Ctrlk
Get CIPPJoin Discord
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Frequently Asked Questions

On this page you can find a list of frequently asked questions about the CyberDrain Improved Partner Portal (CIPP). If you're having specific issues with CIPP please also check the Troubleshooting page.

What benefits do we get with hosted CIPP

Hosted CIPP includes the following:

  • One hosted instance of CIPP

  • Automatic updates and maintenance for the hosted instance

  • Support for a self-hosted or hosted instance

  • Access to our #CIPP-quicksupport channel on our discord server

  • The ability to create feature requests for the product

  • Access to weekly live training sessions for CIPP users

  • API key for Have I Been Pwned & Breach Detection

  • Access to CIPP events such as on-site training events

  • Early access to Graph APIs made available by Microsoft for CIPP users

  • Predictable pricing, no contract lock-in.

I updated, but CIPP still says I am out of date. How do I fix this?

Use a superadmin admin account browse to CIPP -> Advanced -> Container Management -> Status & Updates to arrange auto-update settings.

Is hosted CIPP faster?

Yes. Hosted CIPP is maintained by an expert team of Azure Administrators and runs using different infrastructure than self-hosted CIPP. Hosted CIPP is about 100% faster than self-hosted thanks to ongoing maintenance and better specifications used thanks to scale.

How much does CIPP cost to run?

Assuming you're running on the click-to-deploy configuration and average usage patterns CIPP has a cost of about €25 a month. You can check the costs, and estimated costs, for the resource group on the Azure Portal.

Hosted CIPP is €99/month and comes with unlimited support, weekly live training sessions, and more benefits.

How is hosted CIPP billed?

Hosted CIPP subscriptions are €99/month. New subscriptions use the secure checkout linked in the setup guide, while existing GitHub Sponsors subscribers can continue using that billing path until October 1, 2026.

If you subscribed through Stripe, your billing details and receipt information are provided during checkout and in your confirmation email. If you are still on GitHub Sponsors before October 1, 2026, billing continues through your GitHub account.

If you need help with billing after subscribing, contact helpdesk@cyberdrain.com. See Subscription Quick Start for the rest of the setup process.

How do we get new integrations?

We know, you love CIPP. You want everything to integrate with CIPP. Unfortunately, CIPP's business model doesn't allow us to take on the development, documentation, and help desk training to support every integration out there. In order for a vendor to integrate with CIPP, we need them to sponsor CIPP at the integration level.

Vendor sponsorship pays for that development, training, and support. If you have a vendor that you want to see integrated with CIPP, please reach out to your Account Manager at the vendor and let them know that you are interested.

Here's a couple of options for emails that you can send to vendors. Modify these as you see fit for other vendors.

Email 1: You love CIPP and would switch vendors based on who we integrate with:

Email 2: You love CIPP and would like your vendor to integrate

What should I do if I'm experiencing performance issues in CIPP?

Performance issues in CIPP are not expected. If your performance appears impacted, you can follow these steps to diagnose and resolve the issue:

  1. Check Your Deployment Region:

    • Ensure that you deployed to the nearest region. You can verify this at Azure Speed.

  2. Check your Worker Health

    1. using a superadmin account go to CIPP -> Advanced -> Worker health to see the health of your workers.

Can I add Conditional Access to my CIPP App?

To add Conditional Access to CIPP, follow the below steps:

  1. Go to your Conditional Access Policies

  2. Select which users to apply the policy to, default suggestion is "All Users"

  3. Select CIPP-SSO as the included app under "Cloud Apps or actions"

  4. Configure any condition you want. For example, Trusted Locations, specific IPs, specific platforms.

  5. At Access Controls you must enable Grant, with MFA access.

  6. Select Save

Your app is now protected with Conditional Access.

I renamed a tenant. How do I get this to show up in CIPP?

Beginning with v7, CIPP relies on the tenant's name at the time a GDAP relationship was created. Much of the tenant naming and renaming API capabilities were deprecated. As such, it will no longer pull in live information if you rename a tenant through your Microsoft Partner Portal.

