Introduction

Welcome to the CIPP User Documentation! CIPP (pronounced "sip") is the CyberDrain Improved Partner Portal, a powerful Microsoft 365 multi-tenant management system designed to help MSPs streamline their clients' Microsoft 365 administration tasks. Created by Kelvin Tegelaar in 2021, CIPP aims to fill the gaps left by existing multi-tenant management solutions, making it easy and efficient to manage multiple clients from one centralized portal experience.

CIPP consists of two main components: the CIPP UI and the CIPP API. The frontend is built using React and Core UI, while the API is built with PowerShell. The system leverages Azure Functions and Azure Static Web Apps to provide a fast, responsive, and maintainable solution.

Key Features

• Central User Management: CIPP offers a simple user management interface, making it easy to add, edit, and delete users, offboard users, change calendar permissions, manage shared mailboxes, and more.

• Easy Standardization: Deploy standards across your entire client base, ensuring tenants are always in the desired state. CIPP's alerting and best practices features help you provide the best experience for your clients.

• Secure and Report: CIPP includes industry best-practice standards and integrations, allowing you to report on everything in your M365 tenants and secure your customers' environments.

Documentation Components

The documentation is organized into the following components:

1. Setup Documentation: This section covers the initial setup process of deploying your own instance of CIPP, including system requirements, installation, and configuration.

2. User Documentation: Here, you'll find detailed guides and tutorials on how to use the CIPP platform once it's been deployed to manage your clients' Microsoft 365 tenants.

3. Developer Documentation: If you're looking to extend the functionality of CIPP or integrate it with other tools and services, the Developer Documentation provides API documentation, custom scripting, and other advanced topics for developers.

In addition to the core documentation components, we also provide a Troubleshooting Guide and an FAQ section to help you quickly resolve common issues and find answers to frequently asked questions.

CIPP is an open-source project, and we encourage users to review the code and contribute to its ongoing development. For more information about the project, its contributors, and funding, please refer to the documentation in the relevant sections.

We hope this documentation serves as a valuable resource as you explore and utilize the CyberDrain Improved Partner Portal. If you have any questions or need further assistance, please don't hesitate to check us out in .

Our Sponsors

The table below outlines the keyboard shortcuts that have been enabled in CIPP.

What to do after installation?

Using the Intune Catalog

Setting up an audit log alert

Setting up a CIPP scripted alert

Offboarding users

Setting up location based alerting, without a P1 license

Managing your clients secure score

Have an error that you're unsure how to handle? Errors in most pages of CIPP will return with a Get Help button to the right of the text. Click the button and a new tab will open allowing you to search the documentation for additional information.

Introduction

This section of the documentation will walk you through the process of setting up the CyberDrain Improved Partner Portal (CIPP) to manage your clients' tenants efficiently.

CIPP is a powerful Microsoft 365 multitenant management system that will allow you to deploy standard properties across all your tenants, easily manage everything from a single portal, and keep your managed environments in the best shape.

Clicking this toggle will switch the display mode for CIPP.

Available Display Modes

• Light mode

• Dark mode

This will allow you to add a guest user. Enter the user's "Display Name", "E-mail Address", and an optional "Redirect URL". Toggle the "Send invite via e-mail" option on if you'd like the guest user to receive a Microsoft generated invite e-mail.

This page allows you to adjust the settings for your group template.

Clicking this icon will display pages that you have added to your bookmarks.

Use of the magnifying glass in the menu bar will pop open a search modal. You can use this feature to quickly locate a page within CIPP without having to navigate the sidebar menu. This search will only return pages that a user has permission to.

This wizard will allow you to bulk update the selected user(s) from the page.

When typing in text fields, you can now type % and begin typing the name of the variable you want to use in the text field. This will bring up a dropdown that you can use to auto complete variable names. This ensures you always type the variable name exactly how you input it into settings.

Hotkey Support

Navigating the list is supported by the following hotkeys

This page will output a structured view of the audit log entry selected from the Audit Logs page.

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.

Hosted Clients

Adding a Custom Domain Name

Why setup a custom domain?

