CIPP Basics (draft)

CIPP Basics (draft)

The CIPP portal lets us manage all our Microsoft tenants together at an MSP level, more easily than in the individual MS admin portals, and lets us automate or schedule tasks like user offboarding.


We can set up alerts for each tenant, including if a mailbox or SharePoint is full, or if someone doesn't have 2FA enabled.

  1. Tenant Administration - shows you all your tenants

  1. Once signed in, select the tenant in the top left > Identity Management > Administration > Users > Click the 3 dots on the right hand side of a user's row













  1. Using the "Offboarding Wizard" feature, offboarding one or more users at a time and releasing license(s) can be scheduled in advance. An email notification can also be sent out when this is scheduled. 
    1. A link to the offboarded user's OneDrive data can be sent to the person with mailbox permission
    2. Revoke All Sessions and Remove All MFA Devices should each be set to ON for all offboardings. 



Notes
As of February 2026, Matthew has requested an "Onboarding Wizard" and we are awaiting a response. 
  1. CIPP provides good quality reports

  1. Email & Exchange > Administration > Mailboxes: Email groups and shared mailboxes can be managed by clicking this

  1. For Entra ID:
    1. P1 licensed clients have conditional access
    2. P2 licensed clients allow more features and higher access, including labels for a "risky user" and J.I.T. (Just In Time) which created a temporary admin account

  1. Intune: we can manage all application and devices' set up and policies
Warning
If a user thinks that they have been hacked, we can click the 3 dots on the right hand side of a user's row > View User > Compromise Remediation tab > Remediate User

Just in Time 
  1. This provides a customer temporary admin permissions
  2. P2 license is not required for this feature
  3. CIPP > Admin > JIT Admin > Add
    1. New or existing
    2. Start/end date
    3. Select the roll; only allow necessary admin permission (never global admin)
    4. Provide a reason
    5. Generate a Temporary Access Pass (TAP)
      1. Temporary password to set up 2FA
    6. Expiration action
    7. Notification action

Video of CIPP webinar from 2026:  https://tinyurl.com/cippwebinar

    • Related Articles

    • Lob Basics

      We can send invoices via postal mail by using Lob.com The Lob credentials are shared in the Office folder in the Keeper vault. How to send a document via Postal Mail using Lob From the Lob dashboard, Print & Mail > Letters. Click the Live button at ...

    • How to Find Draft Articles in the Zoho KB

      Finding Draft Articles in the Zoho KB The public help center portal does not offer a way to filter or find draft articles. To find drafts, you need to go into the Knowledge Base module on the Desk backend (agent side), not the public portal. Steps ...

    • Autotask Client Portal Basics

      To configure Portal Options for a Specific Customer This should not need to be changed for any customer at this time. The info is here for documentation only. Admin > Admin Categories > Extensions & Integrations > Client Portal & Taskfire > Manage ...

    • Google Partner Network Hub Basics

      What is Partner Network Hub Partner Network Hub is Google's portal for managing a partner organization's relationship with Google. It is where partner staff view account information, request authorizations to work on customer accounts, access ...

    • Usecure Security Awareness Training - Admin Basics

      Customer Tenant Access To go to a customer tenant, go to uService tab on top. Click Customers. There are two button next to each customer: Admin is for changing and viewing the customer's training and phishing configuration (for example, when ...