Introduction

Welcome to the CIPP User Documentation! CIPP (pronounced "sip") is the CyberDrain Improved Partner Portal, a powerful Microsoft 365 multitenant management system designed to help MSPs streamline their clients' Microsoft 365 administration tasks. Created by Kelvin Tegelaar in 2021, CIPP aims to fill the gaps left by existing multi-tenant management solutions, making it easy and efficient to manage multiple clients from one centralized portal experience.

CIPP consists of two main components: the CIPP UI and the CIPP API. The frontend is built using React and Core UI, while the API is built with PowerShell. The system leverages Azure Functions and Azure Static Web Apps to provide a fast, responsive, and maintainable solution.

Key Features

• Central User Management: CIPP offers a simple user management interface, making it easy to add, edit, and delete users, offboard users, change calendar permissions, manage shared mailboxes, and more.

• Easy Standardization: Deploy standards across your entire client base, ensuring tenants are always in the desired state. CIPP's alerting and best practices features help you provide the best experience for your clients.

• Secure and Report: CIPP includes industry best-practice standards and integrations, allowing you to report on everything in your M365 tenants and secure your customers' environments.

Documentation Components

The documentation is organized into the following components:

1. Setup Documentation: This section covers the initial setup process of deploying your own instance of CIPP, including system requirements, installation, and configuration.

2. User Documentation: Here, you'll find detailed guides and tutorials on how to use the CIPP platform once it's been deployed to manage your clients' Microsoft 365 tenants.

3. Developer Documentation: If you're looking to extend the functionality of CIPP or integrate it with other tools and services, the Developer Documentation provides API documentation, custom scripting, and other advanced topics for developers.

In addition to the core documentation components, we also provide a Troubleshooting Guide and an FAQ section to help you quickly resolve common issues and find answers to frequently asked questions.

CIPP is an open-source project, and we encourage users to review the code and contribute to its ongoing development. For more information about the project, its contributors, and funding, please refer to the documentation in the relevant sections.

We hope this documentation serves as a valuable resource as you explore and utilize the CyberDrain Improved Partner Portal. If you have any questions or need further assistance, please don't hesitate to check us out in discord.

Our Sponsors

This guide walks you through deploying your self-hosted instance of CIPP using our Azure Resource Manager (ARM) templates. Once completed, you’ll have a fully functioning CIPP installation, ready to configure.

Confirm You’ve Met All Prerequisites

Before deploying, ensure you’ve completed everything in the Prerequisites section (forks, Azure subscription, GitHub PAT, etc.).

Choose Your Deployment Template

When you start a CIPP sponsorship, you can either:

• Continue self-hosting and receive support for that setup, or

• Use the version hosted by CyberDrain (fully managed).

If you decide to migrate from a self-hosted instance to our hosted environment, follow these steps:

1. Back Up Your Self-Hosted Instance

2. Deploy Your Hosted Instance

3. Transfer Your Key Vault Secrets

4. Restore Your Backup

5. (Optional) Custom Domain Cleanup

• If you used a custom domain on your self-hosted instance, remove it there first so you can reuse it in the hosted environment.

• In the Management Portal, add your custom domain to the hosted CIPP instance following the on-screen instructions.

That’s It!

Your instance and settings now live in the fully managed, CyberDrain-hosted version of CIPP.

Congratulations on a smooth migration! Enjoy your new, hosted CIPP with automatic updates and support.

To get started you must follow or have the following ready. Click on the links for instructions on how to perform some of these tasks, or for more information on the functionality in question.

You’re Ready for Installation Once you’ve checked off these prerequisites, move on to the next page to set up your self-hosted instance. Happy CIPPing!

Once your CIPP installation completes successfully, follow the steps below to finalize access and roles.

Tip: If you see a red “X” in your deployment status, the install failed. Delete the resource group in the Azure Portal and redeploy.

For Self-Hosted Deployments

Add Yourself as an Admin

Test Your Access

Next Steps

With user access established, you can:

• Invite other team members or clients (using the same Role Management process or the management portal for hosted users.).

• Configure advanced settings (e.g., custom domains, environment variables, or additional roles).

Congratulations! You’re now ready to use CIPP for tenant management in your Azure environment.

Most Azure Function Apps can be deployed using various methods, but Run From Package is a streamlined, read-only approach that pins your Function App’s code to a zip file. This method:

• Ensures consistent deployment (updates happen atomically when the package is replaced).

• Makes rollback and troubleshooting simpler.

• Often leads to faster cold starts since your code is pre-packaged and ready to go.