1. The automatically generated domain uses azurewebsites.net which is often blocked by web filtering products as it's often used by spammers and phishing sites due to the ease of obtaining an azurewebsites.net subdomain.

2. Your bookmark stays the same if you redeploy.

3. Easier to communicate internally and looks better for your team.

At the moment of deployment, the application uses a generated domain name. To change this follow these instructions:

• Go to CIPPs Settings menu

• Click on 'Static Web app - Role Management'

• Select Custom Domains. You can add your own domain name here.

For more information see Microsoft's documentation at

To make sure CIPP is able to access your tenants securely we recommend the usage of Conditional Access. Both your, and your clients Conditional Access Policies will need to be configured for optimal usage.

Setup of Your Conditional Access Policies

Setup of Clients' Conditional Access Policies

GDAP is affected by your clients' conditional access policies. To make sure you can access your clients using your CIPP integration user we recommend excluding the MSP from the Conditional Access Policy per

If you want to manage your own tenant or if you are not a Microsoft Partner but still want to use CIPP you can perform the setup and enable access to the partner tenant or enable Single Tenant Mode. The CIPP Service Account should be granted at least the Recommended Roles within the tenant being managed.

There are 3 different modes in CIPP to choose from:

• Multi Tenant - GDAP mode

  • This is the default mode in CIPP, it does not allow access to the partner tenant.

• Multi Tenant - Add Partner Tenant

  • This mode allows direct access to the partner tenant in addition to your customer tenants via GDAP. See the Limitations below for more details.

Limitations of Single Tenant Mode

When using Single Tenant Mode CIPP runs in a somewhat more limited state - You are not able to add any other tenant to CIPP and it only works for the configured tenant. GDAP permissions will not apply, and you must directly assigned roles such as Global Admin to the service account.

Limitations of Partner Tenant Enabled

When using Partner Tenant Enabled mode you can see your partner tenant inside of CIPP. There will be no permissions applied to whom can see this tenant and control it.

GDAP permissions will not apply and you must directly assign roles to the service account in the Entra portal (e.g. User Administrator, Exchange Administrator, etc.).

To set the tenant mode, follow these steps

1. Log in to CIPP with an account with the role superadmin. This role will allow you access to the menu to change this setting.

2. Go to the Application Settings menu

3. Go to the Super Admin tab

4. Select one of the three modes. The default mode is "Multi Tenant - GDAP Mode"

Overview

The GDAP Invite Wizard simplifies setting up GDAP relationships with your clients by assigning the correct roles and ensuring the CIPP-SAM application is correctly configured for each tenant. To get started with generating GDAP invites inside CIPP, navigate to Tenant Administration -> GDAP Management and follow the instructions below.

Wizard Steps

Step 1: Click on Add Tenant

To get started, we click the "Add Tenant" button. The overview page shows you your current GDAP configuration

Step 2: Generate CIPP Default Template

If you have never used the CIPP before, you will have the option to generate the CIPP Defaults Template. This template allows you to create the optimal role configuration for CIPP. If you do not create this template, you will need to create your own.

Step 3: Select GDAP Role Template and generate invites

Choose the role template to use from the list of role templates, and choose the amount of invites you'd like to generate. You can use this to generate the exact amount of invites for tenants you'd like to onboard.

Post-Invite Actions

After submission, you will see as many rows as invites you've requested, with two URLs in a table:

• Invite Link: This URL is for the Global Administrator in your client tenant to accept the invite.

• Onboarding Link: This URL is to be used by a CIPP admin to complete the onboarding process. It should not be used under a client account.

Role Management Considerations

Any additional users who need access to your Microsoft CSP Tenants via the admin portals must be manually added to the relevant security groups. These groups start with "M365 GDAP".

Drift Management

Drift Standard Creation

AI Powered Help

Using variables in templates and more

Alerting

Audit log searches

License Management

Connect to GitHub for Continuous Deployment

If you want your Function App to auto-update whenever you commit to your CIPP-API fork, follow these steps:

Your Function App will now be automatically updated pull directly from your GitHub fork whenever you pull the latest version of the CIPP-API repository.

