every 30 minutes, hour, 4 hours, day, 7 days, 14 days, 21 days, 30 days or 365 days. ## Tenant Selector Both alert types share the same tenant scoping card. | Field | Description | | -------------------------- | --------------------------------------------------------------------------------------------------- | | Included Tenants for alert | The tenants, tenant groups or \*All Tenants the alert applies to. At least one entry is required. | | Excluded Tenants for alert | Optional. Tenants selected here are skipped even if they fall within the included tenants or group. | ## Alert Criteria The criteria card changes depending on which alert type you selected. ### Audit Log Alert | Field | Description | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Select an alert preset, or customize your own | Loads a ready-made set of conditions for a common scenario. Once loaded, the conditions can still be edited, or you can skip the preset and build the alert from scratch. | | Select the log source | The audit log the alert watches, either Azure AD or Exchange. This determines which properties are offered in the condition builder. Required. | Use **Add a condition** to build the rule. Each condition is a property, an operator and an input value, and multiple conditions are combined, so the alert only triggers when all of them match. The delete icon at the end of a row removes that condition. | Field | Description | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Select property | The audit log property to test. The list is driven by the chosen log source. You can also type a property that is not in the list to create a custom one, which is treated as a text value. | | is | The comparison to apply: `Equals to`, `Not Equals to`, `Like`, `Not like`, `Does not match`, `Greater than`, `Less than`, `In`, or `Not In`. | | Input | The value to compare against. This is a free-text box for most properties, a picker when the property has a known set of values, and a multi-value picker when the operator is In or Not In. | ### Scripted CIPP Alert | Field | Description | | -------------------------------- | -------------------------------------------------------------------------------------------------------------- | | What alerting script should run | The CIPP alert check to run. See [#available-alerts](#available-alerts "mention") for the full list. Required. | | When should the alert run | How often the check repeats. Required. | | When should the first alert run? | The date and time of the first run, with the recurrence counted from there. | Some alert scripts need extra information, such as a threshold value or a list of items to watch. Any additional fields appear beneath the recurrence options once you have selected the script and are labelled by the script itself. ## Notification Settings ### Actions to take Required for both alert types, and the available options differ. For a **Scripted CIPP Alert**, this is how the alert is delivered: * Webhook - Delivers a JSON payload to the webhook configured in [Notifications](/user-documentation/cipp/settings/notifications). * PSA - Delivers a formatted payload to the PSA configured in [Notifications](/user-documentation/cipp/settings/notifications). * Email - Delivers an HTML-formatted table to the email address provided in [Notifications](/user-documentation/cipp/settings/notifications). For an **Audit Log Alert**, this is what CIPP does when a matching log entry arrives, and it can include remediation as well as notification: * Execute a BEC Remediate - Runs the business email compromise remediation against the user in the log entry. * Disable the user in the log entry - Immediately disables the account named in the matching log entry. * Generate an email - Sends an email notification. * Generate a PSA ticket - Raises a ticket in the configured PSA. * Generate a webhook - Sends the alert to the configured webhook. {% hint style="warning" %} Execute a BEC Remediate and Disable the user in the log entry act on the tenant without further confirmation. Test the conditions on a narrow scope before applying them broadly. {% endhint %} ### PSA Ticket Strategy Shown for scripted alerts when PSA is one of the selected actions. It overrides the HaloPSA Link Tickets to affected Users toggle for this alert only, which is handy for wide alerts such as users without MFA where you want to control how many tickets are raised. | Option | Description | | ---------------------------------- | ------------------------------------------------------------- | | One ticket per affected user | Raises a separate ticket for each user returned by the alert. | | One consolidated ticket per tenant | Raises a single ticket per tenant listing every result. | Whichever option matches your current HaloPSA integration setting is labelled as the integration default. ### Custom Subject Overrides the default notification subject with your own text. The value is prefixed with the tenant default domain name for easier filtering, giving `$TenantDomain - $CustomSubject`. Leave it blank to use the default subject format. ### Alert Comment Free-text information to carry with the alert, such as documentation links, FAQ references or instructions for whoever picks it up. Variable replacement is supported, including `%tenantfilter%`, `%tenantname%`, `%resultcount%` for the number of results that triggered the alert, and any custom variables you have defined. Once the criteria and notification