1. Verify “Run From Package” in Your Existing Deployment

If you used our ARM template from the Installation page, your Function App should already be in Run From Package mode, deploying from the latest.zip file. To confirm:

2. Connect to GitHub for Continuous Deployment

If you want your Function App to auto-update whenever you commit to your CIPP-API fork, follow these steps:

3. Done!

Your Function App will now be automatically updated pull directly from your GitHub fork whenever you push commits to the selected branch. For day-to-day development, this means less manual deployment and faster iteration on your CIPP-API codebase.

If you run into any snags:

• Check the Azure Portal’s Logs under your Function App.

• Review your GitHub Actions logs for build/deployment errors.

That’s it! You’re now set up for streamlined, package-based deployments with automatic updates.

Update your self-hosted CIPP instance to the latest release using the following instructions:

1. Sync Your Fork(s) in GitHub

For typical updates (e.g., moving from any v7+ patch releases):

2. Updating from v6 (or Older) to v7+

The v7 front-end introduced a Next.js + Material-UI stack, so older forks might need an extra step:

3. Updating from v6 (or Older) to v7+ (Merge Conflicts)

In many cases, there are so many changes to the repo that GitHub doesn't know how to properly merge your repo with the upstream repo. Follow these instructions to get your branch to update.

“I Accidentally Discarded Changes” (The Common GitHub Pitfall)

If you accidentally chose Discard (X) Commits while syncing your fork, you might have lost the original azure-static-web-apps workflow file. This often leads to:

• “No changes to commit” messages,

• A stuck or outdated front-end version,

• Confusion about missing .yml files.

Recreate the Workflow File

Done & Dusted

At this point, your CIPP front-end and API should be updated to the latest release. Keep these key points in mind:

1. Never click “Discard Commits” when syncing.

2. Watch for the .github/workflows files if you suspect deployment issues.

3. Hard-refresh or wait for CDN caches to clear for a truly up-to-date view

Congratulations! You’re now up-to-date and ready to use the newest features.

What is GDAP

GDAP allows you to access your clients tenants according to the role you've set. This means you are able to give one employee "helpdesk" access, and another employee "security" access.

GDAP requires a mapping between roles and security groups in your partner tenant. CIPP creates these groups and mappings for you. Do not select all roles. This is not supported by Microsoft and CIPP. Selecting all roles (or most roles) will guarantee unexpected results. Carefully consider which roles are required for your deployment.

If you did not perform GDAP migration of your tenants via CIPP or believe you need to setup new GDAP relationships:

The next few pages will walk you through the setting up of a CIPP Service Account, and the best practices you will need to follow within your microsoft environments to ensure you dont run into any issues.

It is important this account is setup correctly to ensure a seamless process when you get into CIPP and start the onboarding process.

Setup Video for the CIPP Service Account

Setup Walkthrough for the CIPP Service Account

This guide walks you through the process from the video of setting up the CIPP Service Account. Follow the instructions on this page to the letter to ensure a seamless setup process down the line.

The CIPP service account will be the account used to execute any actions on your tenants via CIPP.

If you would like to use notifications, webhook triggers, or exporting to other system the account you use must have a mailbox available. This mailbox will be used for outgoing reports, exports, and notifications.

1. Click on the "New user" button.

1. Create a new internal user in your organization

1. Enter a username in the field, we recommend something identifiable like "CIPP Service Account"

1. Enter "CIPP Service Account" in the Display Name field. Set the password to something strong, and save this password in a secure location

1. Click on "Next: Properties".

1. Click on "Next: Assignments".

1. If you are a Microsoft Partner, and want to manage all your client tenants, click on Add Group.

1. Select the AdminAgents group. This group is required for connection to the Microsoft Partner API.

1. Select your GDAP groups

1. Click "Add role"

1. Add the Global Administrator Role

Find the Global Admin role. This role is required for the CIPP-SAM application creation, and is recommended to be removed directly after installation.

1. Click "Next: Review + create"

1. Click on "Create". This creates the account.

As CIPP is an application that touches many parts of M365 selecting the roles might be difficult. The following roles are recommended for CIPP, but you may experiment with less permissive groups at your own risk.

Additional Recommended Roles

These roles are not currently configured with functionality within CIPP but will begin to be incorporated over time. These are the roles that Microsoft recommends in addition to the 12 above to give MSPs the most similar experience of a global administrator without needing global administrator access. Currently these are helpful for enabling them to do things in the native Microsoft portals.

Overview

Enabling automatic updates means that each time CIPP releases a new version, a pull request (PR) is created in your GitHub repository. You simply approve and merge this PR to get the newest changes, no manual forking or syncing required.

1. Install the “Pull” GitHub App

2. Remove pull_request Triggers in Your Existing Workflow

To avoid conflicts, you’ll remove the lines that automatically trigger GitHub Actions on pull requests in your azure-static-web-apps workflow file:

Why Remove These Lines? They trigger the workflow whenever a PR is opened or updated—this can cause conflicts once Pull starts handling your updates, because you’ll end up with dueling triggers.