This page will output a table showing the status of Entra ID Connect syncing.

Table Columns

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

This page will allow you to create a group template for ease of deployment to your clients' tenants. Enter the group's "Display Name", "Description", and "Username" before selecting the radial for the group type you'd like to set.

Additional Group Type Settings

Dynamic Group Parameters: For Dynamic Groups, a text box for entering the dynamic group parameters syntax becomes available e.g.: (user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest").

Page Buttons

• View Members/Edit Membership - This will toggle the page to display a table of the current group membership or show the edit membership and properties view.

Edit Membership & Properties

Group Properties

• Display Name

• Description

• Mail Nickname

Add Members

• Add Members

• Add Owners

• Add Contacts

Remove Members

• Remove Members

• Remove Owners

• Remove Contacts

Group Settings

• Set group visibility to Public or Private

• Let people outside the organization email the group - If selected, it allows external senders to send emails to the group.

  • Send Copies of team emails and events to team members inboxes - If selected, it enables sending copies of team emails and events to the inboxes of team members.

• Hide group mailbox from Outlook - If selected, it will hide the mailbox from the Global Address List

Global variables are key-value pairs that can be used to store additional information for All Tenants. These are applied to templates in standards using the format %variablename%. If a tenant has a custom variable with the same name, the tenant's variable will take precedence.

These variables can be used in any type of template and will be replaced automatically.

Tenant custom variables can be set in the box, shown while editing a Tenant. Global variables are set on the Global Variables tab under Tenant Administration > Administration > Tenants.

Automatically Replaced Variables

The following variables will be automatically replaced by CIPP:

• %initialdomain%

• %tenantfilter%

• %tenantid%

Reserved Variables

The following variables are reserved and will not be used:

• %cippurl%

• %cippuserschema%

• %defaultdomain%

Overview

The Roles page provides a comprehensive list of all Microsoft 365 roles such as Billing Administrator, Global Administrator, etc. It offers the ability to view members associated with each role. This capability promotes efficiency and transparency in managing role assignments.

Column Details

The properties returned are for the Graph resource type directoryRole. For more information on the properties please see the . Additionally, CIPP will include a column outlining who is a member of each role.

Table Actions

Considerations

While navigating the Roles page, please consider the following:

1. Tenant Selection: This page does not yet support the "All Tenants" overview. Please use the tenant selector to view roles specific to a selected tenant.

2. Scope of Roles: This page displays Microsoft 365 admin roles only. Exchange, Azure IAM, and Purview rights are outside the scope of this area.

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

This page will present a tenant's Entra devices in a table.

Column Details

The properties returned are for the Graph resource type device. For more information on the properties please see the Graph documentation.

Table Actions

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

This page will allow you to edit the settings for your app approval template

This page allows you to modify the tenant group's information such as Group Name, Group Description, and make bulk changes to the group membership.

This page will allow you to edit the permission set's settings.

After a new update, when you first load CIPP you will have the release notes show up in a popup on your screen. You can even select prior releases to review. At the bottom you have three options

• View release notes on GitHub - takes you to GitHub to view the release notes

• Remind me next time - Will open again the next time you load CIPP

• Don't show untle next release - Will suppress the notification until CIPP gets a version update

No, this isn't the breadcrumbs from one of the CyberDrain CTFs. Sorry for anyone experiencing any PTSD from your time in the trenches chasing these tasks.

Breadcrumb navigation appears the top of CIPP just under the top menu bar. This will show you path information to how you arrived at a particular page. There are two different display modes for the breadcrumbs:

Hierarchy Mode

This mode will show you the menu hierarchy that allows you to arrive at the current page the same as if you had drilled down the left side menu.

History Mode

This mode will show you the previous pages you clicked to get to your current page.

This wizard will allow you to bulk create new users.

An alternative way to display the Secure Score page.

Information Box

• Current Score

• Compared Score (All Tenants)

• Compared Score (Similar Tenants)

• Score in Points

Table Details

The properties returned are for the Graph resource type secureScoreControlProfile. For more information on the properties please see the .

