Appearance
CIPP Setup
CIPP (CyberDrain Improved Partner Portal) is an open-source Microsoft 365 management platform for MSPs. Once connected, Junto can manage users, reset passwords, configure MFA, manage mailboxes, monitor security alerts, handle devices, and much more across your M365 tenants, all through the single CIPP connection you already have.
CIPP or Microsoft 365 Direct?
Junto can reach your clients' Microsoft 365 tenants two ways, and the agent's capabilities are the same on both paths:
- CIPP -- One connection covers every tenant CIPP manages. Recommended if you run CIPP, because you avoid completing a separate Microsoft OAuth consent for every client tenant and adding a Junto enterprise app to each one.
- Microsoft 365 direct -- Junto connects to each tenant individually through Microsoft Graph, with a Global Administrator consenting per tenant. Junto does not have its own partner-level (GDAP) access, so this is done tenant by tenant.
Which to choose:
| Your situation | Recommendation |
|---|---|
| You run CIPP and it is actively used and maintained | CIPP. One connection, no per-tenant consent. |
| Your CIPP instance is neglected, self-hosted on under-sized resources, or only used occasionally | Microsoft 365 direct. It will be more reliable than a struggling CIPP instance. |
| You don't run CIPP | Microsoft 365 direct. |
If both are connected for a company, the agent uses CIPP by default rather than the direct Microsoft tools.
TIP
The trickiest part of CIPP setup is getting the API credentials out of CIPP, and it varies by CIPP version. If you'd like help, this is a good one to do on a call with Junto support.
Prerequisites
- A CIPP instance you can sign in to as an admin. Hosted CIPP works without extra setup. Self-hosted deployments on versions before 7.1 must first assign the Contributor role to the CIPP Function App in the Azure portal; see the CIPP-API documentation.
- Admin or Owner role in Junto.
Step 1: Create an API Client in CIPP
CIPP creates the app registration for you. Follow the CIPP-API documentation for your version; the current flow is:
- In CIPP, go to Integrations and select CIPP-API.
- Click Actions > Create New Client and give it a name such as Junto.
- Turn the client on. Leave Allowed IP Ranges empty, since Junto's requests come from Junto's cloud, not from your office network.
- Submit the form, and copy the Application (client) ID and the Application secret. The secret is shown once.
- Click Actions > Save to Azure so the Function App picks up the new client.
The page also shows the Tenant ID of the tenant where your CIPP service account lives and the API URL. Note both; you'll need the tenant ID in the next step.
Older CIPP versions
On CIPP versions without the CIPP-API integration page, you create the app registration yourself in Entra ID (Azure AD): create an app registration for Junto, add a client secret under Certificates & secrets, and copy the Application (client) ID, Directory (tenant) ID, and secret value. Then follow the CIPP docs for your version to authorize that app against the CIPP API.
Step 2: Configure in Junto
- In Junto, go to Settings > Integrations > CIPP.
- Click Add Configuration and fill in:
| Field | Value |
|---|---|
| CIPP URL | Your CIPP instance URL, for example https://your-cipp.azurewebsites.net. Use the instance URL, not the /api URL. |
| Azure AD Tenant ID | The tenant ID where your CIPP app registration lives (shown on the CIPP-API page). This is your MSP tenant, not a client's. |
| Application (Client) ID | From Step 1. |
| Application Secret | From Step 1. Encrypted on save. |
| Active | Turn off to pause the integration without deleting it. |
- Click Create.
- On the configuration card, click Test connection. Junto authenticates and lists the tenants CIPP manages.
Step 3: Map Companies to Tenants
- On the configuration card, click Tenant Mapping.
- In the Map Companies to CIPP Tenants dialog, for each Junto company, select its M365 tenant. Click Auto-map to match by name: exact matches are applied automatically, and close matches are shown as suggestions to confirm or dismiss.
- Save mappings.
Only mapped tenants are available to the agent.
