List all tenants managed in CIPP

Get detailed information about a specific tenant

List users in a tenant

⚠ HIGH-IMPACT. Creates a new user account in the tenant, which grants directory presence and may include initial credentials and license/role eligibility. Reversible by deleting or disabling the user. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Edits an existing user's properties, which can include directory attributes, usage location, and may grant or revoke roles or license eligibility. Reversible by editing again. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Disables a user account, blocking sign-in. Reversible by re-enabling the account. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Resets a user's password, invalidating their current password. Reversible by setting a new password. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Resets all MFA methods for a user, requiring them to re-register their authentication methods. Reversible by re-enabling MFA. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Revokes all active sessions for a user, forcing them to re-authenticate. Reversible by the user signing in again. Confirm with the user before invoking.

⚠ DESTRUCTIVE — IRREVERSIBLE. Queues CIPP's offboarding job for a user. Every action is opt-in: at least one must be enabled or the call is rejected. Returns once the job is QUEUED — CIPP reports success on task creation, not completion, so confirm the outcome in CIPP's Offboarding view before reporting the account as offboarded. Confirm with the user before invoking.

Run a Business Email Compromise check on a user

List users and their MFA status in a tenant

List devices enrolled by a user

List groups a user is a member of

List groups in a tenant

⚠ HIGH-IMPACT. Creates a new group in the tenant, which can be used for security policy assignments (RBAC, Conditional Access) or mail distribution. Reversible by deleting the group. Confirm with the user before invoking.

List mailboxes in a tenant

List permissions on a specific mailbox

Report mailbox and online-archive sizes across a tenant, largest first, with tenant-wide totals. Each mailbox reports bytes used, a human-readable size, item count, quota and percent-of-quota, for both the primary store and the archive. Answers 'who is near quota', 'which mailboxes need archiving', and 'how much Exchange storage does this tenant use'. Sizes come from CIPP's reporting database, which must have been synced — the live Exchange query carries no size data at all. For one mailbox, or when the cache is unavailable, use cipp_get_mailbox_usage.

Report the primary mailbox size and online-archive size for a single mailbox, with item counts, quotas and percent-of-quota. Reads live from Exchange, so unlike cipp_list_mailbox_usage it needs no CIPP report-cache sync and still returns real sizes for a tenant that conceals names in its Microsoft 365 usage reports.

⚠ HIGH-IMPACT. Configures the out-of-office / auto-reply for a mailbox, which causes automated messages to be sent to internal and/or external senders. Reversible by disabling the auto-reply. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Configures email forwarding on a mailbox, silently redirecting the user's incoming mail to another address. This is a common data-exfiltration vector. Reversible by removing the forwarding rule. Confirm with the user before invoking.

List Conditional Access policies for a tenant

List named locations (trusted IPs) for a tenant

List enterprise applications (service principals) in a tenant — including third-party SaaS apps that customers have integrated via OAuth (Slack, Salesforce, Zoom, etc.). Returns appId, displayName, publisher, owner-org, signInAudience, tags, and creation date. Use tenantFilter='allTenants' for cross-tenant fan-out — CIPP handles per-tenant errors inline, so a 403 from one opt-out tenant returns as an error row rather than failing the call. Excludes Microsoft-built-in apps by default (owner org f8cdef31-…); pass includeBuiltIn=true to include them.

List compliance standards configured for a tenant

Trigger a standards compliance check for a tenant

List the CIPP Standards Templates configured across the partner tenant.

Report standards drift — settings that deviate from a tenant's assigned Standards Template. Omit tenantFilter to report drift across all tenants.

Report each tenant's alignment percentage against its assigned Standards Templates — the key signal for deciding which standards are safe to promote to Remediate. Omit tenantFilter to report on all tenants.

⚠ HIGH-IMPACT. Creates or updates a CIPP Standards Template (upsert by GUID). A template assigned to tenants with any Remediate-action standard WILL modify those tenants on the next standards run. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Permanently deletes a CIPP Standards Template by ID. Tenants assigned to it lose the standards it enforced. Confirm with the user before invoking.

Get Best Practice Analyser results for a tenant

Check domain health (DMARC, DKIM, SPF) for a tenant

List license assignments and usage for a tenant

List all CSP licenses across tenants

List audit log entries for a tenant

List queued alerts across all tenants

List available GDAP (Granular Delegated Admin Privileges) roles

List pending GDAP relationship invites

List scheduled tasks in CIPP

Create a new scheduled task

Check CIPP API connectivity

Get CIPP version information

List CIPP application logs