List all tenants managed in CIPP

Get detailed information about a specific tenant

List users in a tenant

⚠ HIGH-IMPACT. Creates a new user account in the tenant, which grants directory presence and may include initial credentials and license/role eligibility. Reversible by deleting or disabling the user. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Edits an existing user's properties, which can include directory attributes, usage location, and may grant or revoke roles or license eligibility. Reversible by editing again. Confirm with the user before invoking. CIPP rebuilds the UPN from the account's current username + domain on every edit, so the current UPN is always resolved first (editing without it would rename the account). That lookup is retried for ~10s when the user is not found yet, because a just-created account can lag in Microsoft Graph.

⚠ HIGH-IMPACT. Disables a user account, blocking sign-in. Reversible by re-enabling the account. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Resets a user's password, invalidating their current password. CIPP always generates the new password itself (a caller cannot choose one) and returns it in the response, or a PWPush link if PWPush is enabled in CIPP, so treat the response as a secret. The previous password cannot be restored; resetting again issues another new one. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Resets all MFA methods for a user, requiring them to re-register their authentication methods. Reversible by re-enabling MFA. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Revokes all active sessions for a user, forcing them to re-authenticate. Reversible by the user signing in again. Confirm with the user before invoking.

⚠ DESTRUCTIVE — IRREVERSIBLE. Queues CIPP's offboarding job for a user. Every action is opt-in: at least one must be enabled or the call is rejected. Returns once the job is QUEUED — CIPP reports success on task creation, not completion, so confirm the outcome in CIPP's Offboarding view before reporting the account as offboarded. Confirm with the user before invoking.

Run a Business Email Compromise check on a user

List users and their MFA status in a tenant

List devices enrolled by a user

List groups a user is a member of

List one user's most recent interactive Entra ID sign-ins, newest first. Each row gives the time, app and resource, IP address, location, success/failure with the error code and failure reason, client app, Conditional Access status and the policies that evaluated, authentication requirement (whether MFA was required) and the authentication methods/steps Graph recorded, first factor included, device, and risk when flagged — plus a summary of failures, distinct IPs and countries. Answers "why can't this user sign in", "was this account used from somewhere unexpected", and "did MFA/CA apply". Accepts a UPN or Entra object id; a UPN is resolved to the object id first, because the upstream filter matches object ids only. One tenant and one user per call. Requires Entra ID P1/P2 in the tenant. For tenant-wide sign-ins this is the wrong tool — use CIPP's Sign-Ins report (ListSignIns).

List groups in a tenant

⚠ HIGH-IMPACT. Creates a new group in the tenant, which can be used for security policy assignments (RBAC, Conditional Access) or mail distribution. Reversible by deleting the group. Confirm with the user before invoking.

List mailboxes in a tenant

List permissions on a specific mailbox

List a mailbox's safe-sender (trusted) and blocked-sender entries from its Exchange Online junk email settings. Read-only; returns an empty list when the mailbox has none configured, which is normal, not an error.

Report mailbox and online-archive sizes across a tenant, largest first, with tenant-wide totals. Each mailbox reports bytes used, a human-readable size, item count, quota and percent-of-quota, for both the primary store and the archive. Answers 'who is near quota', 'which mailboxes need archiving', and 'how much Exchange storage does this tenant use'. Sizes come from CIPP's reporting database, which must have been synced — the live Exchange query carries no size data at all. For one mailbox, or when the cache is unavailable, use cipp_get_mailbox_usage.

Report the primary mailbox size and online-archive size for a single mailbox, with item counts, quotas and percent-of-quota. Reads live from Exchange, so unlike cipp_list_mailbox_usage it needs no CIPP report-cache sync and still returns real sizes for a tenant that conceals names in its Microsoft 365 usage reports.

⚠ HIGH-IMPACT. Configures the out-of-office / auto-reply for a mailbox, which causes automated messages to be sent to internal and/or external senders. Reversible by disabling the auto-reply. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Configures email forwarding on a mailbox, silently redirecting the user's incoming mail to another address. This is a common data-exfiltration vector. Reversible by removing the forwarding rule. Confirm with the user before invoking.

List Conditional Access policies for a tenant

List named locations (trusted IPs) for a tenant

Read a tenant's Microsoft Secure Score live: latest points, percentage of the maximum, comparison with all tenants (basis AllTenants) and similarly sized tenants (basis TotalSeats), the control-by-control achievement on that latest reading (lowest completion first), and the recent daily history newest-first. There is no dedicated CIPP list endpoint — this calls ListGraphRequest with Endpoint security/secureScores. top defaults to 7 and caps at 90; it is sent with NoPagination so it limits the series instead of only setting Graph's page size. allTenants is rejected (CIPP's estate view is the nightly cache, not this call). An empty collection is reported as no reading, never as a score of zero. Changing a control's state is not this tool.

List a tenant's Microsoft Secure Score control profiles — the recommendation catalog, not the achievement. Each profile includes title, category, rank, max points, implementation cost, user impact, remediation, threats, compliance mappings, and any non-default state updates (resolved by a third party, or ignored / risk accepted). Calls ListGraphRequest with Endpoint security/secureScoreControlProfiles. Use cipp_get_secure_score for the current score and which controls are complete. allTenants is rejected. Read-only; CIPP's ExecUpdateSecureScore write is not exposed.

List enterprise applications (service principals) in a tenant — including third-party SaaS apps that customers have integrated via OAuth (Slack, Salesforce, Zoom, etc.). Returns appId, displayName, publisher, owner-org, signInAudience, tags, and creation date. Use tenantFilter='allTenants' for cross-tenant fan-out — CIPP handles per-tenant errors inline, so a 403 from one opt-out tenant returns as an error row rather than failing the call. Excludes Microsoft-built-in apps by default (owner org f8cdef31-…); pass includeBuiltIn=true to include them.

List compliance standards configured for a tenant

Trigger a standards compliance check for a tenant

List the CIPP Standards Templates configured across the partner tenant.

Report standards drift — settings that deviate from a tenant's assigned Standards Template. Omit tenantFilter to report drift across all tenants.

Report each tenant's alignment percentage against its assigned Standards Templates — the key signal for deciding which standards are safe to promote to Remediate. Omit tenantFilter to report on all tenants.

⚠ HIGH-IMPACT. Creates or updates a CIPP Standards Template (upsert by GUID). A template assigned to tenants with any Remediate-action standard WILL modify those tenants on the next standards run. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Permanently deletes a CIPP Standards Template by ID. Tenants assigned to it lose the standards it enforced. Confirm with the user before invoking.

Get Best Practice Analyser results for a tenant

Check domain health (DMARC, DKIM, SPF) for a tenant

List license assignments and usage for a tenant

List all CSP licenses across tenants

List audit log entries for a tenant

List queued alerts across all tenants

List available GDAP (Granular Delegated Admin Privileges) roles

List pending GDAP relationship invites

List scheduled tasks in CIPP

Create a new scheduled task

Check CIPP API connectivity

Get CIPP version information

List CIPP application logs