Tenant Health
The Tenant health card on the CIPP settings page shows the state of each mapped tenant as CIPP sees it. Click refresh to re-check.
| Status | Meaning | What to do |
|---|---|---|
| Healthy | CIPP can reach the tenant. | Nothing. |
| Degraded | A recent call to the tenant failed with a transient error. | Informational. Refresh later; it usually clears on its own. |
| Stale | The health data needs a refresh. | Click refresh. |
| Blocked | A persistent authentication or consent failure. Tools for this tenant fail immediately until it's fixed. | Re-run the consent for that tenant in CIPP (the CIPP-SAM / tenant onboarding wizard). |
| Excluded | The tenant is excluded in CIPP. | Remove the exclusion in CIPP, or unmap the company. |
| Not found | The mapped tenant is no longer in CIPP's tenant list. | The tenant was offboarded from CIPP or the mapping is wrong. Re-map the company. |
Known Gotchas
- Write actions are slow. CIPP write operations route through Azure and can take 30 to 120 seconds (offboarding is the slowest). The agent knows this and tells the technician the action is in progress before invoking it. This is normal.
- Self-hosted performance. If your CIPP instance runs on under-sized resources, you'll see this latency compound and occasional timeouts. Partners in that position have moved to Microsoft 365 direct; hosted CIPP customers have generally been happy staying on CIPP.
- Don't IP-restrict the API client. Junto's requests do not come from your network. If you set Allowed IP Ranges on the CIPP-API client, the connection will fail.
- Save to Azure. After creating or changing the API client in CIPP, the change doesn't take effect until you click Actions > Save to Azure. The tenant ID shown on the page can also take 5 to 15 minutes to update.
- The tenant ID is your tenant, not the client's. The Azure AD Tenant ID field is the tenant your CIPP service account and app registration live in. Client tenants are handled through mapping.
- AD-synced users and groups. For tenants with Entra Connect, password resets and group membership changes have to be made in on-premises AD. The agent checks for this and will tell you rather than attempt the change.
- Distribution lists. Microsoft Graph cannot modify distribution list membership. When both paths are connected, the agent uses CIPP's offboarding tool for bulk group removal because it handles all group types through Exchange.
What the Agent Can Do
User Management
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Users | List all M365 users with UPN, display name, status, and licenses | Low | None |
| Get User Details | View detailed information about a specific user | Low | None |
| Add User | Create a new M365 user account | High | Always |
| Edit User | Update user properties (name, job title, department, phone, address) | Medium | Once |
| Disable User | Disable a user account | High | Always |
| Enable User | Re-enable a previously disabled user account | Medium | Once |
| Remove User | Delete an M365 user account | High | Always |
| Reset Password | Reset a user's password | High | Always |
| Offboard User | Full offboarding: disable sign-in, reset password, revoke sessions, remove groups and licenses | High | Always |
| Dismiss Risky User | Dismiss risk flag from Azure AD Identity Protection | Medium | Once |
MFA & Authentication
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List MFA Status | View MFA registration status and Conditional Access coverage for all users | Low | None |
| Reset MFA | Re-require MFA registration for a user | High | Always |
| Set Per-User MFA | Set per-user MFA state (enabled, enforced, or disabled) | High | Always |
| Revoke Sessions | Revoke all active sign-in sessions for a user | High | Always |
Mailbox & Exchange
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Mailboxes | List all Exchange mailboxes for the tenant | Low | None |
| Get Mailbox Details | View detailed mailbox information | Low | None |
| Convert Mailbox | Convert between shared and regular mailbox types | Medium | Once |
| Enable Archive | Enable the online archive mailbox for a user | Medium | Once |
| Set Email Forwarding | Configure email forwarding for a mailbox | Medium | Once |
| Set Out of Office | Enable or disable out-of-office auto-reply with custom message | Medium | Once |
| List Mailbox Rules | List all inbox rules across the tenant | Low | None |
| Get Shared Mailbox Stats | View statistics for shared mailboxes (size, item count, last logon) | Low | None |
| Get Mailbox Client Access | View client access settings (OWA, ActiveSync, IMAP, POP) | Low | None |
| List Contacts | List Exchange mail contacts for the tenant | Low | None |
| Trace Messages | Trace email messages to track delivery status | Low | None |
| List Shared Mailboxes with Sign-In | Identify shared mailboxes with sign-in enabled (security risk) | Low | None |
| List Deleted Items | List recently deleted M365 objects that can be restored | Low | None |
Email Security
