CIPP

List audit log entries for a tenant

Get Best Practice Analyser results for a tenant

List Conditional Access policies for a tenant

List all CSP licenses across tenants

Check domain health (DMARC, DKIM, SPF) for a tenant

List enterprise applications (service principals) in a tenant — including third-party SaaS apps that customers have integrated via OAuth (Slack, Salesforce, Zoom, etc.). Returns appId, displayName, publisher, owner-org, signInAudience, tags, and creation date. Use tenantFilter='allTenants' for cross-tenant fan-out — CIPP handles per-tenant errors inline, so a 403 from one opt-out tenant returns as an error row rather than failing the call. Excludes Microsoft-built-in apps by default (owner org f8cdef31-…); pass includeBuiltIn=true to include them.

List pending GDAP relationship invites

List available GDAP (Granular Delegated Admin Privileges) roles

List groups in a tenant

List license assignments and usage for a tenant

List CIPP application logs

List permissions on a specific mailbox

Report mailbox and online-archive sizes across a tenant, largest first, with tenant-wide totals. Each mailbox reports bytes used, a human-readable size, item count, quota and percent-of-quota, for both the primary store and the archive. Answers 'who is near quota', 'which mailboxes need archiving', and 'how much Exchange storage does this tenant use'. Sizes come from CIPP's reporting database, which must have been synced — the live Exchange query carries no size data at all. For one mailbox, or when the cache is unavailable, use cipp_get_mailbox_usage.

List mailboxes in a tenant

List users and their MFA status in a tenant

List named locations (trusted IPs) for a tenant

List scheduled tasks in CIPP

List a tenant's Microsoft Secure Score control profiles — the recommendation catalog, not the achievement. Each profile includes title, category, rank, max points, implementation cost, user impact, remediation, threats, compliance mappings, and any non-default state updates (resolved by a third party, or ignored / risk accepted). Calls ListGraphRequest with Endpoint security/secureScoreControlProfiles. Use cipp_get_secure_score for the current score and which controls are complete. allTenants is rejected. Read-only; CIPP's ExecUpdateSecureScore write is not exposed.

List the CIPP Standards Templates configured across the partner tenant.

List compliance standards configured for a tenant

List all tenants managed in CIPP

List a mailbox's safe-sender (trusted) and blocked-sender entries from its Exchange Online junk email settings. Read-only; returns an empty list when the mailbox has none configured, which is normal, not an error.

List devices enrolled by a user

List groups a user is a member of

List one user's most recent interactive Entra ID sign-ins, newest first. Each row gives the time, app and resource, IP address, location, success/failure with the error code and failure reason, client app, Conditional Access status and the policies that evaluated, authentication requirement (whether MFA was required) and the authentication methods/steps Graph recorded, first factor included, device, and risk when flagged — plus a summary of failures, distinct IPs and countries. Answers "why can't this user sign in", "was this account used from somewhere unexpected", and "did MFA/CA apply". Acc…

List users in a tenant

⚠ DESTRUCTIVE — IRREVERSIBLE. Queues CIPP's offboarding job for a user. Every action is opt-in: at least one must be enabled or the call is rejected. Returns once the job is QUEUED — CIPP reports success on task creation, not completion, so confirm the outcome in CIPP's Offboarding view before reporting the account as offboarded. Confirm with the user before invoking.

Check CIPP API connectivity

⚠ HIGH-IMPACT. Resets all MFA methods for a user, requiring them to re-register their authentication methods. Reversible by re-enabling MFA. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Resets a user's password, invalidating their current password. CIPP always generates the new password itself (a caller cannot choose one) and returns it in the response, or a PWPush link if PWPush is enabled in CIPP, so treat the response as a secret. The previous password cannot be restored; resetting again issues another new one. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Revokes all active sessions for a user, forcing them to re-authenticate. Reversible by the user signing in again. Confirm with the user before invoking.

Trigger a standards compliance check for a tenant

⚠ HIGH-IMPACT. Configures email forwarding on a mailbox, silently redirecting the user's incoming mail to another address. This is a common data-exfiltration vector. Reversible by removing the forwarding rule. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Configures the out-of-office / auto-reply for a mailbox, which causes automated messages to be sent to internal and/or external senders. Reversible by disabling the auto-reply. Confirm with the user before invoking.