Hudu

The Hudu integration writes Microsoft 365 tenant, user, device and domain information from CIPP into Hudu. Tenant-level information is published as a Magic Dash card on the Hudu company, while user and device detail is written into a rich text field on the asset layouts you nominate. You control which parts are populated, so it is reasonable to sync only what you need.

If Hudu sits behind a Cloudflare Zero Trust tunnel, set up the Cloudflare integration as well and enable Connect to HUDU through CloudFlare Tunnel with the Service Account credentials. That toggle only appears on this page once the Cloudflare integration is enabled.

User and device information is written to a rich text field named Microsoft 365. CIPP adds this field to the asset layouts you map, so it appears after the first synchronisation rather than needing to be created by hand. The layout mapped for users also gains an Email Address text field, positioned first and shown in list views.

Settings

Setting	Description
Enable Integration	Turns the integration on. Every other setting, the Test and Force Sync buttons, and the Tenant Mapping and Field Mapping tabs remain unavailable until this is enabled and saved.
Please enter your Hudu URL	The full URL of your Hudu instance, such as https://yourcompany.huducloud.com, or your self-hosted address.
Hudu API Key	The API key generated in Hudu. Stored securely and masked once saved. Enable Password Access on the key when synchronising LAPS passwords or BitLocker recovery keys.
Create missing users in Hudu	Creates an asset for any Microsoft 365 user without a matching record in the mapped user layout. Without this, CIPP only updates users that already exist in Hudu.
Create missing devices in Hudu	Creates an asset for any Intune device without a matching record in the mapped device layout.
Sync Windows LAPS passwords to Hudu	Adds the LAPS account, password and backup date to matching Windows device assets in the mapped device layout. Individual tenants can be excluded on the Tenant Mapping tab.
Sync BitLocker recovery keys to Hudu	Adds paired key ID and recovery-key fields for each BitLocker OS, fixed data, removable data or unknown drive to matching Windows device assets. Individual tenants can be excluded on the Tenant Mapping tab.
Exclude device serials (comma separated)	Additional serial numbers to skip when matching and creating devices. A set of common placeholder serials is always excluded regardless of this setting.
Import domains from M365	Creates a Hudu website record for each domain in the tenant that does not already exist.
Monitor domains in Hudu	Enables DNS, SSL and WHOIS monitoring on the website records created by the previous setting. Without it, records are created paused with monitoring disabled.
Hide Empty Roles in Magic Dash	Omits directory roles with no active or eligible members from the assigned roles table, which keeps the Magic Dash considerably shorter.
Include link to Partner Center Service management page (partner.microsoft.com)	Adds a Partner Center link to the tenant's portal links.
Include link to Defender Portal (security.microsoft.com)	Adds a Defender portal link to the tenant's portal links.
Include link to Compliance Portal (compliance.microsoft.com)	Adds a Purview compliance portal link to the tenant's portal links.
Connect to HUDU through CloudFlare Tunnel with the Service Account credentials.	Sends the Cloudflare Access service token with every request to Hudu. Only appears when the Cloudflare integration is enabled.
Reschedule next sync date	Sets a future date to delay the next scheduled synchronisation, which is useful for keeping the first run outside business hours. Leave blank to sync at the next scheduled time.

The M365 Admin Portal, Exchange Admin Portal, Entra Portal, Intune, Teams Portal, SharePoint Portal, and Azure Portal links are always included. The Partner Center, Defender, and Compliance links are optional because not every technician has access to them.

Obtaining an API Key in Hudu

1

Create the key

Sign in to Hudu as an Administrator, go to Admin > Account Administration > API Keys, and select + New API Key.

2

Configure the key

Give it a name such as CIPP Integration, set Limit scope to to Full Access, and leave Company blank. Enable Password Access under Key can perform the following actions when synchronising LAPS passwords or BitLocker recovery keys. The other actions are not required.

Optionally restrict Allowed IP Addresses to your function app's outbound addresses. CyberDrain-hosted clients can find these at management.cipp.app.

Hudu's global IP Access Control list (Admin > Security) applies to API keys as well. If it is enabled, add CIPP's outbound addresses there too, even when the key itself allows all IPs, or requests fail with Unauthorized IP Address. These addresses can change, so update the list if the integration stops working.

3

Store the key

Select Create New Key and copy the key somewhere secure. It is not retrievable afterwards.

Configuring the Integration in CIPP

1

Enable the integration

Turn on Enable Integration. The remaining fields stay disabled until it is on.

2

Enter the connection details

Enter your Hudu URL and the Hudu API Key you created.

