Get CIPPJoin Discord

Creating the CIPP Service Account

Setup Video for the CIPP Service Account

When setting up your Service Account, remember:

Administration Requirements

  1. Must be a Global Administrator while setting up the integration. These permissions may be removed after the integration has been setup.

  2. Must be added to the AdminAgents group. This group is required for connection to the Microsoft Partner API.

GDAP Group Requirements

  1. Recommended Roles: When going through the invite process in CIPP, these groups will be automatically created. If you performed the migration with CIPP, these groups will start with M365 GDAP.

    1. Note that these groups are not roles in your tenant; they must be GDAP-assigned groups. For the latest details, refer to Recommended Roles

  2. Don't over-assign GDAP roles. Too many permissions will stop GDAP functionality.

    1. Review Microsoft's GDAP frequently asked questions page for more information.

Multi-factor Authentication

  1. MFA Setup: This account must have Microsoft MFA enforced for each logon.

    1. Use Conditional Access when available or via Per User MFA when not available.

  2. Microsoft MFA is mandatory. Do not use alternative providers like Duo, and ensure it's setup before any login attempts.

    1. Reference this article on Supported MFA options from Microsoft for more details.

Setup Walkthrough for the CIPP Service Account

This guide walks you through the process from the video of setting up the CIPP Service Account. Follow the instructions on this page to the letter to ensure a seamless setup process down the line.

To get started, head to the Microsoft Entra Portal's user overview at entra.microsoft.com

  1. Click on the "New user" button.

  1. Create a new internal user in your organization

  1. Enter a username in the field, we recommend something identifiable like "CIPP Service Account"

  1. Enter "CIPP Service Account" in the Display Name field. Set the password to something strong, and save this password in a secure location

  1. Click on "Next: Properties".

  1. Click on "Next: Assignments".

  1. If you are a Microsoft Partner, and want to manage all your client tenants, click on Add Group.

  1. Select the AdminAgents group. This group is required for connection to the Microsoft Partner API.

  1. Select your GDAP groups

If you have already migrated to GDAP you select your GDAP groups at this stage. If you migrated using CIPP these groups start with M365 GDAP, For the latest required GDAP roles check our Recommended Roles page.

  1. Click "Add role"

  1. Add the Global Administrator Role

Find the Global Admin role. This role is required for the CIPP-SAM application creation, and is recommended to be removed directly after installation.

  1. Click "Next: Review + create"

  1. Click on "Create". This creates the account.

Last updated