CIPP will additionally add columns called "Action Url" and "Remediation" with addiitonal information on how to take action on the score component. The "Remediation" column will indicate which CIPP Standard will complete the selected action.

This page will display all audit logs for Microsoft Entra ID.

Table Details

The properties returned are for the Graph resource type directoryAudit. For more information on the properties please see the Graph documentation.

Table Actions

This page lists the tenant's risky users. Here, you can review the information associated with the risk detection.

Table Columns

The properties returned are for the Graph resource type riskyUser. For more information on the properties please see the .

If you've started the sponsorship process and are ready to enhance your management of Microsoft 365 tenants with efficiency, this guide is designed to get you started.

This page will list sign-ins from the past seven days.

Table Columns

The properties returned are for the Graph resource type signIn

This guide walks you through the process of executing the Setup Wizard inside CIPP for the first time. The Setup Wizard presents you with multiple options. If this is your first setup, choose the "First Setup" option.

Getting Started with the CIPP Setup Wizard

The First Setup option is designed for initial configuration. It guides you through essential steps to prepare CIPP and connect your tenants.

1. Begin Setup

This page allows you to create a new JIT admin

This page will display the results for a specific .

Table Details

Multi-Factor Authentication Status Report

Introduction

This report provides an overview of the Multi-Factor Authentication (MFA) status for all users within the tenant. It's a combination of the built in Entra MFA report, and getting the Per User MFA state and combining them for a complete picture.

This table will show all app registrations in the tenant.

Table Details

The properties returned are for the Graph resource type application. For more information on the properties please see the .

Shows deleted items in the tenant. What else did you expect? Monkeys? 🐒

Available Deleted Item Types

• Administrative Unit

This page will display the risk detections for the selected tenant or AllTenants

Table Columns

The properties returned are for the Graph resource type riskDetection. For more information on the properties please see the .

Ensure temporary admin accounts aren't left active. CIPP lets you create accounts with specific roles as needed and easily removes them automatically when no longer required. JIT Admin accounts will be displayed in the table.

Column Details

This page will show the results of any audit log searches completed by CIPP.

Filter Search List

Use this expandable section to adjust the results displayed in the table below. Choose the Status and Date Range you would like to view.

The Tenant page provides the ability for you to jump to the specific tenant administration centers for that client using your individual partner tenant user credentials. Allowing you to administer that specific tenant.

Tenants are cached for 24 hours. By using the Clear Tenant Cache button in , you are able to reload the tenants from the partner center immediately. Remember to also clear your browser cache.

This page shows all the enterprise applications that are available in the tenant. This can for example be very helpful when trying to identify SAM applications from previous MSPs.

To do this, first clear the filter and then select the All-non-Microsoft Enterprise Apps filter. If not done in this order, the filter will not work as expected.

Page Actions

This page will allow you to create an approval template for a multi-tenant application. Set the template name, application to deploy, and the permission set.

CIPP offers a set of scheduled, recurring alert checks. Some of these duplicate Microsoft Alerts functionality in a more MSP-friendly manner and some are not available as a Microsoft Alert at this time. Similar to , you configure alerts using the wizard to select one or more tenants or -All Tenants- to apply alerts globally, then select from the list of available alerts.

Overview

Enabling automatic updates means that each time CIPP releases a new version, a pull request (PR) is created in your GitHub repository. You simply approve and merge this PR to get the newest changes, no manual forking or syncing required.

1. Install the “Pull” GitHub App

2. Remove pull_request Triggers in Your Existing Workflow

To avoid conflicts, you’ll remove the lines that automatically trigger GitHub Actions on pull requests in your azure-static-web-apps workflow file:

Why Remove These Lines? They trigger the workflow whenever a PR is opened or updated—this can cause conflicts once Pull starts handling your updates, because you’ll end up with dueling triggers.

3. Approve Your First Automatic Update

When a new version of CIPP is released:

That’s it! Your repository will now stay in sync with the latest CIPP releases by simply merging new pull requests from the Pull app.

Common Questions

Q: Do I need to remove pull_request triggers in both CIPP and CIPP-API repos? A: Yes—if both repos have pull_request triggers in their .yml workflow files, remove them in each to avoid conflicts.

