Creating the CIPP Service Account
Last updated
Last updated
When creating your new CIPP Service Account, it's important to remember the following:
Must be a Global Administrator while setting up the integration. These permissions may be removed after the integration has been setup.
Must be added to the AdminAgents group. This group is required for connection to the Microsoft Partner API.
Must have Microsoft multi-factor authentication setup prior to being ready for executing the SAM Wizard either via Conditional Access when available or via Per User MFA when Conditional Access is not available.
You may not use any other authentication provider other than Microsoft for this account. Duo or other providers will not work. See the Supported MFA section of Microsoft's partner tenant security guidelines for further details.
Don't over-assign GDAP roles. Too many permissions will stop GDAP functionality. Review Microsoft's GDAP frequently asked questions page for more information.
Must be added to your GDAP Groups. If you're going through the invite process in CIPP, these will be created for you. If you did the migration previously through CIPP, these would start with M365 GDAP. These groups are not roles in your own tenant. These must be the GDAP assigned groups. For the latest, check the Recommended Roles
This guide walks you through the process from the video of setting up the CIPP Service Account. Follow the instructions on this page to the letter to ensure a seamless setup process down the line.
To get started, head to the Microsoft Entra Portal's user overview at entra.microsoft.com
Click on the "New user" button.
Create a new internal user in your organization
Enter a username in the field, we recommend something identifiable like "CIPP Service Account"
Enter "CIPP Service Account" in the Display Name field. Set the password to something strong, and save this password in a secure location
Click on "Next: Properties".
Click on "Next: Assignments".
If you are a Microsoft Partner, and want to manage all your client tenants, click on Add Group.
Select the AdminAgents group. This group is required for connection to the Microsoft Partner API.
Select your GDAP groups
If you have already migrated to GDAP you select your GDAP groups at this stage. If you migrated using CIPP these groups start with M365 GDAP, For the latest required GDAP roles check our Recommended Roles page.
Click "Add role"
Add the Global Administrator Role
Find the Global Admin role. This role is required for the CIPP-SAM application creation, and is recommended to be removed directly after installation.
Click "Next: Review + create"
Click on "Create". This creates the account.