settings are complete, **Save Alert** on the Notification Settings card writes the alert. The button stays disabled until every required field is valid. ## Setting Up an Audit Log Alert {% @storylane/embed subdomain="app" url="" linkValue="6wxwpjesdsrx" %} ## Setting Up A CIPP Scripted Alert {% @storylane/embed subdomain="app" url="" linkValue="9r1i7cklndrq" %} ## Available Alerts You can review the available alerts embedded below or navigate to . {% @cipp-external-webpage-block/cyberdrain url="" fullWidth="true" %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Snoozed Alerts Alert snoozes let you suppress a single noisy result from a scripted CIPP alert without disabling the alert itself. A snooze is scoped to one specific item in one tenant, so the rest of the alert keeps reporting as normal. This page lists everything currently snoozed so you can review it and lift a snooze early. ## Snoozing Alerts Snoozes are set from the alert results, not from this page. There are two routes: * **From an alert email** - Each result in the notification carries its own set of snooze buttons for 7, 14, 30 or 90 days. Clicking one opens CIPP and applies the snooze straight away, with no reason recorded, then offers a link back to this page. * **From the dashboard** - The Alerts overview card has a snooze action per result, which opens a dialog offering 7, 14 or 30 days along with an optional free-text reason. {% hint style="info" %} A snooze is matched on the content of the alert item, not just the user or object name. If the underlying detail changes, CIPP treats it as a new item and it will alert again even though a snooze exists for the earlier version. {% endhint %} ## Table Details | Column | Description | | --------------- | ---------------------------------------------------------------------------------------------------- | | Cmdlet Name | The alert check the snooze applies to. | | Tenant | The tenant the snoozed item belongs to. A snooze never applies across tenants. | | Content Preview | A short summary of the specific result that was snoozed, typically the user or object it relates to. | | Snooze Reason | The optional reason recorded when the snooze was set. Empty for snoozes applied from an alert email. | | Snoozed By | The CIPP user who set the snooze. | | Status | `Active` while the snooze is in effect, and `Expired` once it has run out. | | Remaining Days | Whole days left before the snooze expires, rounded up. Shows `0` once expired. | {% hint style="info" %} Expired snoozes stay listed until they are removed. They no longer suppress anything, so they are safe to leave in place, but clearing them keeps the list readable. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
Remove SnoozeRemoves the snooze after confirmation, so the alert fires again for that item on its next run.true
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Audit Logs View captured Audit Logs from the Alerts Wizard. CIPP stores a copy of any audit log entry that matches an Audit Log Alert rule, so you keep a durable record even after the entry ages out of the tenant. This page lists those saved entries and lets you open any of them in full. Entries are only captured going forward from the point an alert rule exists, so nothing appears here for a rule that has not yet matched. ## Search Options The Search Options panel controls the time window the table covers. It defaults to the last 7 days. | Field | Description | | ---------------- | --------------------------------------------------------------------------------------------------------- | | Date Filter Type | Choose `Relative` to look back a set amount of time from now or `Start / End` to specify an exact window. | | Last | Shown for a relative filter. The number of hours or days to look back. | | Interval | Shown for a relative filter. Whether the number above counts Hours or Days. | | Start Date | Shown for a start and end filter. The beginning of the window. | | End Date | Shown for a start and end filter. The end of the window. | Select **Apply Filters** to reload the table for the chosen window. Use the table's own filter and search to narrow the results further. ## Table Details | Column | Description | | --------- | ------------------------------------------------------------------------------------------------------------------- | | Timestamp | When the original event occurred in the tenant, taken from the raw audit record rather than the time CIPP saved it. | | Tenant | The tenant the entry was captured from. | | Title | A short summary of what the alert matched, generated when the entry was processed. | {% hint style="info" %} The table respects the tenant selected at the top of CIPP. Choose All Tenants to see captured entries from every tenant in one list. {% endhint %} ## Table Actions
ActionDescriptionBulk Action Available