To have the new tenant's name show up in CIPP, you have two options

Establish a New Relationship

  1. After renaming the tenant, create a new GDAP relationship. You can use the Tenant Onboarding wizard to expedite this process.

  2. Terminate the old GDAP relationship. This can be accomplished by locating the old relationship on the GDAP Relationships page and selecting terminate relationship from the per-row actions or Bulk Actions with the row selected.

  3. Clear your tenant cache from Application Settings.

Utilise the Tenant Alias Functionality

CIPP can also set an alias via the Edit Tenant section of Edit Tenant.

I remediated an admin with no MFA, why is it still alerting?

The CIPP alert "Alert on admins without any form of MFA" is based on checking a report created by Microsoft. This report is only updated once every 7 days. As such, CIPP recommends only running this alert every 7 days. It's possible the user may still show up on the report after remediation if the report has not refreshed since you completed your remediation steps.

I'm getting an error that "you must use multi-factor authentication to access" what's going on?

Typically, this error means you're using tokens that don't have a "strong auth claim" or similar. This could be because you're using non-Entra ID MFA or you didn't complete MFA when creating your tokens for one or more of the authentication steps. Make sure you're using a supported MFA method and that you've completed the MFA steps when creating your tokens.

Check the Multi-Factor Authentication Troubleshooting details in the Troubleshooting section for more information.

What if I get errors during management my tenants in CIPP?

  1. Perform a CPV Permissions Refresh:

    1. Navigate to Settings -> CIPP -> Application Settings

    2. Click on the Tenants tab.

    3. Click the blue refresh button in the "Actions" column for the relevant tenant.

  2. Perform Permissions Check:

    1. Navigate to Settings -> CIPP -> Application Settings

    2. Select "Perform Permissions Check"

  3. Conduct GDAP Check

    1. Navigate to CIPP -> Application Settings -> GDAP Check.

    2. After the Permissions Check, perform the GDAP check

  4. Perform an Access Check:

    1. Navigate to CIPP -> Application Settings -> Access Check.

    2. Select the relevant tenant and click "Run access check".

Complete all checks for effective troubleshooting. If you still have issues or for detailed instructions, refer to theRefreshing a Specific Tenant's Permissions via CPV API page, the Troubleshooting Instructions page, and the relevant sections on our Error Codes page.

I'm getting missing permissions errors when performing the Permissions Check on my CIPP-SAM application. How can I fix this?

Sometimes when you are running a permissions check, you may encounter specific errors that you are missing some of the API permissions required for CIPP to perform as expected.

To ensure full functionality of CIPP, follow these steps to add the necessary API permissions:

  1. Click the Details button on the Permissions Check section of CIPP Settings > Permissions

  2. Click Repair Permissions. CIPP will automatically add newly added or missing permissions to your CIPP-SAM application.

  3. CIPP will queue up CPV refreshes to push the update permissions to your client tenants.

How can I resolve expired / revoked auth token errors or ensure the correct service account is used by CIPP?

This error occurs because the user who authorised the CSP or Graph API connection has had their password changed, sessions revoked, or account disabled. Reauthorisation is required.

To resolve this, execute the Setup Wizard with Option 4:

  • Go to CIPP → Application Settings → Setup Wizard.

  • Select "Refresh Tokens for existing application registration"

Occasionally this can happen if there is not a new application secret available to CIPP and the existing one is expired/revoked. In that case, you will first need to:

  • Log into Entra on the partner tenant

  • Find your CIPP-SAM application in the app registrations

  • Add a new client secret

  • Choose option "Manually enter credentials" in the Setup Wizard.

  • Enter the new app secret only and Submit

Important: Ensure your browser allows cookies, disable any ad-blockers, and do not use in-private mode.

How do I resolve issues with the wrong CIPP-SAM user / Service Account?