3. Approve Your First Automatic Update

When a new version of CIPP is released:

That’s it! Your repository will now stay in sync with the latest CIPP releases by simply merging new pull requests from the Pull app.

Common Questions

Q: Do I need to remove pull_request triggers in both CIPP and CIPP-API repos? A: Yes—if both repos have pull_request triggers in their .yml workflow files, remove them in each to avoid conflicts.

Q: What if I accidentally discard the Pull app’s PR? A: You can always open the “Closed” Pull Requests and revert that action, or let Pull create a new one. Just make sure you haven’t re-added the pull_request lines.

Q: Will my Azure deployment automatically pick up changes after I merge the PR? A: Yes—assuming your GitHub Actions workflow triggers on push to main, the Static Web App and Function App will redeploy within ~30 minutes.

Q: Do I still need to click “Sync Fork”? A: No—once Pull is set up, you won’t need to manually sync. The Pull app auto-creates a PR whenever upstream changes are detected.

You’re All Set!

With Pull handling your repository’s updates, your self-hosted CIPP instance will stay current with minimal effort. Just watch for those PR notifications, merge them, and enjoy the latest features!

Introduction

This section of the documentation will walk you through the process of setting up the CyberDrain Improved Partner Portal (CIPP) to manage your clients' tenants efficiently.

CIPP is a powerful Microsoft 365 multitenant management system that will allow you to deploy standard properties across all your tenants, easily manage everything from a single portal, and keep your managed environments in the best shape.

How will you be planning to use CIPP?

Depending on how you will deploy the software will determine where you will want to start.

Walkthrough Video for Running the SAM Setup Wizard

This guide walks you through the process from the video of executing the SAM Wizard inside CIPP for the first time, and has 3 options based on what you're looking to accomplish. In this example, we use the first-time setup option, but more details on additional options can be found in the sections below.

Walkthrough Steps for Running the SAM Setup Wizard

1. Once you've logged into your CIPP instance, navigate to Settings -> SAM Setup Wizard

1. For the purposes of this walkthrough, we'll act as if this is your first time running through this process, and you'd like to follow CIPP's recommended settings by clicking I would like CIPP to create an application for me.

1. On the next page, click on the Start Setup Wizard button.

1. Copy the code from the returned step to your clipboard.

1. Then click on the "HERE" link beside the code.

1. Enter the code we've copied in the previous step & click Next.

1. Select the option "Use another account".

1. Click on the "Continue" button. You may close this window when prompted.

1. Back in CIPP, click on the link that now appears when you see we've arrived at step number 2.

1. Login with the CIPP Service Account again.

1. Click on the Accept button. This will forward you to the page that reports the authentication status. You may close this page when instructed.

1. Back in CIPP, you should see it says "Setup Completed". You can now click on the "Application Settings" button.

1. From there, you'll want to click on the "Run Permissions Check" button. This check should show a successful result when all steps have been performed.

User Roles within CIPP

Adding Users via the Management App for Hosted Deployments

Hosted clients can use the backend management system to add and remove users.

1. Go to management.cipp.app.

2. Navigate to the User Management tab.

3. Enter the UPN for the user in the Email field. Ensure this matches the user's M365 UPN.

4. Assign the appropriate roles for the user.

Adding Users via Azure for Self Hosted Deployments

After deployment you'll need to give each user access. To generate an invite for a user follow these steps:

• Go to the Azure Portal.

• Go to your CIPP Resource Group.

• Select your CIPP Static Web App CIPP-SWA-XXXX.

• Select Role Management (Not IAM Role Management).

• Select invite user.

• Enter the UPN for the user. It is important to make sure that this matches the M365 UPN.

• Add the roles for the user.

Overview

The GDAP Invite Wizard simplifies setting up GDAP relationships with your clients by assigning the correct roles and ensuring the CIPP-SAM application is correctly configured for each tenant. To get started with generating GDAP invites inside CIPP, navigate to Tenant Administration -> GDAP Management and follow the instructions below.

Wizard Steps

Step 1: Click on Add Tenant

To get started, we click the "Add Tenant" button. The overview page shows you your current GDAP configuration

Step 2: Generate CIPP Default Template

If you have never used the GDAP wizard before, you will have the option to generate the CIPP Defaults Template. This template allows you to create the optimal role configuration for CIPP.

Step 3: Select GDAP Role Template and generate invites

Choose the role template to use from the list of role templates, and choose the amount of invites you'd like to generate. You can use this to generate the exact amount of invites for tenants you'd like to onboard.

Post-Invite Actions

After submission, you will see as many rows as invites you've requested, with two URLs in a table:

• Invite Link: This URL is for the Global Administrator in your client tenant to accept the invite.