View LogOpens the full structured view of the selected entry, including the raw audit record, any actions CIPP took, and geolocation for the originating IP address where one is available.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # View Audit Log Opening a saved log gives you the complete picture of a single captured event: what CIPP matched on, what it did in response, and the raw audit record straight from Microsoft. The heading at the top of the page is the entry's title, the same one shown in the Saved Logs table. **Back** returns you to wherever you came from, which keeps your place in the table and its filters. ## Log Information A summary of the event and how CIPP handled it. | Field | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | Timestamp | When the event occurred in the tenant, taken from the raw audit record. | | Tenant | The tenant the entry was captured from. | | User | The account the event relates to. CIPP resolves this from the audit record, preferring a readable user name where the record only carried an object ID. | | IP Address | The client IP address recorded against the event, where one was present. | | Actions Taken | The response actions CIPP ran when the alert matched, such as disabling the user or raising a ticket. Shows `N/A` when the rule was notification only. | | Webhook Rule | The alert condition that matched this entry, written out in the same plain language used on the alert itself. | Some entries also carry a button in the top right of this card, which jumps straight to the most useful follow-up in CIPP. A BEC alert, for example, links through to the compromise review for the affected user. The button only appears when the alert supplied one. ## Location Information Shown when an IP address could be determined for the event, either from the audit record or from location data captured at the time. The card is headed with the IP address being looked up. A map pins the approximate location, and the panel beside it lists the organisation, city, region, country and postcode returned by the lookup. Selecting the map marker reveals further detail, including the time zone, the autonomous system, and whether the address is known to be a proxy, a hosting provider or a mobile network. {% hint style="info" %} Geolocation is an estimate based on IP registration data. Treat it as a signal rather than proof of where someone was, particularly for mobile and hosting addresses. {% endhint %} ## Audit Data Everything else from the raw audit record, laid out as a property list. The exact set of properties varies with the type of event, since this is Microsoft's own record rather than something CIPP shapes. Values are translated into readable text wherever CIPP has a mapping for them, so numeric result codes and internal identifiers appear as their meanings rather than their raw values. Properties that CIPP added while processing the alert are left out here, as they are already presented above. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Log Searches CIPP collects audit logs by planning a series of 60-minute search windows per tenant, then working each one through to completion: creating the search in Graph, polling it, downloading the records and processing them against your alert rules. This page is the ledger of those windows, so you can confirm coverage is unbroken and spot any window that failed. It is the everyday view; the advanced Search Coverage tab carries the full diagnostic detail. ## Search Options The Search Options panel controls how far back the ledger is shown, filtered on each window's start time. It defaults to the last 48 hours. | Field | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------- | | Date Filter Type | Choose `Relative` to look back a set amount of time from now, or `Start / End` to specify an exact window. | | Last | Shown for a relative filter. The number of hours or days to look back. | | Interval | Shown for a relative filter. Whether the number above counts Hours or Days. | | Start Date | Shown for a start and end filter. The beginning of the range. | | End Date | Shown for a start and end filter. The end of the range. | Select **Apply Filters** to reload the ledger for the chosen range. ## Search Health Beneath the Search Options panel, a row of chips summarises the windows currently in view: * **All log searches healthy** - No window in the range has failed permanently. Replaced by a count of windows that failed permanently when any have. * **Currently searching** - How many windows are still in progress, meaning they are planned or created but not yet downloaded. * **Skipped (auditing off)** - How many windows were skipped because unified auditing is not enabled for the tenant. Only shown when there are any. {% hint style="warning" %} Skipped windows mean no audit data was collected for that period, and it cannot be recovered later. If a tenant is showing skipped windows, enable unified auditing on that tenant before the gap grows. {% endhint %} ## Table Details | Column | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tenant | The tenant the search window belongs to, shown as its default domain name. | | Type | The kind of ledger entry: `Window` for a normal planned 60-minute search window, `Reconciliation` for a gap-fill block, or `Manual` for a manually queued search bridged into the pipeline. | | Window Start | Start of the search window, in UTC. | | Window End | End of the search window, in UTC. | | State | Where the window sits in the pipeline: `Planned`, `Created`, `Downloaded`, `Retry`, `DeadLetter` (failed permanently) or `Skipped` (unified auditing off for the tenant). | | Search Status | The underlying Graph audit log search status, such as `notStarted`, `running` or `succeeded`, refreshed on each poll. | | Record Count | Number of audit records the window's Graph search returned and downloaded. | | Matched Count | Number of downloaded records that matched an alert rule during processing. | | Last Error | The most recent error recorded for the window. Blank when healthy. | {% hint style="info" %} The