Q: What if I accidentally discard the Pull app’s PR? A: You can always open the “Closed” Pull Requests and revert that action, or let Pull create a new one. Just make sure you haven’t re-added the pull_request lines.

Q: Will my Azure deployment automatically pick up changes after I merge the PR? A: Yes—assuming your GitHub Actions workflow triggers on push to main, the Static Web App and Function App will redeploy within ~30 minutes.

Q: Do I still need to click “Sync Fork”? A: No—once Pull is set up, you won’t need to manually sync. The Pull app auto-creates a PR whenever upstream changes are detected.

You’re All Set!

With Pull handling your repository’s updates, your self-hosted CIPP instance will stay current with minimal effort. Just watch for those PR notifications, merge them, and enjoy the latest features!

Upon page load, CIPP will run an analysis on the user to identify common Indicators of Compromise (IoC). Once that analysis is returned, review the information presented and determine if the user has been compromised. The analysis performs the checks listed in the table below. A green check will indicate that information was found for the check and needs review.

Indicators of Compromise Checks

Actions

Walkthrough Steps for Setting Up Standards

Purpose

This guide walks you through setting up Standards in CIPP for the first time. It focuses on applying and managing standards to maintain security and compliance across your organization.

Accessing Standards

1. Navigate to Tenant Administration > Standards & Drift.

2. Here you'll be presented with a table of Standards templates and an action in the upper right to create new templates.

Reporting Options

Each standard offers three options:

• Report: Logs the current configuration in a Best Practices Report.

• Alert: Sends you a notification via the configured method in CIPP -> Application Settings -> Notifications.

• Remediate: Automatically applies the desired configuration.

Understanding Impact

• Each standard includes:

  • A description of what it does.

  • An impact label (Low, Medium, High) to indicate user impact.

• Review these details to ensure changes align with your needs.

Customizing Standards

Input Fields

• Some standards require settings, like custom text fields or dropdown selections.

• Enter the required values to customize the standard.

Categories

• Standards are grouped by categories, like security, compliance, or usability.

• There are over 150 standards (), with more added regularly.

Deploying Templates

• Use templates for consistent configurations across clients.

• Examples include templates for Intune, Exchange, and Conditional Access

Excluding Tenants

• Exclude specific tenants from All Tenants standards to:

  • Prevent global standards from applying.

  • Allow custom standards for that tenant only.

Template Reapplication

• Templates reapply every 3 hours, maintaining the desired state.

• If changes are made by admins, they are automatically reverted to match the template.

• Update a template once, and all linked tenants will receive the changes.

Run Standards Manually

• Use the Run Template Now options from the Actions menus.

• Apply standards immediately to:

  • A specific tenant by selecting (Currently Selected Tenant only) to match the tenant in the menu Tenant Selector.

  • All tenants in one go for all tenants in the template.

Key Takeaways

• Standards automatically reapply settings every 3 hours for consistency.

• Categories and templates simplify management across multiple tenants.

• Customization and manual runs give you flexibility to meet tenant-specific needs.

By following these steps, you’ll ensure your M365 tenants remain secure, consistent, and compliant with minimal manual effort.

The tenant selector at the top of CIPP allows you to control the currently managed tenant. Any changes to the tenant selector will reload the currently shown data to the one of the selected tenant.

Added functionality

The Tenant Selector has a building button to see the current tenant details. Clicking on this button allows you to view the following info directly from any page:

You can also use this page to jump to the most common portals or actions

Actions

• Manage Tenant - Opens

• M365 Portal

• Exchange Portal

• Entra Portal

Assign the “Contributor” Role to the Function App

If you're self-hosting and running your own Azure Function App, you'll need to grant it proper access:

PowerShell Role Assignment (Alternative)

You can also use Azure Cloud Shell:

Overview

The Groups page is equivalent to Microsoft 365 admin center > Active teams and groups. It offers an overview of all groups within the organization and allows users to manage group details and memberships.

Action Buttons

Show/Hide Members - This will toggle if the page displays a column to show the membership of the group. You may need to select the column to show from the table's column selector also.