• Onboarding Link: This URL is to be used by a CIPP admin to complete the onboarding process. It should not be used under a client account.

Role Management Considerations

Any additional users who need access to your Microsoft CSP Tenants must be manually added to the relevant security groups. These groups start with "M365 GDAP".

Hosted Clients

Adding a Custom Domain Name

Why setup a custom domain?

1. The automatically generated domain uses azurewebsites.net which is often blocked by web filtering products as it's often used by spammers and phishing sites due to the ease of obtaining an azurewebsites.net subdomain.

2. Your bookmark stays the same if you redeploy.

3. Easier to communicate internally and looks better for your team.

At the moment of deployment, the application uses a generated domain name. To change this follow these instructions:

• Go to CIPPs Settings menu

• Click on 'Static Web app - Role Management'

• Select Custom Domains. You can add your own domain name here.

For more information see Microsoft's documentation at Microsoft Docs - Set up a custom domain with free certificate in Azure Static Web Apps

CIPP utilizes the Secure Application model, which means that each action will be done under the user permissions of the CIPP-SAM user. To limit the access users have you can use the role management system.

For hosted clients, invites and roles can be managed by logging into the management portal here

CIPP features a role management system which utilises the Roles feature of Azure Static Web Apps. The roles available in CIPP are as follows:

You can assign these roles to users using the Role Management system of Azure Static Web Apps

To assign a role to a user you would follow these steps:

• Go to the Azure Portal.

• Go to your CIPP Resource Group.

• Select your CIPP Static Web App CIPP-SWA-XXXX.

• Select Role Management (Not IAM Role Management).

• Select invite user.

• Add the roles for the user. Multiple roles can be applied to the same user.

Custom Roles

While CIPP only supplies the above roles by default, you can create your own Custom Roles and apply them to your users with 'editor' or 'readonly' rights, admin users are unaffected by custom roles. Set up Custom Roles by following these steps:

• Go to CIPP -> Advanced > Super Admin > Custom Roles.

• Select a Custom Role from the list or start typing to create a new one if you do not yet have any.

  • Please ensure that your custom role is entirely in lowercase and does not contain spaces or special characters.

• For Allowed Tenants select a subset of tenants to manage or AllTenants.

  • If AllTenants is selected, you can block a subset of tenants using Blocked Tenants.

• Select the API permission from the listed categories and choose from None, Read or Read/Write.

  • To find out which API endpoints are affected by these selections, click on the Info button.

If you are a hosted client, you can add custom roles to your users from the Management App. Just start typing the role name in the select box and add it when prompted. Make sure that your users have the 'editor' or 'readonly' role selected as well.

If you set up Custom Roles by modifying staticwebapp.config.json, you should revert those changes and migrate to the new Custom Role management.

Overview

The Tenant Onboarding Wizard further simplifies the process of getting setup in CIPP by automatically connecting to any tenants found in your GDAP Relationships List to perform the background tasks necessary to manage a tenant in the system. Below is a list of the actions that are performed during Tenant Onboarding:

• Verification of GDAP Invite Accepted

• Confirmation that required roles are present.

• Ensures groups are correctly mapped to roles.

• Validates that permissions are updated via a CPV refresh

• Verifies Graph API connectivity and access.

Using the Tenant Onboarding Wizard

Navigate to Tenant Administration -> Administration -> Tenant Onboarding and click Start Tenant Onboarding to initiate the wizard.

Step 1: Relationship Choice

• Choose the GDAP relationship(s) to onboard.

• Filter and select from the list of active relationships.

Step 2: Onboarding Options

• Toggle on Exclude this tenant from top-level standards if needed. This means that only the standards you explicitly set for this tenant will be applied.

• Toggle on Map missing groups to GDAP Roles.

• Toggle on Add CIPP SAM user to missing groups if any required GDAP groups are missing.

Step 3: Tenant Onboarding

• Click Next and wait for the wizard to complete the onboarding steps.

• Review the onboarding status and logs to ensure successful completion of each step.

Manual Steps

After adding a relationship, you can perform a CPV refresh via the following instructions. This also runs automatically each night

• Navigate to CIPP -> Application Settings

• Click on the Tenants tab

• Click on the blue refresh button next to the tenant. This will process all required permissions to that tenant.

If you want to manage your own tenant or if you are not a Microsoft Partner but still want to use CIPP you can perform the setup and enable access to the partner tenant or enable Single Tenant Mode. The CIPP Service Account should be granted at least the Recommended Roles within the tenant being managed.

There are 3 different modes in CIPP to choose from:

• Multi Tenant - GDAP mode

  • This is the default mode in CIPP, it does not allow access to the partner tenant.

• Multi Tenant - Add Partner Tenant

  • This mode allows access to the partner tenant and customers via GDAP. See the Limitations below for more details.

