Creating the CIPP Service Account
Last updated
Last updated
Must be a Global Administrator while setting up the integration. These permissions may be removed after the integration has been setup.
Must be added to the AdminAgents group. This group is required for connection to the Microsoft Partner API.
Recommended Roles: When going through the invite process in CIPP, these groups will be automatically created. If you performed the migration with CIPP, these groups will start with M365 GDAP.
Note that these groups are not roles in your tenant; they must be GDAP-assigned groups. For the latest details, refer to Recommended Roles
Don't over-assign GDAP roles. Too many permissions will stop GDAP functionality.
Review Microsoft's GDAP frequently asked questions page for more information.
MFA Setup: This account must have Microsoft MFA enforced for each logon.
Use Conditional Access when available or via Per User MFA when not available.
Microsoft MFA is mandatory. Do not use alternative providers like Duo, and ensure it's setup before any login attempts.
Reference this article on Supported MFA options from Microsoft for more details.
This guide walks you through the process from the video of setting up the CIPP Service Account. Follow the instructions on this page to the letter to ensure a seamless setup process down the line.
To get started, head to the Microsoft Entra Portal's user overview at entra.microsoft.com
Click on the "New user" button.
Create a new internal user in your organization
Enter a username in the field, we recommend something identifiable like "CIPP Service Account"
Enter "CIPP Service Account" in the Display Name field. Set the password to something strong, and save this password in a secure location
Click on "Next: Properties".
Click on "Next: Assignments".
If you are a Microsoft Partner, and want to manage all your client tenants, click on Add Group.
Select the AdminAgents group. This group is required for connection to the Microsoft Partner API.
Select your GDAP groups
If you have already migrated to GDAP you select your GDAP groups at this stage. If you migrated using CIPP these groups start with M365 GDAP, For the latest required GDAP roles check our Recommended Roles page.
Click "Add role"
Add the Global Administrator Role
Find the Global Admin role. This role is required for the CIPP-SAM application creation, and is recommended to be removed directly after installation.
Click "Next: Review + create"
Click on "Create". This creates the account.