Column Details

The properties returned are for the Graph resource type group. For more information on the properties please see the .

Table Actions

These actions and information are available in the flyout menu when you click the ellipsis button in the "Actions" column:

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

To get started you must follow or have the following ready. Click on the links for instructions on how to perform some of these tasks, or for more information on the functionality in question.

You’re Ready for Installation Once you’ve checked off these prerequisites, move on to the next page to set up your self-hosted instance. Happy CIPPing!

On this page you will enter all of the necessary information to create a group.

Group Types

Dynamic Group Parameters: For Dynamic Groups, a text box for entering the dynamic group parameters syntax becomes available e.g.: (user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest").

The report indicates whether inactive users have licenses assigned. It examines both interactive and non-interactive sign-in dates to determine this. This page lists all inactive users in the tenant who have not logged in for 180 days or more.

Table Columns

Table Actions

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

When you start a CIPP sponsorship, you can either:

• Continue self-hosting and receive support for that setup, or

• Use the version hosted by CyberDrain (fully managed).

If you decide to migrate from a self-hosted instance to our hosted environment, follow these steps:

1. Back Up Your Self-Hosted Instance

2. Deploy Your Hosted Instance

3. Transfer Your Key Vault Secrets

4. Restore Your Backup

5. (Optional) Custom Domain Cleanup

• If you used a custom domain on your self-hosted instance, remove it there first so you can reuse it in the hosted environment.

• In the Management Portal, add your custom domain to the hosted CIPP instance following the on-screen instructions.

That’s It!

Your instance and settings now live in the fully managed, CyberDrain-hosted version of CIPP.

Congratulations on a smooth migration! Enjoy your new, hosted CIPP with automatic updates and support.

CIPP saves Audit Logs when an alert matches the rules defined in your Alert Configuration.

Search Options

Select a time range in the Search Options to find Audit Log entries. Use the table filter to narrow down the results to what you are looking for.

Table Details

This will output a combined table of the various audit log alert entries that CIPP has collected. The table columns will vary based on the alert data structures.

Table Actions

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

This page will allow you to create a new application permission set of Microsoft Graph permissions.

Set a name for your new permission set, optionally import from an existing permission set, optionally add a service principal, and select the application and delegated permissions to add to the set.

This page allows you to view and manage your custom tenant groups. Groups can be used in easily including similar tenants in your Standards.

Action Buttons

Add Tenant Group

This flyout will allow you to create a new tenant group. Set the Group Name, Group Description, and initial tenants to add to the group.

How to Make a Dynamic Tenant Group

Create Default Groups

This will allow you to create a predefined set of tenant groups provided by CIPP. The default groups created are:

View Logs

This will open a flyout with a table of information on CIPP's processing of your dynamic tenant groups.

Table Details

Table Actions

This page displays all current configured Audit Log and Scripted Alerts for CIPP. It also allows you to remove alert rules.

Action Buttons

Table Details

Table Actions

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

The CIPP speed dial contains easy access to quick links for help with CIPP. The speed dial is located in the lower right corner of your browser window:

Options

This page will contain your application appoval templates.

Action Buttons

Deploy Template

This button will launch Application Approval.

Table Details

This table will include basic information on the template name, app id, app name, and permission set for your created templates.

Table Actions

This page will allow you to manage application permission settings to be used to approve and deploy applications to your client tenants.

Action Buttons

Table Details

This table will display the permission sets that you have created along with some basic information on the permission set.

Table Actions

This page provides an overview of the Secure Score of the tenant. The default page view is with each secure score component displayed as a card.

Filters

Card Actions

Feature Requests / Ideas

We value your feedback and ideas. Please raise any on GitHub.

Getting Started

• Navigate to: Identity Management > Administration > Users

The Group Templates page allows administrators to define templates for creating groups. These templates can speed up the process of creating new groups by pre-defining certain group parameters. Once a template is created, it can be reused multiple times to create new groups with similar settings.

Action Buttons

Overview

The Deploy Group Templates page provides an interface for creating and deploying group templates in Microsoft 365. This feature offers an easy and efficient way to manage group creation, allowing users to select from a list of pre-defined templates and apply them across chosen tenants.