• Single Tenant - Own Tenant Mode

  • This mode is for if you would like to manage your own tenant and/or are not a Microsoft Partner. See the limitations below for more details.

Limitations Single Tenant Mode

When using Single Tenant Mode CIPP runs in a somewhat more limited state - You are not able to add any other tenant to CIPP and it only works for the configured tenant. GDAP permissions will not apply, and you must directly assigned roles such as Global Admin to the service account.

Limitations Partner Tenant Enabled

When using Partner Tenant Enabled mode you can see your partner tenant inside of CIPP. There will be no permissions applied to whom can see this tenant and control it.

GDAP permissions will not apply and you must directly assign roles to the service account in the Entra portal (e.g. User Administrator, Exchange Administrator, etc.).

To set the tenant mode, follow these steps

1. Add the role 'superadmin' to your admin user as an additional role. This role will allow you access to the menu to change this setting.

2. Go to the Application Settings menu

3. Go to the SuperAdmin tab

4. Select one of the three modes. The default mode is "Multi Tenant - GDAP Mode"

5. Clear the tenant cache. Users of CIPP now have access to the CSP Partner tenant, or to the single tenant it's been configured for.

Walkthrough Steps for Setting Up Standards

Purpose

This guide walks you through setting up Standards in CIPP for the first time. It focuses on applying and managing standards to maintain security and compliance across your organization.

Accessing Standards

1. Navigate to Tenant Administration > Standards.

2. Click Edit Standards to manage or add new standards.

   • Example: Add an "All Tenants" standard to apply settings across all tenants.

Reporting Options

Each standard offers three options:

• Report: Logs the current configuration in a Best Practices Report.

• Alert: Sends notifications (via ticket, email, or webhook).

• Remediate: Automatically applies the desired configuration.

Note: Turning off Remediate prevents future fixes but doesn’t undo changes already applied.

Understanding Impact

• Each standard includes:

  • A description of what it does.

  • An impact label (Low, Medium, High) to indicate user impact.

• Review these details to ensure changes align with your needs.

Customizing Standards

Input Fields

• Some standards require settings, like custom text fields or dropdown selections.

• Enter the required values to customize the standard.

Categories

• Standards are grouped by categories, like security, compliance, or usability.

Deploying Templates

• Use templates for consistent configurations across clients.

• Examples include templates for Intune, Exchange, and Conditional Access

Template Reapplication

• Templates reapply every 3 hours, maintaining the desired state.

• If changes are made by admins, they are automatically reverted to match the template.

• Update a template once, and all linked tenants will receive the changes.

Run Standards Manually

• Use the Run Now option at the top of the Standards page.

• Apply standards immediately to:

  • A specific tenant.

  • All tenants in one go.

Excluding Tenants

• Exclude specific tenants from All Tenants standards to:

  • Prevent global standards from applying.

  • Allow custom standards for that tenant only.

Key Takeaways

• Standards automatically reapply settings every 3 hours for consistency.

• Categories and templates simplify management across multiple tenants.

• Customization and manual runs give you flexibility to meet tenant-specific needs.

By following these steps, you’ll ensure your M365 tenants remain secure, consistent, and compliant with minimal manual effort.

Welcome to the post-setup implementation guide for CIPP! In this guide, you will learn how to navigate and configure various settings within the CIPP application. Let's discover some of the key features of CIPP and see how to use them.

Tenant Navigation

Using the Tenant Selector at the top you can switch tenants at any time. This allows you to dynamically choose what you're working on. You can also use the Tenant Selector to select "All Tenants" which allows you to see all your tenants in one swoop.

Personalization

Let's setup some personal things first. The user settings section has your personal preferences and profile information. Let's start by setting up CIPP the way you like it.

Usage Location

The Default Usage Location is used each time you create a new user. Set this up here to prevent having to enter it each time you create a new M365 user.

Change how CIPP looks to you.

Go to the Appearance section and select the desired theme, page size, and report image.

Page Table Sizes

You can set page table sizes to whatever number you want. The default is 25.

By clicking save settings, you save this profile for you, no matter what computer you move to.

By clicking Save for all users, you save this profile for all the users of the app. This becomes their default.

Application Settings

Let's go check out some of the application settings next.

Password Styles

We have two style of passwords we can generate when creating a new user, or resetting a password, the classic password with capitalization, numbers, and symbols. You can also choose the modern passphrase style password. This is a more readable and often stronger password than randomly generated characters

Let's select the "Correct-Battery-Horse" option, which are passphrases.

DNS Resolver

You can choose the DNS resolver CIPP uses. By default the resolver is Google.

Access Checks

CIPP can help you figure out why you can't access a tenant by executing an access check. These checks can help you detect issues with GDAP, access rights, or general M365 issues.