3

Choose what to synchronise

Work through the remaining toggles to decide whether missing users and devices are created, whether domains are imported and monitored, and which portal links appear. Add any device serials you want ignored.

4

Save and test

Select Submit, then select Test. A message confirming the connection and reporting your Hudu version means the URL and API key are correct. If the test fails, the message includes the error returned by Hudu.

5

Map companies and layouts

Work through the Tenant Mapping and Field Mapping tabs described below. Scheduled synchronisation is only set up once tenants are mapped.

Organisation Mapping

The Tenant Mapping tab pairs each CIPP tenant with a Hudu company. Only mapped tenants are synchronised, and mapping a tenant is what causes CIPP to schedule its daily synchronisation.

Saving on the Tenant Mapping and Field Mapping tabs requires a role with unrestricted tenant access, meaning Allowed Tenants left as AllTenants with nothing in Blocked Tenants. A role scoped to particular tenants or tenant groups can read the existing mappings but is refused when it selects Submit or Automap Companies. See Setting Up SSO and Getting Access to CIPP.

To map manually, choose a tenant, choose the matching entry under Select Hudu Company, and select the add button. Automap Companies fills in matches automatically, and the refresh button reloads the company list from Hudu. Manual mappings are only written when you select Submit.

Column	Description
IntegrationName	The name of the Hudu company the tenant is mapped to.
Tenant	The display name of the mapped Microsoft 365 tenant.
SyncPasswords	Whether LAPS passwords and BitLocker recovery keys are synchronised for this tenant. Shown as true by default, including for mappings created before the column existed.
TenantDomain	The default domain name of the mapped tenant.
TenantId	The tenant's Microsoft customer ID.

Each row also offers these actions:

Action	Description
Sync Now	Queues an on-demand synchronisation for that tenant only, without waiting for the next scheduled run.
Exclude password data (LAPS/BitLocker)	Stops LAPS and BitLocker data being synchronised for this tenant. Greyed out once SyncPasswords is false.
Include password data	Resumes LAPS and BitLocker synchronisation for this tenant. Greyed out while SyncPasswords is true.
Delete Mapping	Removes the mapping.

The exclude and include actions change the table only, so select Submit to save the change. The Sync Windows LAPS passwords and Sync BitLocker recovery keys settings must still be on for password data to be synchronised at all. On the next synchronisation of an excluded tenant, CIPP clears any LAPS and BitLocker values previously written to that tenant's device assets in Hudu.

Automapping first follows the HaloPSA integration: when a tenant is mapped to a Halo client in CIPP and a Hudu company is synced from that same Halo client, the tenant is mapped to that company. A tenant with no Halo match falls back to a Hudu company whose name exactly matches the tenant's display name. Archived companies are ignored, existing mappings are never overwritten, and these mappings are saved immediately and scheduled for synchronisation.

Automap Companies also suggests looser name matches that ignore case, punctuation and trailing legal suffixes such as Ltd, Limited, LLC, Inc, GmbH or BV. Those appear in the table but are only saved when you select Submit, so review them first. Where more than one company matches, the tenant is skipped and left for you to map manually.

While the integration is enabled, CIPP also runs the HaloPSA and exact name matching automatically every two hours, so newly added tenants are mapped and synchronised without visiting this page. It runs straight after the HaloPSA automapping, so a tenant newly mapped to a Halo client can be carried through to its Hudu company in the same run. Each mapping it creates is written to the Logbook. The looser name suggestions are only made by Automap Companies.

Archived Hudu companies are skipped during synchronisation, and this is recorded in the sync log rather than raised as an error. If a mapped tenant never seems to update, check whether its Hudu company has been archived.

Field Mapping

The Field Mapping tab nominates which Hudu asset layouts receive Microsoft 365 user and device data.

Field	Description
Asset Layout for M365 Users	The layout used for user assets. The built-in People layout is recommended, as using a layout with an unexpected structure tends to cause matching problems.
Asset Layout for M365 Devices	The layout used for device assets.

Leave either set to --- Do not synchronize --- to skip that data type entirely. Select Submit to save, and use the refresh button after creating new layouts in Hudu.

CIPP adds the fields it needs to whichever layouts you map, so no preparation is required in Hudu beyond having the layouts exist. Leaving a layout unmapped disables creation of that asset type as well, regardless of the Create missing users and Create missing devices settings.

What Gets Synchronised

Once a tenant is mapped, CIPP schedules a daily synchronisation for it. Each run publishes a Magic Dash card on the Hudu company titled Microsoft 365 - tenant name, showing the licensed user count and containing tenant detail, portal links and the assigned roles table. The roles table lists each role's active members and, for tenants using Privileged Identity Management, its eligible members in a separate column with their eligibility end date; expired eligibilities are left out. User and device assets are then created or updated in the mapped layouts, and domains are imported as website records where enabled.

Each tenant's synchronisation first checks that CIPP can reach Hudu with the saved API key. If it cannot, that tenant's run stops straight away and the Hudu error is recorded in the logbook. Select Test to confirm the connection.

Use Reschedule next sync date to push the next run to a specific date, which is the cleanest way to keep the initial full synchronisation out of business hours.

Force Sync on this page reschedules the synchronisation tasks rather than running them immediately. The message confirms that tasks will start within fifteen minutes.

The Integration Sync page shows per-tenant synchronisation status and is the first place to look when a tenant's data appears stale.

Custom CSS

The Microsoft 365 rich text field can render with cut-off tables or cramped formatting depending on your Hudu theme. Adding the following custom CSS in your Hudu settings improves the layout of the tables, licence tiles and link buttons CIPP generates.

.card__item table {
  border-collapse: collapse;
  margin: 5px 0;
  font-size: 0.8em;
  font-family: sans-serif;
  min-width: 400px;
  box-shadow: 0 0 20px rgba(0, 0, 0, 0.15);
}
.card__item h2,
.card__item p {
  font-size: 0.8em;
  font-family: sans-serif;
}
.card__item th,
.card__item td {
  padding: 5px 5px;
  width: auto;
}
.card__item thead tr {
  text-align: left;
}
.card__item tr {
  border-bottom: 1px solid #dddddd;
}

.custom-fast-fact.custom-fast-fact--warning { background: #f5c086; }
.custom-fast-fact.custom-fast-fact--datto-low { background: #2c81c8; }
.custom-fast-fact.custom-fast-fact--datto-moderate { background: #f7c210; }
.custom-fast-fact.custom-fast-fact--datto-high { background: #f68218; }
.custom-fast-fact.custom-fast-fact--datto-critical { background: #ec422e; }

.nasa__block {
  height: auto;
}
.nasa__block td {
  white-space: normal;
  word-wrap: break-word;
  word-break: break-word;
}

.mce-content-body {
  max-height: none !important;
  overflow: visible !important;
}
.writer-wrap {
  max-height: none;
  overflow-y: auto;
}

/* === License & Management Link Card Grids === */

/* Suppress generated <br> tags between sections */
.rich_text_content .o365 + br {
  display: none;
}

/* Flex for management button rows */
.o365 {
  display: flex;
  flex-wrap: wrap;
  gap: 8px;
  padding: 8px 0;
  align-items: stretch;
}

/* Grid for license tile rows — equal-width columns */
.o365:has(.o365__app) {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(155px, 1fr));
}

.o365__app {
  display: flex;
  flex-direction: column;
  align-items: center;
  justify-content: center;
  gap: 6px;
  padding: 10px 14px;
  min-width: 130px;
  border-radius: 6px;
  border: 1px solid rgba(200, 200, 200, 0.15);
  box-shadow: 0 2px 6px rgba(0, 0, 0, 0.2);
  font-family: sans-serif;
  font-size: 0.8em;
  text-align: center;
}
.o365__app strong {
  font-size: 1em;
  line-height: 1.2;
  display: block;
}
.o365__app font {
  font-size: 0.72rem !important;
  opacity: 0.65;
  display: block;
  line-height: 1.2;
}

.o365 .button {
  border-radius: 6px;
  padding: 8px 14px;
  font-size: 0.85em;
  font-family: sans-serif;
  font-weight: 500;
  box-shadow: 0 2px 6px rgba(0, 0, 0, 0.2);
  transition: box-shadow 0.15s ease, transform 0.1s ease;
  white-space: nowrap;
  margin: 0;
  cursor: pointer;
}
.o365 .button:hover {
  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.35);
  transform: translateY(-1px);
}
.o365 .button a {
  display: flex;
  align-items: center;
  gap: 6px;
  text-decoration: none;
}

.section-label {
  font-family: sans-serif;
  font-size: 0.7em;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--primaryl1);
  margin-top: 16px;
  margin-bottom: 6px;
  padding-bottom: 5px;
  padding-left: 2px;
  border-bottom: 1px solid rgba(21, 112, 239, 0.3);
}

Special Thanks

Special thanks to Luke Whitelock and his HuduM365Automation function app code.

---

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.