  1. Perform a Permissions Check:

    • Go to CIPP -> Settings -> Permissions

    • A Permissions Check will automatically run on page load

  2. Confirm the UserPrincipalName matches the expected service account.

  3. If not, go to the Setup Wizard and select the option to "Refresh Tokens for existing application registration.

  4. Review the remaining Permissions Check output after replacing the incorrect account.

    • The refresh token matches key vault. This may take a little while to update after first changing the account due to caching.

    • The user should be a service account.

    • The user needs to be a member of the AdminAgents group.

    • The application has all the required permissions. If you have an error here, click the "Details" button and use the built-in permissions repair tool.

How do I troubleshoot GDAP relationship issues in the partner portal?

If there are issues with the GDAP relationship, follow these steps:

  1. Check GDAP Relationships:

  2. Verify Access:

    • If you only see a relationship with "MLT_", you do not have write-access to the tenant.

    • If you see other relationships, click into them and check if the roles are mapped to groups.

  3. Create Role Mapping:

    • If roles are not mapped, create the mapping by clicking the + icon.

    • Assign these groups to the CIPP service account.

  4. Identify the CIPP Service Account:

    • Go to CIPP -> Application Settings -> Permissions -> Permissions Check.

    • Review the results for the UserPrincipalName to identify the CIPP service account.

How do I manage my own tenant?

See the instructions to switch the tenant mode here

Does CIPP require a specific licence?

No, CIPP can work with any M365 licence in your partner tenant. For specific features CIPP will of course only function if the tenant is licensed correctly, for example to manage Intune, the tenant must have Intune Licensing.

My usernames or sites are GUIDs or blank?

Please see the standard "Enable Usernames instead of pseudo anonymised names in reports" in Templates.

My tenant requires admin approval for user apps; how do I do this for CIPP?

If your Azure Tenant requires admin approval for user apps, add consent by following the below steps:

  1. Go to Azure Enterprise Applications

  2. Find Azure Static Websites

  3. Grant Admin Consent for all

This permits users the ability to grant consent when access CIPP now.

Can I replace the default branding with my own in CIPP?

For the CIPP application:

No, CIPP's branding is compiled into the code. Additionally, the branding isn't just a decorative feature, it plays a role in helping maintain visibility and community growth.

For CIPP reports:

Yes, please set up the Application Settings in Application Settings

How can I add or change a domain name using the CIPP management portal?

You can use our management portal to add or change a domain name. Follow these steps:

  1. Set CNAME:

    • First, set any CNAME you want to use to your current portal domain.

    • For example, set "CIPP.MyMsp.com" to "Proud-Dolphin01928.azurewebsites.net".

  2. Use the Management Portal:

    • After setting the CNAME, use the management portal to finish the setup and add it on the platform.

How do I find the correct AppID for CIPP?

To find the correct AppID for CIPP:

  1. Run a Permissions Check:

  2. Locate the Correct AppID:

    • There will be a direct link to the application registration CIPP currently uses.

    • You can safely delete the other AppIDs.

Helpdesk asked me to generate a HAR file in Google Chrome. How do I do that?

To generate a HAR file while performing an action, follow these steps:

  1. Open Chrome DevTools:

    • Right-click in the browser window or tab.

    • Select Inspect.

  2. Capture Network Traffic:

    • Click the Network tab in the panel that appears.

  3. Export the HAR File:

    • Click the download button (tooltip will say "Export HAR").

    • Name the file and click Save.

For more details, refer to the Chrome DevTools guide.

I want to access the portals from my own account

if you want to use the ability to jump into portals using your own account, add the user that must do this to the M365 GDAP groups generated by CIPP. This allows their accounts permission to all tenants onboarded with GDAP.

My technicians get "no access", blank/half-loading portals, or repeated sign-in prompts when using the Portals links. What's wrong?

This is one of the most common points of confusion for newly onboarded partners, and it almost always comes down to a single cause: the technician's own account does not have GDAP access to the client tenant.

It's important to understand that there are two different identities at play in CIPP:

  • The CIPP service account (CIPP-SAM). This is what CIPP itself uses to read and manage tenants in the background. The onboarding wizard, the 15 Recommended Roles, CPV refreshes, and the Permissions Check all relate to this account. If CIPP is displaying tenant data, this account is working.