Tenants Tab

Talking about tenants, let's go check out our internal tenant list. In this section we see all our tenants.

Using the highlighted button we can exclude a tenant from CIPP. This means the tenant will not be connected to CIPP, and we will not be able to make any changes to this tenant.

Notifications Tab

Navigate to the Notifications section.

CIPP can send many types of notifications, in this screen we can do some of the basic setup of these notifications to filter them, or select where they need to go.

User Administration

Let's see how CIPP works in action. We'll navigate to the Administration section to start managing users.

Navigate to the Users section.

Bulk Actions

Most pages in CIPP work by showing you a table layout. The table allows you to filter data, export it, or execute actions. Let's try executing some bulk actions.

Setting the checkbox means we are going to take a bulk action on that specific row in our table.

You'll find all available actions in the "Actions" dropdown. Each page has different actions.

Let's look at some more of the options we have. Most tables in CIPP have a three-dot action menu, next to bulk actions. This three dot menu gives you a flyout with options and information about that specific row.

For users, we have a lot of actions we can take. We could reset passwords or even add them to groups. Let's not bother our users and check out some other parts of CIPP for now.

Tools

Navigate to the Tools section.

Graph Explorer

Select the "Graph Explorer" option.

CIPP has the option to report on anything inside of the Graph API. even when there is not a direct page created for it. You can use the Graph Explorer option to craft your own report. Let's try using the All User with Email Addresses report.

Execute the query by clicking "Query".

The report allows you to check this data as raw as it comes back from the API. you can also create an export using the PDF or CSV buttons.

Standards

Let's go check out the standards next by clicking on "Edit Standards"

Standards allow you to create a baseline for a tenant. This means you can easily deploy your wanted settings to any tenant. If you want to see more about standards, check out the documentation about the standards on the Standards page.

Best Practice Analyser

Let's go check out some reporting. Click on Best Practice Analyzer next.

The BPA gives you the ability to zoom in on your tenants and their current state. You can use custom reports, or use the included examples to tell your clients what actions they need to take to become more secure.

Alerts (Classic)

Talking about best practices. You want to be notified when something goes wrong, so let's look at some of the alert options.

Alert Rules

the classic alerts are alerts that run on a schedule, and check by executing a script towards the tenant. We also have the option to receive alerts from Microsoft directly. Let's go check that out.

Options

Select the option for the specific action you want to perform, such as creating a new Inbox rule or editing an existing one. There is a list of default options, and none of these require a specific M 3 6 5 subscription. This means you can alert on logons from strange locations, VPN or anonymized IPs without needing to buy P1 subscriptions for all your clients.

Tenant Administration

Let's try managing our tenants next. Click on Administration and then Tenants.

Tenant Overview

The tenant overview shows you your tenant names, default domains, and direct links to each of the portals. You can use these links to directly manage that tenant using GDAP.

Tenant Actions

We can also take actions on the tenants. Let's try using the three dot icon to do so.

You'll find some more information about the tenant in this flyout, and you can edit a tenant. This allows you to change the tenant display name or defaultDomainName inside of your partner environment. Changes made there only reflect your partner side, and not the client's actual environment.

There are so many more features, but now that you've understood the basics you can find more of the features yourself. We hope you enjoyed the walkthrough of the basic settings. You're now ready to deep dive into the platform.

The tenant selector at the top of CIPP allows you to control the currently managed tenant. Any changes to the tenant selector will reload the currently shown data to the one of the selected tenant.

Added functionality

The Tenant Selector has a building button to see the current tenant details. Clicking on this button allows you to view the following info directly from any page:

You can also use this page to jump to the most common portals or actions

Actions

• M365 Portal

• Exchange Portal

• Entra Portal

• Teams Portal

• Azure Portal

• Intune Portal

• Security Portal

• Sharepoint Admin

Clicking this icon will display pages that you have added to your bookmarks.

The User Preferences page provides a tailored interface for users to manage and configure their individual settings related to general preferences, appearance, and offboarding defaults. This document outlines the functionalities available on the User Settings page.

General Settings

In this section, users can manage general settings related to their account and workspace:

• Added Attributes when creating a new user: Users can select additional user object attributes that are available when creating a new user.

• Default new user usage location: This setting allows users to specify the default user location when creating or editing a user.

• Default Page Size: Set the default page size for tables across CIPP.

• Menu Favourites: Set pages that will display in your favourites section.

Offboarding Defaults

This section provides you the ability to set offboarding defaults, this allows you to easily preselect your predefined offboarding preferences.

Actions

• Save Settings: Save the modified settings for the individual user.

• Save for All Users: If the user has admin privileges, they have the option to save the modified settings for all users within the tenant, this will overwrite all personal settings and be force on each full refresh of a page.

Developer Options

• Enable TanStack Query Tools

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.