ledger honours the tenant selector at the top of CIPP. Choose All Tenants to review coverage across your whole estate at once. {% endhint %} To queue a search of your own rather than wait for the scheduled windows, use the Manual Searches tab. *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Manual Searches Alongside the search windows CIPP runs automatically, you can queue an audit log search of your own against a specific tenant, time range and set of filters. This is the tool for investigations: chasing a suspected compromise, answering a client's question about who deleted a file, or checking activity for a period before your alert rules existed. This page lists the searches you have queued, and lets you review the records they returned or push them through your alert rules. {% hint style="info" %} Only searches queued in the last 7 days are listed. Older searches age out of CIPP's tracking even if the query still exists in the tenant. {% endhint %} ## Action Buttons **New Search** opens the Create New Audit Log Search flyout. Complete the fields, then select **Create Search** to queue it, or **Cancel** to discard. | Field | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Search Name | A name for the search, used to identify it in the table afterwards. Required. | | Tenant | The tenant to search. Defaults to the tenant currently selected in CIPP. Required. | | Start Date & Time | The beginning of the period to search. Required. | | End Date & Time | The end of the period to search. Required. | | Record Types | Restricts the search to particular categories of audit record, such as Exchange Admin, SharePoint File Operation or Microsoft Teams. Leave empty to search all types. | | Keywords | Free text to search for across the non-indexed parts of the audit records. Enter each term separately. | | Operations | The specific activities to look for, such as Hard Delete, New Inbox Rule or Anonymous Link Created. Choose from the list or type your own if the operation you need is not offered. | | User Principal Names | Restricts the search to activity performed by particular users. | | IP Addresses | Restricts the search to activity originating from particular addresses. | | Object IDs | Restricts the search to particular objects. For SharePoint and OneDrive this is the full path of the file or folder; for Exchange admin activity it is the name of the object that was changed. | | Administrative Units | Restricts the search to records tagged with the chosen administrative units in the tenant. | | Process Logs for Alerts | Stores the search so its results can be run through your alert rules. Leave off for a purely investigative search. | {% hint style="info" %} Every filter you add narrows the search further, so start broad and tighten from there. A search with no filters beyond the date range returns everything in the window, which is slow but occasionally what you want. {% endhint %} Searches are not instant. Microsoft queues the query and works through it in the background, so a newly created search sits at `notStarted` or `running` for a while before its records become available. ## Table Details The properties returned are for the Graph resource type `microsoft.graph.security.auditLogQuery`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/security-auditlogquery?view=graph-rest-1.0#properties). ## Table Actions
ActionDescriptionBulk Action Available
View ResultsOpens the /pages/rVVrLH6TSj3hbwUQHDfn for the selected search. Only useful once the search has reached a status of succeeded.false
Process LogsRuns the search results through your alert rules after confirmation, generating alerts for anything that matches. Nothing happens for records that match no rule.true
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Search Results Opening a manual search shows the audit records it returned, straight from the tenant. The heading is the name you gave the search, falling back to the search ID where no name was recorded. Records arrive unsorted, so use the table's own sorting and filtering to work through them. {% hint style="info" %} A search only has records once it has finished running. If the table is empty, check the search's status on the Manual Searches tab: anything still showing `notStarted` or `running` has not completed yet. {% endhint %} ## Action Buttons | Button | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | Back to Searches | Returns you to the audit log searches list. | | Process Logs | Runs these results through your alert rules after confirmation, generating alerts for anything that matches. Records that match no rule are ignored. | ## Table Details The properties returned are for the Graph resource type `microsoft.graph.security.auditLogRecord`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/security-auditlogrecord?view=graph-rest-1.0#properties). ## Audit Log Details Selecting a row opens a flyout with the full record laid out in two sections. The first covers the record itself, and the second expands the audit data payload, which is where the detail specific to that operation lives. CIPP does some work to make the record readable. Object IDs are resolved to the display names of the directory objects they refer to, both as property values and where they appear inside longer strings, with the original identifier available on hover. Any identifier that cannot be resolved is marked as such rather than silently left raw. Where the record carries a client IP address, an approximate geographic location is shown alongside it. ## Table Actions