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Blocked Senders | View tenant allow/block list entries | Low | None |
| Block Sender | Add a sender or domain to the tenant block list | Medium | Once |
| Unblock Sender | Remove a sender or domain from the block list | Medium | Once |
Security Monitoring
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Security Alerts | View Microsoft Defender security alerts | Low | None |
| Update Security Alert | Update the status or assignment of a security alert | Medium | Once |
| List Security Incidents | View Microsoft Defender security incidents | Low | None |
| Update Security Incident | Update the status or assignment of a security incident | Medium | Once |
| List Audit Logs | View M365 audit logs (admin and user activity) | Low | None |
| List Defender Status | View Defender protection status per device | Low | None |
Sign-In & Activity Monitoring
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Sign-Ins | View recent sign-in events with optional filtering for failed sign-ins | Low | None |
| Get AD Connect Status | Check Azure AD Connect synchronization status | Low | None |
| List Inactive Accounts | List accounts inactive for 6+ months | Low | None |
Device Management
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Devices | List Intune-managed devices with name, OS, compliance, and user info | Low | None |
| Get BitLocker Key | Retrieve the BitLocker recovery key for a device | High | Always |
| Sync Device | Trigger an Intune sync to pull latest policies | Medium | Once |
| Reboot Device | Remotely reboot a managed device | Medium | Once |
| Retire Device | Retire a device from Intune management (removes company data) | High | Always |
| Wipe Device | Factory reset a device (erases all data -- cannot be undone) | High | Always |
| List Autopilot Devices | List Windows Autopilot enrolled devices | Low | None |
Groups & Teams
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Groups | List all M365 groups (security, distribution, M365, mail-enabled) | Low | None |
| Get Group Members | List all members of a group | Low | None |
| Get Group Owners | List all owners of a group | Low | None |
| Add Group | Create a new M365 group | Medium | Once |
| Edit Group | Update group properties (name, description, visibility) | Medium | Once |
| Edit Group Members | Add or remove members and owners | Medium | Once |
| Delete Group | Delete an M365 group (permanently removes group and content) | High | Always |
| Hide Group from GAL | Hide or unhide a group from the Global Address List | Medium | Once |
Licensing & Tenant Admin
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Licenses | View all M365 license subscriptions with usage counts | Low | None |
| List Tenants | List all managed tenants from CIPP | Low | None |
| List Domains | List all domains registered in the M365 tenant | Low | None |
| List Roles | List Azure AD directory roles | Low | None |
| List Conditional Access Policies | View all Conditional Access policies | Low | None |
| Add CA Exclusion | Add a user exclusion to a Conditional Access policy | High | Always |
| List Named Locations | View named locations used in Conditional Access policies | Low | None |
| List OAuth Apps | List OAuth/enterprise applications registered in the tenant | Low | None |
| List Service Health | Check M365 service health and availability status | Low | None |
Teams & SharePoint
| Tool | Description | Risk Level | Approval |
|---|---|---|---|
| List Teams | List all Microsoft Teams | Low | None |
| List Teams Activity | View Teams user activity (meetings, calls, chat counts) | Low | None |
| List SharePoint Sites | List SharePoint sites or OneDrive accounts with usage statistics | Low | None |
| Provision OneDrive | Pre-provision OneDrive for a user before their first login | Medium | Once |
High-impact actions like user deletion, device wipes, and password resets always require explicit technician approval.
Troubleshooting
- Connection fails -- Check the CIPP URL (instance URL, no
/api), the Application ID and Secret, and that the Tenant ID is your MSP tenant. Confirm the API client is enabled in CIPP, has no IP restrictions, and that you clicked Save to Azure. On self-hosted CIPP before 7.1, confirm the Function App has the Contributor role. - No tenants listed -- Confirm your CIPP instance is configured with access to the expected M365 tenants, and that they aren't excluded in CIPP.
- Actions time out or feel slow -- Expected for writes (30 to 120 seconds). If reads are also slow, your CIPP instance may be under-resourced; see CIPP or Microsoft 365 Direct?.
- A tenant shows Blocked -- Re-consent the tenant in CIPP. See Tenant Health.
- User not found -- Check that the company mapping is correct for the target tenant.
- Permission denied on action -- Some actions require specific Azure AD permissions. Verify the app registration has the necessary API permissions granted.
- Device wipe or retire fails -- Ensure the device is enrolled in Intune and the app registration has device management permissions.