Error codes
Last updated
Was this helpful?
Last updated
Was this helpful?
Below are error codes that can occur in CIPP. Use this page to troubleshoot your received error code.
The account you use to generate your SAM tokens for CIPP must have Microsoft (Azure AD) MFA enabled, it can't use third-party MFA.
You can't have the Allow users to remember multi-factor authentication on devices they trust
option enabled in the in the partner tenant.
Check our section on on how to handle Conditional Access issues.
The required license for this feature is not available for this tenant. Check the tenant's license information to ensure that it has the necessary license for the requested operation. Most seen around security tasks that require M365 BP or Azure AD P1.
This feature requires a P1 license or higher. Check the license information of your clients tenant to ensure that they have the necessary licenses.
Error 400 occurred. There is an issue with the request. Most likely an incorrect value is being sent. If you receive this error with a permissions check, please redo your SAM setup. In the case of a CPV refresh you may get this code if you are using Duo as an MFA solution.
This occurs when GDAP has been deployed, but the user is not in any of the GDAP groups.
There is no Exchange subscription available, so exchange connections are no longer possible.
The relationship between this tenant and the partner has been dissolved from the client side. Check the partner relationship information and ensure that it is still active. This error also occurs when a GDAP relationship has expired or is not configured correctly.
Multiple Potential Causes:
The user has not authorized the CIPP-SAM Application. Use the Settings -> Tenants -> Refresh button to refresh the permissions.
The user that was used for the CIPP Authorisation is a guest in this tenant
You have not added the user to the correct group(s) for CIPP to function. See Connecting to your tenants for more information.
Multiple Potential Causes:
The user has not authorized the CIPP-SAM Application. Use the Settings -> Tenants -> Refresh button to refresh the permissions.
The user that was used for the CIPP Authorization is a guest in this tenant
A Conditional Access policy may be blocking your access. Add your CSP tenant as a serviceProvider exception.
You have not added the user to the correct group(s) for CIPP to function. See Connecting to your tenants for more information.
You have not finished the SAM Setup wizard - CIPP cannot connect to the API with the current credentials.
NOTE: If you are receiving this during the SAM Setup wizard, copy the complete URL from the address bar in your browser and paste it into a new tab.
This error can appear when performing a tenant access check. Try a GDAP check to see if you have the correct permissions in place, when you do try a CPV refresh, if the CPV refresh fails with an error it means we most likely do not have write access to the tenant.
The user does not have sufficient access rights to perform the operation or is missing the necessary Exchange role. Check the user's access rights and Exchange role information, when using GDAP the user must be in the "Exchange Administrators" group.
When executing the first authorization for CIPP, a trusted device was used. This device has been deleted from the Intune portal. Reauthorization is required by using the SAM Wizard "I'd like to refresh my tokens" option.
The user that authorized the CSP or Graph API connection has had their password changed, sessions revoked, or account disabled. Reauthorization is required by using the SAM Wizard "I'd like to refresh my tokens" option.
This error can have three causes.
The user has not had MFA set up when performing authorization.
The CIPP-SAM application in the customer tenant is disabled for login. This can be remediated by doing the following:
Navigate to the customer tenant and log in either via the partner relationship or an customer admin account.
Locate the CIPP-SAM app under Enterprise Application by removing the Application type filter.
Under the properties tab, set "Enabled for users to sign-in?" to "Yes"
Wait a few minutes and run a tenant access check.
This error occurs when a Conditional Access Policy has set the maximum lifetime. Suggested is to change the Conditional Access Policy to exclude "Service Provider users". See the chapter about how to resolve this under Conditional Access.
The refresh token could not be retrieved and stored. The user must reauthorize.
This error occurs when CIPP cannot write to the errors table - Clear your tenant cache from the settings menu and try again. You might also receive the error when a tenant access check has failed, the only way to clear the Last Graph Error is by removing the tenant cache.
This occurs when the app has existed for more than 2 years and requires a new certificate or secret, or when a secret has been expired manually.
Find and click on your app
Navigate to "Certificates & secrets"
Click "+ New client secret"
Enter a description, choose an expiration, and click "Add"
Copy the new client secret value
Go to CIPP -> Settings -> SAM Wizard
Use the option "I have an existing application and would like to enter my keys"
Enter only the new secret and click Next.
This issue can occur when you restart the app during an important task. It's never recommended to restart the function app, and if you do unexpected results can happen. The Function Host uses something called durable functions, which when handled incorrectly can cause performance issues or increase costs due to looping tasks.
Navigate to Storage Account: Go to 'Storage accounts' and select the storage account that starts with 'CIPP'
Access Queues: Inside the storage account click on Storage Explorer,
Clear Data Individually:
Delete each queue. This will automatically be recreated when required.
Delete all data in the "Blobs" section as well.
Restart the function app.
This procedure can also be used to safely restart the function app when required.
The client has Conditional Access policies blocking CIPP's access. See the chapter about to resolve.
Copy the contents of into the new file you created
Copy the contents of this the new file you created
Log In to Azure Portal: Sign in to your Azure account at .
This troubleshooting document was created with the help of