ActionDescriptionBulk Action Available
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Directory Audits Directory audits are Entra ID's own record of administrative activity in the tenant: role assignments, application consent, user and group changes, policy edits and so on. This page reads that log live from Microsoft rather than from anything CIPP has stored, so it reflects the tenant's current retention period rather than CIPP's history. Entries are listed newest first, and the table honours the tenant selector at the top of CIPP. {% hint style="info" %} This is a live Graph query, so no data appears until a tenant is selected, and the retention available depends on the tenant's Entra ID licensing rather than on CIPP. {% endhint %} ## Table Details The properties returned are for the Graph resource type `directoryAudit`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0#properties). ## Table Actions
ActionDescriptionBulk Action Available
More InfoOpens the Extended Info flyout with the full details for the selected row.false
*** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # Applications # Enterprise Applications Enterprise applications are the service principals present in the selected tenant: every application that has been granted a presence there, including Microsoft first-party services, third-party SaaS apps that users or admins have consented to, and any partner applications such as CIPP's own SAM app. Listing them is the quickest way to audit what has access to a tenant, spot applications carrying client secrets or certificates, and identify leftover integrations from a previous provider. The table is read live from Microsoft Graph each time the page loads, so it always reflects the tenant's current state. {% hint style="info" %} Microsoft first-party service principals make up the bulk of a typical tenant's list. Sort or filter on **Publisher Name** to bring third-party and partner applications to the top. {% endhint %} ## Page Actions **Deploy Template** opens [Application Approval](/user-documentation/tools/tenant-tools/appapproval), where a saved application template can be deployed to one or more tenants. ## Table Details The properties returned are for the Graph resource type `servicePrincipal`. For more information on the properties please see the [Graph documentation](https://learn.microsoft.com/en-us/graph/api/resources/serviceprincipal?view=graph-rest-1.0#properties). The password and certificate credential columns are included so that applications holding secrets or certificates, and their expiry dates, can be reviewed without opening each application in turn. ## Table Actions
ActionDescriptionBulk Action Available
View in CIPPOpens the /pages/i5eDn82GNtdW7ra8rCXl page for the selected enterprise application.false
View ApplicationOpens the selected enterprise application in the Microsoft Entra admin center, in a new tab.false
Create Template from AppCreates a reusable Enterprise App template from the selected application and copies its permissions into a permission set, both named "<application name> (Auto-created)". An option is offered to overwrite an existing template of the same name. Only available for multi-tenant applications; single-tenant applications need a manifest template created from the App Registrations page instead.true
Remove Password CredentialsPrompts you to choose which of the application's client secrets to remove, listed by name and expiry date, then removes only those selected. Only available where the application holds password credentials.true
Remove Certificate CredentialsPrompts you to choose which of the application's certificate credentials to remove, listed by name and expiry date, then removes only those selected. Only available where the application holds certificate credentials.true
Disable Service PrincipalBlocks sign-in to the selected application without removing it or its consent. Only available where the service principal is currently enabled.true
Enable Service PrincipalRestores sign-in for a previously disabled application. Only available where the service principal is currently disabled.true
Delete Service PrincipalRemoves the application from the tenant, revoking its access and any consent granted to it. The app registration in the application's home tenant is not affected.true
More InfoOpens the Extended Info flyout with the full details for the selected row.false
{% hint style="warning" %} Removing credentials, disabling, or deleting a service principal takes effect immediately and will break any integration currently authenticating as that application. Confirm what an application is used for before acting on it, particularly for applications published by your own or another partner organisation. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. # View Enterprise Application This page shows a single enterprise application in detail: its identifiers and publisher, the credentials it holds, who owns it, and the permissions that have actually been granted to it in the tenant. The header carries the application's display name, chips for the Application (client) ID and Object ID that copy to the clipboard when selected, how long ago the service principal was created, and a **View in Entra** link that opens the same application in the Microsoft Entra admin center. ## Page Actions The actions menu offers the same actions as the [Enterprise Applications](/user-documentation/tenant/administration/applications/enterprise-apps#table-actions) table, with the exception of the one that opens this page. All of them act on the application currently in view. ## View Enterprise App Tab ### Enterprise application This card identifies the application. The top of the card shows the display name and whether the service principal is enabled or disabled, followed by the details below. | Field | Description | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Display name | The name of the application as it appears in the tenant. | | Application (client) ID | The application ID, shared by every service principal for this application across all tenants. | | Object ID | The object ID of the service principal, unique to this tenant. | | Sign-in audience | Which account types the application accepts, for example `AzureADMyOrg` for single-tenant or `AzureADMultipleOrgs` for multi-tenant. | | Publisher | The publisher name recorded against the application, where one is set. | | Homepage | The application's home page URL, where one is set. | | Created | When the service principal was created in this tenant. | **Open app registration in CIPP** opens [View App Registration](/user-documentation/tenant/administration/applications/app-registrations/appid) for the same application ID. {% hint style="info" %} An app registration only exists in the tenant that owns the application. For Microsoft services and third-party multi-tenant applications, the registration lives in the publisher's tenant, so the app registration page will not find it. {% endhint %} ### Credentials Two collapsible entries summarise the credentials held by the service principal, one for client secrets and one for certificates. Each shows how many credentials are configured and the next expiry date, taken from the earliest expiry across all credentials of that type. Expanding an entry lists each credential individually by name and expiry date, along with its key ID. Where the credential list is empty, the entry is marked in amber to draw the eye; that is a prompt to check rather than a fault, since most applications legitimately hold no credentials in the tenants they are consented to. Each credential carries its own menu: | Action | Description | | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Rotate | Creates a replacement client secret with the same name and a twelve month lifetime, then deletes the current one. The new secret value is shown once, with a copy button. Client secrets only. | | Remove | Deletes the selected credential immediately, after a confirmation prompt. | {% hint style="warning" %} Rotation deletes the original secret as soon as the replacement is created, so anything still using the old value stops working until it is updated. Copy the new secret before closing the dialogue, as it cannot be retrieved afterwards. Where the tenant enforces an application secret lifetime policy, the twelve month lifetime is shortened to fit and you are told so in the result. {% endhint %} {% hint style="info" %} Credentials cannot be added from this page, only rotated or removed. A certificate removed here has to be uploaded again in Entra. {% endhint %} ### Owners Lists the directory objects that own the service principal, with their display name, user principal name, mail address and object type. **View User** opens the selected owner in CIPP, and is offered only for owners that are users rather than groups or other service principals. Where Graph returns no owners the section says so, and where the owners request fails the error returned by Graph is shown instead. Microsoft first-party service principals routinely have no owners at all. ## Permissions Tab This tab shows what the application has actually been granted in the tenant, read from the service principal's own app role assignments and OAuth2 permission grants. It reflects consent as it stands now, not what the application asks for in its manifest, so a permission the application requests but has never been consented to will not appear here. ### Application permissions App roles assigned to the application for app-only access, grouped by the API that publishes them. Each group is headed by the resource name, its object ID, and the number of permissions granted. Expanding a group lists each permission by name with the description published by that API. ### Delegated permissions OAuth2 permission grants where this application is the client, grouped by resource API in the same way. Scopes are de-duplicated and sorted across all grants for that resource, so a scope granted both tenant-wide and to an individual user appears once. ### Risk indicators Permissions that appear in CIPP's curated set of risky permissions are marked with a coloured bar and a chip reading Critical, High, Medium or Low. Hovering the chip gives the reason the permission is considered risky. Each API group carries a chip of its own showing the highest risk found within it and how many of its permissions are flagged. {% hint style="info" %} The risky-permissions set is a deliberately short list of the permissions most useful to an attacker, and it concentrates on application permissions, so delegated scopes are rarely flagged. A permission without a chip has not been assessed rather than judged safe. {% endhint %} *** ## Feature Requests/Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- [Next Page](/llms-full.txt/1)