> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tools/dark-web-tools/tenant-breach-lookup.md).

# Tenant Breach Lookup

This page lists the accounts in the selected tenant that appear in known data breaches, along with the credentials exposed. Results come from a background search that you start from this page, so the table shows what was found the last time a search ran rather than a live lookup.

{% hint style="danger" %}
The **Password** column contains credentials exposed in a breach, in the clear. Treat this page as sensitive: anyone who can view it can read those passwords. Where an account appears here and the password is still in use anywhere, reset it and check for reuse across other services rather than only in Microsoft 365.
{% endhint %}

## Action Buttons

<details>

<summary>Run Breach Check</summary>

Opens a confirmation dialog naming the tenant the search will run against. Selecting **Run Breach Search** queues the job and returns straight away, it does not wait for results.

The search collects every domain registered in the tenant and checks each one for breached accounts. Results are written back per domain as they are found.

</details>

{% hint style="info" %}
The search runs in the background and can take up to 24 hours to complete. Nothing on this page updates while it runs, so refresh the table later to pick up results rather than waiting on the dialog.
{% endhint %}

{% hint style="warning" %}
Results are only written back where the number of breached accounts found for a domain has changed since the last search. Re-running a check against a domain whose count is unchanged leaves the existing rows exactly as they are, so an unchanged table does not necessarily mean the search failed.
{% endhint %}

## Table Details

| Column   | Description                                               |
| -------- | --------------------------------------------------------- |
| Email    | The breached account.                                     |
| Password | The password exposed for that account in the breach data. |
| Sources  | The breaches the account was found in.                    |

An account exposed in several breaches appears once per breached credential, so the same address can be listed more than once.

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>View User</td><td>Opens the <a data-mention href="/pages/oJe74pgGQMeeWm0MzrI1">/pages/oJe74pgGQMeeWm0MzrI1</a> page with the selected address already filled in, showing everything known about that individual account.</td><td>false</td></tr></tbody></table>

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/tools/dark-web-tools/tenant-breach-lookup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.