  • Your individual technician's account. The Portals Quick Access links on the CIPP Dashboard and the portal jump-ins on Tenant Select leave CIPP entirely and open the Microsoft portal as the signed-in technician, not as the service account. For these to work, the technician's own account must have a GDAP path into that tenant.

So if CIPP works but a technician can't use the portal links, refreshing CPV, re-running the Permissions Check, or confirming the 15 roles will not help: those only affect the service account.

Typical symptoms, all from the same cause:

Symptom
What's happening

"No SharePoint admin access"

The technician's account isn't in the GDAP group mapped to the SharePoint Administrator role.

M365 portal is blank / Entra portal never finishes loading (or loads the centre but no left sidebar)

The portal opened under the technician's account, which has no delegated role in that tenant, so it can't render.

Prompted to authenticate every time a portal is opened, even with other portal tabs already open

The technician's account has no standing delegated access to the tenant, so each portal forces a fresh delegated sign-in.

The fix: add the technician's account to the M365 GDAP security groups that CIPP generated in your partner tenant. Membership in these groups is what grants a user delegated access through your GDAP relationships.

  1. In your partner tenant, go to Entra (or the Microsoft 365 admin center) and locate the security groups named M365 GDAP ....

  2. Add the technician's user account as a member of the relevant groups (add them to all of the role groups to mirror the access the service account has).

  3. Optionally you can nest groups under those roles such that you add staff to a group called GDAP Technician Accounts and add that group as a member of the M365 GDAP ... groups and then add the staff just to GDAP Technician Accounts, when new permissions are added just add the GDAP Technician Accounts group to the new M365 GDAP ... group and all staff in GDAP Technician Accounts will get the new permission

  4. Have the technician sign out of the Microsoft portals fully and sign back in so their token picks up the new group membership.

Adding a user to the M365 GDAP groups grants that user delegated access to every tenant onboarded with GDAP, not just one client. Only add accounts that should be able to administer all of your clients.

GDAP delegated access is also bounded by the roles in each relationship. If a role (for example SharePoint Administrator) was never part of the relationship for that client, no one, service account or technician, will have that access until a new relationship containing the role is established. See Recommended Roles and the GDAP Management section. Microsoft GDAP Documentation

Applying New Standards to a Tenant

Q: How long does it typically take for new standards to be applied to a tenant?

A: It usually takes between 0 to 3 hours for new standards to be applied to a tenant. This timeframe depends on the scheduling of a cron job that automatically initiates the application of standards.

Q: Can I apply standards immediately instead of waiting for the cron job?

A: Yes, you can apply standards immediately by clicking the "Run Now" buttons located in the top right corner of the interface. This action bypasses the scheduled cron job and applies the standards right away.

When trying to onboard a GDAP relationship, I received an error that only x amount of groups were found, or that the group is not assigned to a user. What does this mean?

This error can mean two things;

  • You migrated using different tools, such as Microsoft Lighthouse.

  • You didn't assign the groups to the user after migrating.

Make sure you assign the correct groups to the CIPP service account. For more information see our best practices in Recommended Roles.

I've already set up my GDAP relationships and given them access to a Global Administrator role. Can I still auto-extend these after their expiration?

Auto Extend is only available for relationships without the Global Administrator role. If your relationship contains the Global Administrator role you cannot enable this feature. This means that you will need to renew the relationship by reinviting the tenant every 2 years. If your relationships contain at least the Recommended Roles in addition to Global Administrator, you can go to GDAP Management -> Relationships, select one or more relationship and choose the action "Remove Global Administrator from Relationship". After waiting for changes to sync, you can then select the action "Enable automatic extension".

My GitHub personal access token expired and I'm not sure what to do?

You don't need to do anything. The personal access token was only needed for initial deployment.

PreviousRepairing Missing Function App Settings
NextI Got a "Potential Phishing page detected" Alert. What Do I Do With That?

Last updated

Was this helpful?