Executing the Setup Wizard

This guide walks you through the process of executing the Setup Wizard inside CIPP for the first time. The Setup Wizard presents you with multiple options. If this is your first setup, choose the "First Setup" option.

Getting Started with the CIPP Setup Wizard

1

Begin Setup

Click on "First Setup" to start the configuration process.

2

Application Registration

On this page, you’ll create the necessary Application Registration in your Microsoft 365 environment. This application is used to manage tenant connections.

• Click Authenticate and follow the on-screen instructions to register the application.

• Important: Use the dedicated CIPP service account created during the preparation steps.

If authentication fails, assign Global Administrator to the service account temporarily to ensure sufficient rights to approve all necessary application permissions.

3

Tenant Configuration

Start with "Connect to Partner Tenant", even if you're not a Microsoft Partner. This step is needed regardless of how you plan to connect your tenants.

Authenticating here consents the CIPP-SAM application in your partner tenant (or, if you're not a Microsoft Partner, in the first tenant you designate as the "partner" tenant). That consent is what lets CIPP manage its own credentials and application permissions, such as creating and managing additional API clients. The option to add separate tenants becomes available once a partner tenant is connected.

You'll sign in again here — this is a separate authentication from the previous step, so use the same dedicated CIPP service account. If you're already signed in to another account, your browser may pick it automatically, so it's worth checking the account shown before approving consent. Afterwards, the page displays the connected tenant and user so you can confirm it's correct.

Once the partner tenant is connected, you can also use "Connect to Separate Tenants" to add tenants individually, outside your partner relationship. Repeat that step for each tenant you want to add.

• For these separate tenants, use a service account with equivalent permissions as the partner tenant. More information on these roles can be found under Recommended Roles

4

Select Baselines

Choose from a list of available configuration baselines. These presets help you quickly apply best practices and policies.

• We recommend selecting the CyberDrain Templates for the most optimised standard configurations and receiving templates and examples on how to utilise standards.

5

Configure Notifications

Set up email notifications on the next page.

• Ensure your service account has a mailbox enabled to support email alerts. This can either be a shared mailbox

• You can test notification delivery directly from this screen.

6

Optional Features

The final step presents a list of optional features you can enable to further enhance CIPP’s functionality. Review and configure these as needed. Many of these features are quite powerful and CIPP users often find they greatly enhance their experience and ease the burden of tenant administration.

Common Errors

"Response status code does not indicate success" during Step 2

We have seen Microsoft implement some new secure by design initiatives that are impacting the ability for tenants, especially newly created tenants, from successfully completing the authentication. By default, Microsoft has disabled the ability for Enterprise Applications to add passwords in new tenants. Open up the Entra portal for your tenant. Navigate to Enterprise Applications > Application Policies. View the "Password addition restriction" policy. To remain most secure, leave the policy enabled but set an exclusion for the CIPP-SAM app by selecting "All applications with exclusions" and adding the CIPP-SAM app to the excluded apps list. Wait a bit for the policy to update to apply and then try the Setup Wizard again.