Use of the magnifying glass in the menu bar will pop open a search modal. You can use this feature to quickly locate a page within CIPP without having to navigate the sidebar menu.

The CIPP speed dial contains easy access to quick links for help with CIPP. The speed dial is located in the lower right corner of your browser window:

Options

The Home page provides a comprehensive overview of the current tenant's details and allows you to perform various actions related to the tenant and its resources.

The Home page includes the following sections:

• Universal Search: This is a universal search bar that allows you to quickly find the information you need using Lighthouse. To utilize this search, you must have onboarded Lighthouse on your partner tenant.

• Portals: Contains links to various Microsoft 365 administration centers.

• Current Tenant: Displays various details about the current tenant:

  • Tenant Name

  • Tenant ID

  • Default Domain

  • AD Sync Enabled

  • Users: Total, Licensed, Guests and Global Admins. Note: The chart names are clickable.

  • Standards set: Shows the applied Remediation, Alert and Report standards set.

  • SharePoint Quota

  • Domain Names

  • Partner Relationships

  • Tenant Capabilities

This page will allow you to add a guest user. Enter the user's "Display Name", "E-mail Address", and an optional "Redirect URL". Toggle the "Send invite via e-mail option on if you'd like the guest user to receive a Microsoft generated invite e-mail.

If you've started the sponsorship process and are ready to enhance your management of Microsoft 365 tenants with efficiency, this guide is designed to get you started.

Initial Sponsorship Actions

Deployment & Service Account Creation

Accessing CIPP & Executing SAM Wizard

Managing Client Relationships

Overview

The main table provides an overview of information including display name, email address, licensing, enabled/disabled status, and if the account is AD synchronized. Behind the ellipsis menu user creation date, last sync date, and user GUID are also available.

Actions

Per-User Actions:

Account Management Actions

Security Actions

Password Management

Mail and Communication

OneDrive Management

Group and Directory Management

Information Access

Create Temporary Access Password

Query String Support

The Add User has the ability to be form filled via URL query strings. This table shows all supported query strings. For example https://yourcipp.app/identity/administration/users/add?customerId=Mydomain.onmicrosoft.com&city=Rotterdam would automatically fill in the city for a user.

AutoTask LiveLink

If you want to create your own LiveLink you can use the QueryString below.

Getting Started

1. Navigate to: Identity Management > Administration > Users

2. Click Add User

3. Choose your starting point:

   • Start with blank form

   • Use "Copy properties from another user" dropdown to pre-fill fields

Available Settings

Basic Information

1. User Identity: First Name, Last Name, Display Name, Username (before the @ symbol), Primary Domain name (select from dropdown)

2. Email Aliases: Add multiple email aliases one per line without domain (added automatically)

Account Settings

1. Password Options

   • Create password manually (toggle)

     • When enabled: Enter custom password

     • When disabled: System generates secure password

   • Require password change at next logon (toggle)

2. Location Settings

   • Usage Location (required for licensing)

   • Select country from dropdown

License Management

1. License Assignment: Allows you to select license(s) to assign & shows available license count

2. SherWeb Integration (if enabled): Auto-purchase option appears when licenses unavailable, allows you to select license SKU for purchase for system to handle for you along with onboarding.

Contact Information

1. Professional Details: Job Title, Department, Company Name

2. Contact Details: Street Address, Postal Code, Mobile Phone, Business Phone, Alternate Email Address

3. Management: Set Manager (select from existing users), Copy groups from another user

4. Custom Attributes

   • Custom attributes can be configured in Preferences > General Settings

   • These include specific Azure AD attributes that will be available when creating new users:

   • Available Attributes: consentProvidedForMinor, employeeId, employeeHireDate, employeeLeaveDateTime, employeeType, faxNumber,legalAgeGroupClassification, officeLocation, otherMails, showInAddressList, state

   • Configuration:

     • Go to Preferences page under your user profile.

     • Under General Settings

     • Find Added Attributes when creating a new user

     • Select desired attributes from dropdown

     • Selected attributes will appear on Add User form

Additional Details

• License assignment requires valid usage location

• Password complexity rules apply to manual passwords

• Group copying includes all accessible groups

• Scheduled creation can be monitored in tasks

Actions Drop Down

Exchange Details

Expandable Actions in Info Area

The table below outlines the keyboard shortcuts that have been enabled in CIPP.

This page lists the tenant's risky users. Here, you can review the information associated with the risk detection.

Actions

• Dismiss Risk - This action will mark the risk as dismissed.

• More Info - Displays the Extended Info flyout.

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.

View User

The View User page provides a comprehensive overview of user details and settings. It serves as the main landing page when viewing a user, with additional tabs available for more specific operations, such as Edit User, Compromise Remediation, etc.