This document provides a step-by-step guide on how to navigate and utilize the Deploy Group Templates page.

This guide walks you through deploying your self-hosted instance of CIPP using our Azure Resource Manager (ARM) templates. Once completed, you’ll have a fully functioning CIPP installation, ready to configure.

Confirm You’ve Met All Prerequisites

Before deploying, ensure you’ve completed everything in the section (forks, Azure subscription, GitHub PAT, etc.).

Choose Your Deployment Template

Initial User Setup

When you first set up CIPP, you will need to create your first user in one of two ways:

• For hosted clients, invites and roles can be managed by logging into the management portal

• For self-hosted users:

  • Go to the Azure Portal.

  • Go to your CIPP Resource Group.

Additional User Setup

Once you have your initial superadmin user added, you are now ready to finish the first setup. After completing the setup, you can return hereto set up additional users using the built-in roles or custom CIPP roles via .

Built-In Roles

CIPP features a role management system which utilizes the . The roles available in CIPP are as follows:

You can assign these roles to users using the page.

Custom Roles

While CIPP only supplies the above roles by default, you can create your own custom roles and apply them to your users with editor or readonly rights, admin users are unaffected by custom roles.

Set up Custom Roles by following these steps:

• Go to CIPP -> Advanced -> Super Admin -> CIPP Roles.

• Select a Custom Role from the list or start typing to create a new one if you do not yet have any.

  • Please ensure that your custom role is entirely in lowercase and does not contain spaces or special characters.

• Optionally select a Entra group this role will be mapped to. Adding an Entra group removes the requirement to add the user to either the SWA or inviting via the Management Portal.

Overview

The Tenant Onboarding Wizard further simplifies the process of getting setup in CIPP by automatically connecting to any tenants found in your GDAP Relationships List to perform the background tasks necessary to manage a tenant in the system. Below is a list of the actions that are performed during Tenant Onboarding:

• Verification of GDAP Invite Accepted

• Confirmation that required roles are present.

• Ensures groups are correctly mapped to roles.

• Validates that permissions are updated via a CPV refresh

• Verifies Graph API connectivity and access.

Methods of adding a tenant

We currently support two methods of connecting to Microsoft Tenants, using a direct connection or a GDAP connection. It's recommended to setup a GDAP relationship with your clients, but in some cases, this is not always possible due to transaction regions or other potential blockers.

GDAP

Prerequisites

CIPP relies on use of GDAP role templates for proper onboarding of tenants. Prior to using the tenant onboarding wizard, you should create a role template. To create the CIPP Defaults role template navigate to Tenant Administration-> GDAP Management-> Role Templates. Click the "+ Create CIPP Defaults" button. You can alternatively create your own templates but be sure to include the recommended roles for full CIPP functionality.

Using the Tenant Onboarding Wizard

Navigate to Tenant Administration -> GDAP Management-> Relationships

Direct Tenant Add

To directly add a tenant, go to the and select "Add a Tenant" - Make sure you log into a tenant using a service account. This tenant is added to the list of managed tenants immediately.

Limitations of Direct Tenants

There are limitations to what CIPP can do with directly added tenants due to some features relying on Lighthouse, Partner Center APIs, etc.

• Permissions errors during addition of the tenant

  • Consent can only be granted for permissions the direct tenant is licensed for.

  • To work around this until a more robust method can be devised, if you see one of these errors, remove the offending permission (NOT THE CONSENT) from the CIPP-SAM app registration in your tenant.

• Universal Search - This relies on Lighthouse to search for users

View User

The View User page provides a comprehensive overview of user details and settings. It serves as the main landing page when viewing a user, with additional tabs available for more specific operations, such as Edit User, Compromise Remediation, etc.

Overview

• Primary display of user information including a quick link to view the user in Entra

• Additional tabs at top for extended functionality (Edit, Compromise Remediation, etc.)

• Inherits Actions dropdown from list users page

Actions

The actions dropdown carries forward the same from the main Users page.

User Information Fields

Profile & Identity

Licensing & Contact