Overview

• Primary display of user information including a quick link to view the user in Entra

• Additional tabs at top for extended functionality (Edit, Compromise Remediation, etc.)

• Inherits Actions dropdown from list users page

Actions

The actions dropdown carries forward the same actions from the list users page.

User Information Fields

Profile & Identity

Licensing & Contact

Professional Information

Address Information

Security & Access

Group & Role Memberships

Notes

• Information is read-only in this view

• Use Edit tab to modify information

• Expandable sections (▼) provide additional details

• Direct links to related management pages

• Real-time data from Entra ID/Azure AD

This view serves as the central hub for user information, providing quick access to both basic details and advanced management options through the tabbed interface.

This wizard will allow you to bulk create new users.

Getting Started

• Navigate to: Identity Management > Administration > Users

• Select a user > Click Edit User in the Actions menu

• You will be landed on the "Edit User" tab.

Page Layout

Header Information on this page displays the user's Display Name, their User Principal Name (with copy option), their User ID (with copy option, the Account Creation Date, and a button to launch Entra to view the user.

Basic Information

1. User Identity: First Name, Last Name, Display Name, Username (before the @ symbol), Primary Domain name (select from dropdown)

2. Email Aliases: Add multiple email aliases one per line without domain (added automatically)

3. Professional Details: Job Title, Department, Company Name

4. Contact Details: Street Address, Postal Code, Mobile Phone, Business Phone, Alternate Email Address

5. Management: Set Manager (select from existing users), Copy groups from another user

Account Settings

1. Password Options

   • Create password manually (toggle)

     • When enabled: Enter custom password

     • When disabled: System generates secure password

   • Require password change at next logon (toggle)

2. Location Settings

   • Usage Location (required for licensing)

   • Select country from dropdown

License Management

• Current Licenses

  • Shows currently assigned licenses

  • Drop down box allows you to multi-select the licenses you want the user to have after editing

  • Option to remove all licenses (toggle)

• SherWeb Integration (if enabled)

  • Auto-purchase option appears when licenses unavailable

  • Select license SKU for purchase

  • System handles purchase and assignment

Group Management

• Copy groups from user

  • Allows you to select another Entra ID user to copy groups from

• Add to Groups

  • Multi-select dropdown that will allow you to add the user to groups

Custom Attributes

• Custom attributes can be configured in Preferences > General Settings

• These include specific Azure AD attributes that will be available when creating new users:

• Available Attributes: consentProvidedForMinor, employeeId, employeeHireDate, employeeLeaveDateTime, employeeType, faxNumber,legalAgeGroupClassification, officeLocation, otherMails, showInAddressList, state

• Configuration:

  • Go to Preferences page under your user profile.

  • Under General Settings

  • Find Added Attributes when creating a new user

  • Select desired attributes from dropdown

  • Selected attributes will appear on Add User form

Notes

• Changes take effect immediately upon saving

• License changes require valid usage location

• Password resets follow complexity requirements

• Group membership changes are processed in order (removals then additions)

• On-premises synced accounts show warning about limited editability

This page displays the following information:

• Members - This table will display the current membership of the group for your review while making changes.

• Add - You can use each of these drop downs to add one or more Members, Owners, or Contacts.

• Remove - You can use each of these drop downs to remove one or more Members, Owners, or Contacts.

• Let people outside the organization email the group - If selected, it allows external senders to send emails to the group.

• Send Copies of team emails and events to team members inboxes - If selected, it enables sending copies of team emails and events to the inboxes of team members.

On this page you will enter all of the necessary information to create a group.

Group Types

Dynamic Group Parameters: For Dynamic Groups, a text box for entering the dynamic group parameters syntax becomes available e.g.: (user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest").

Overview

Details

This page presents each group in a structured table, including the following columns. You can select which columns are visible.

Actions

Per-Group Actions

These actions and information are available in the fly-out menu when you click the ellipsis button in the "Actions" column:

Feature Requests / Ideas

Upon page load, CIPP will run an analysis on the user to identify common Indicators of Compromise (IoC). Once that analysis is returned, review the information presented and determine if the user has been compromised. The analysis performs the checks listed in the table below. A green check will indicate that information was found for the check and needs review.

Indicators of Compromise Checks

Actions

The Group Templates page allows administrators to define templates for creating groups. These templates can speed up the process of creating new groups by pre-defining certain group parameters. Once a template is created, it can be reused multiple times to create new groups with similar settings.

*Additional Fields for Specific Group Types

For some types of groups, additional fields become available when that type is selected:

• Allow External: For Distribution Lists, a checkbox labeled "Let people outside the organization email the group" becomes available.

• Dynamic Group Parameters: For Dynamic Groups, a text box for entering the dynamic group parameters syntax becomes available e.g.: (user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest").