git:20260606.f4a030b to git:20260613.fc77200

- description: "Use when the user asks to roll up Microsoft 365 posture across all their CIPP tenants (MFA, Conditional Access, Standards, BPA), find unused M365 licenses, flag stale accounts, detect security-baseline drift, fan one read out across every client tenant, or drive bulk user changes from a CSV. The first single-binary CLI and MCP server for CIPP (CyberDrain Improved Partner Portal) we could find (June 2026): cross-tenant fan-out, an offline SQLite store, and fleet rollups the one-tenant-at-a-time portal never renders. Trigger phrases: `check MFA across all my tenants`, `find unused M365 licenses`, `offboard users from a CSV in CIPP`, `which tenants drifted off baseline`, `list CIPP tenants`, `use cipp`, `run cipp-cli`."

- author: "Damien Stevens"

- license: "Apache-2.0"

- vendor: "CIPP"

- argument-hint: "<command> [args] | install cli|mcp"

- allowed-tools: "Read Bash"

- metadata:

- openclaw:

- requires:

- bins:

- - cipp-cli

- ---

-

- # CIPP Claude Code Skill

-

- ## Prerequisites: Install the CLI

-

- This skill drives the `cipp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

-

- 1. macOS / Linux:

- ```bash

- bash <(curl -fsSL https://raw.githubusercontent.com/servosity/msp-skills/main/skills/cipp/install.sh)

- ```

- 2. Windows (PowerShell):

- ```powershell

- iwr -useb https://raw.githubusercontent.com/servosity/msp-skills/main/skills/cipp/install.ps1 | iex

- ```

- 3. Verify: `cipp-cli --version`

- 4. Ensure `~/.local/bin` (macOS / Linux) or `%LOCALAPPDATA%\Programs\msp-skills` (Windows) is on `$PATH`.

-

- If `--version` reports "command not found" after install, the install step did not put the binary on `$PATH`. Do not proceed with skill commands until verification succeeds.

-

- CIPP (CyberDrain Improved Partner Portal) is how MSPs manage many Microsoft 365 tenants from one place. This CLI wraps the full 496-endpoint API as typed commands, then goes further: `fanout --save` pulls tenants, users, licenses, and standards into a local SQLite database so you can run fleet-wide queries (`posture`, `licenses waste`, `users stale`), detect baseline drift (`standards drift`), and execute throttle-aware bulk operations (`bulk`) that survive Microsoft Graph 429s - all with --json, --dry-run, and typed exit codes.

-

- ## When to Use This CLI

-

- Reach for this CLI whenever an MSP task spans more than one Microsoft 365 tenant or needs to be scripted: cross-tenant posture and license reporting, baseline drift detection, burst onboarding/offboarding from a CSV, or any CIPP action wired into cron/RMM automation. It is the headless, scriptable alternative to clicking through the CIPP web UI one tenant at a time.

-

- **When NOT to use this CLI:**

-

- - Managing a single Microsoft 365 tenant directly without a CIPP instance - use Microsoft Graph tooling; this CLI drives a self-hosted CIPP deployment.

- - Driving destructive or write actions across tenants with `fanout` - fanout is read fan-out; use `bulk` for CSV-driven write batches.

- - Expecting `standards drift` on first run - drift needs two snapshots over time (`fanout --endpoint /ListStandards --all-tenants --save` twice); use `posture` for a point-in-time read.

- - Bulk-populating the store with the framework `sync` command - CIPP's tenant-scoped endpoints require tenantFilter, so `fanout --save` is the population path.

-

- ## Unique Capabilities

-

- These capabilities aren't available in any other tool for this API.

-

- ### Cross-tenant leverage

- - **`fanout`** - Run any read command across every client tenant at once, with throttle-aware backoff and resume after a halt.

-

- _Reach for this whenever a question spans the whole MSP fleet instead of a single tenant; it replaces dozens of UI tenant-switches with one call._

-

- ```bash

- cipp-cli fanout --endpoint /ListUsers --all-tenants --save

- ```

- - **`posture`** - One table of every tenant's MFA, Conditional Access, Standards, and BPA posture - the QBR rollup the UI never renders.

-

- _Use it to answer 'which tenants are out of compliance right now' for a QBR or cyber-insurance attestation without click-per-tenant._

-

- ```bash

- cipp-cli posture --dimension mfa --agent

- ```

- - **`licenses waste`** - Surface assigned-but-unused licenses and CSP billing mismatches across all tenants.

-

- _Run it at renewal to recover real dollars from dormant seats and pool-vs-billed gaps._

-

- ```bash

- cipp-cli licenses waste --all-tenants --agent

- ```

-

- ### Drift and time-travel

- - **`standards drift`** - Show every tenant whose security baseline regressed since the last sync.

-

- _Catch baseline drift before an audit finds it - the snapshot-to-snapshot diff is invisible in the live UI._

-

- ```bash

- cipp-cli standards drift --agent

- ```

- - **`users stale`** - Flag licensed accounts with no sign-in in N days across every tenant.

-

- _Use it for security cleanup and cost recovery - dormant licensed accounts are both an attack surface and wasted spend._

-

- ```bash

- cipp-cli users stale --days 90 --all-tenants --agent

- ```

-

- ### Bulk and automation

- - **`bulk`** - Drive add-user / offboard / remove-user / set-forwarding actions from a CSV with Retry-After backoff and resume-after-429 checkpointing.

-

- _Use it for burst onboarding/offboarding across tenants; the dry-run previews every destructive step before anything fires._

-

- ```bash

- cipp-cli bulk --from offboards.csv --dry-run

- ```

-

- ## Command Reference

-

- **add-alert** - Manage add alert

-

- - `cipp-cli add-alert` - Add alert

-

- **add-apdevice** - Manage add apdevice

-

- - `cipp-cli add-apdevice` - Adds Autopilot devices to a tenant via Partner Center API #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **add-assignment-filter** - Manage add assignment filter

-

- - `cipp-cli add-assignment-filter` - Add assignment filter

-

- **add-assignment-filter-template** - Manage add assignment filter template

-

- - `cipp-cli add-assignment-filter-template` - Add assignment filter template

-

- **add-autopilot-config** - Manage add autopilot config

-

- - `cipp-cli add-autopilot-config` - Add autopilot config

-

- **add-bpatemplate** - Manage add bpatemplate

-

- - `cipp-cli add-bpatemplate` - Add bpatemplate

-

- **add-capolicy** - Manage add capolicy

-

- - `cipp-cli add-capolicy` - Add capolicy

-

- **add-catemplate** - Manage add catemplate

-

- - `cipp-cli add-catemplate` - Add catemplate

-

- **add-choco-app** - Manage add choco app

-

- - `cipp-cli add-choco-app` - Add choco app

-

- **add-connection-filter** - Manage add connection filter

-

- - `cipp-cli add-connection-filter` - Add connection filter

-

- **add-connection-filter-template** - Manage add connection filter template

-

- - `cipp-cli add-connection-filter-template` - Add connection filter template

-

- **add-contact** - Manage add contact

-

- - `cipp-cli add-contact` - Add contact

-

- **add-contact-templates** - Manage add contact templates

-

- - `cipp-cli add-contact-templates` - Add contact templates

-

- **add-defender-deployment** - Manage add defender deployment

-

- - `cipp-cli add-defender-deployment` - Add defender deployment

-

- **add-domain** - Manage add domain

-

- - `cipp-cli add-domain` - Add domain

-

- **add-edit-transport-rule** - Manage add edit transport rule

-

- - `cipp-cli add-edit-transport-rule` - This function creates a new transport rule or edits an existing one (mail flow rule).

-

- **add-enrollment** - Manage add enrollment

-

- - `cipp-cli add-enrollment` - Add enrollment

-

- **add-equipment-mailbox** - Manage add equipment mailbox

-

- - `cipp-cli add-equipment-mailbox` - Add equipment mailbox

-

- **add-ex-connector** - Manage add ex connector

-

- - `cipp-cli add-ex-connector` - Add ex connector

-

- **add-ex-connector-template** - Manage add ex connector template

-

- - `cipp-cli add-ex-connector-template` - Add ex connector template

-

- **add-group** - Manage add group

-

- - `cipp-cli add-group` - Add group

-

- **add-group-team** - Manage add group team

-

- - `cipp-cli add-group-team` - Add group team

-

- **add-group-template** - Manage add group template

-

- - `cipp-cli add-group-template` - Add group template

-

- **add-guest** - Manage add guest

-

- - `cipp-cli add-guest` - Add guest

-

- **add-intune-reusable-setting** - Manage add intune reusable setting

-

- - `cipp-cli add-intune-reusable-setting` - Add intune reusable setting

-

- **add-intune-reusable-setting-template** - Manage add intune reusable setting template

-

- - `cipp-cli add-intune-reusable-setting-template` - Add intune reusable setting template

-

- **add-intune-template** - Manage add intune template

-

- - `cipp-cli add-intune-template` - Add intune template

-

- **add-jitadmin-template** - Manage add jitadmin template

-

- - `cipp-cli add-jitadmin-template` - Add jitadmin template

-

- **add-mspapp** - Manage add mspapp

-

- - `cipp-cli add-mspapp` - Add mspapp

-

- **add-named-location** - Manage add named location

-

- - `cipp-cli add-named-location` - Add named location

-

- **add-office-app** - Manage add office app

-

- - `cipp-cli add-office-app` - Add office app

-

- **add-policy** - Manage add policy

-

- - `cipp-cli add-policy` - Add policy

-

- **add-quarantine-policy** - Manage add quarantine policy

-

- - `cipp-cli add-quarantine-policy` - Add quarantine policy

-

- **add-room-list** - Manage add room list

-

- - `cipp-cli add-room-list` - Add room list

-

- **add-room-mailbox** - Manage add room mailbox

-

- - `cipp-cli add-room-mailbox` - Add room mailbox

-

- **add-safe-links-policy-from-template** - Manage add safe links policy from template

-

- - `cipp-cli add-safe-links-policy-from-template` - This function deploys SafeLinks policies and rules from templates to selected tenants.

-

- **add-safe-links-policy-template** - Manage add safe links policy template

-

- - `cipp-cli add-safe-links-policy-template` - Add safe links policy template

-

- **add-scheduled-item** - Manage add scheduled item

-

- - `cipp-cli add-scheduled-item` - Add scheduled item

-

- **add-shared-mailbox** - Manage add shared mailbox

-

- - `cipp-cli add-shared-mailbox` - Add shared mailbox

-

- **add-site** - Manage add site

-

- - `cipp-cli add-site` - Add site

-

- **add-site-bulk** - Manage add site bulk

-

- - `cipp-cli add-site-bulk` - Add site bulk

-

- **add-spam-filter** - Manage add spam filter

-

- - `cipp-cli add-spam-filter` - Add spam filter

-

- **add-spam-filter-template** - Manage add spam filter template

-

- - `cipp-cli add-spam-filter-template` - Add spam filter template

-

- **add-standards-deploy** - Manage add standards deploy

-

- - `cipp-cli add-standards-deploy` - Add standards deploy

-

- **add-standards-template** - Manage add standards template

-

- - `cipp-cli add-standards-template` - Add standards template

-

- **add-store-app** - Manage add store app

-

- - `cipp-cli add-store-app` - Add store app

-

- **add-team** - Manage add team

-

- - `cipp-cli add-team` - Add team

-

- **add-tenant** - Manage add tenant

-

- - `cipp-cli add-tenant` - Add tenant

-

- **add-tenant-allow-block-list** - Manage add tenant allow block list

-

- - `cipp-cli add-tenant-allow-block-list` - Add tenant allow block list

-

- **add-test-report** - Manage add test report

-

- - `cipp-cli add-test-report` - Add test report

-

- **add-transport-rule** - Manage add transport rule

-

- - `cipp-cli add-transport-rule` - Add transport rule

-

- **add-transport-template** - Manage add transport template

-

- - `cipp-cli add-transport-template` - Add transport template

-

- **add-user** - Manage add user

-

- - `cipp-cli add-user` - Create a new user in a tenant, optionally scheduled

-

- **add-user-bulk** - Manage add user bulk

-

- - `cipp-cli add-user-bulk` - Bulk-create users in a tenant via CSV import

-

- **add-user-defaults** - Manage add user defaults

-

- - `cipp-cli add-user-defaults` - Add user defaults

-

- **add-win32-script-app** - Manage add win32 script app

-

- - `cipp-cli add-win32-script-app` - Add win32script app

-

- **best-practice-analyser-list** - Manage best practice analyser list

-

- - `cipp-cli best-practice-analyser-list` - Best practice analyser_list

-

- **cippdbtests-run** - Manage cippdbtests run

-

- - `cipp-cli cippdbtests-run` - Cippdbtests run

-

- **cippoffboarding-job** - Manage cippoffboarding job

-

- - `cipp-cli cippoffboarding-job` - Cippoffboarding job

-

- **cippstandards-run** - Manage cippstandards run

-

- - `cipp-cli cippstandards-run` - Cippstandards run

-

- **create-safe-links-policy-template** - Manage create safe links policy template

-

- - `cipp-cli create-safe-links-policy-template` - This function creates a new Safe Links policy template from scratch.

-

- **delete-sharepoint-site** - Manage delete sharepoint site

-

- - `cipp-cli delete-sharepoint-site` - Delete sharepoint site

-

- **delete-test-report** - Manage delete test report

-

- - `cipp-cli delete-test-report` - Delete test report

-

- **deploy-contact-templates** - Manage deploy contact templates

-

- - `cipp-cli deploy-contact-templates` - This function deploys contact(s) from template(s) to selected tenants.

-

- **edit-anti-phishing-filter** - Manage edit anti phishing filter

-

- - `cipp-cli edit-anti-phishing-filter` - Edit anti phishing filter

-

- **edit-assignment-filter** - Manage edit assignment filter

-

- - `cipp-cli edit-assignment-filter` - Edit assignment filter

-

- **edit-capolicy** - Manage edit capolicy

-

- - `cipp-cli edit-capolicy` - Edit capolicy

-

- **edit-contact** - Manage edit contact

-

- - `cipp-cli edit-contact` - Edit contact

-

- **edit-contact-templates** - Manage edit contact templates

-

- - `cipp-cli edit-contact-templates` - Edit contact templates

-

- **edit-equipment-mailbox** - Manage edit equipment mailbox

-

- - `cipp-cli edit-equipment-mailbox` - Edit equipment mailbox

-

- **edit-ex-connector** - Manage edit ex connector

-

- - `cipp-cli edit-ex-connector` - Edit ex connector

-

- **edit-group** - Manage edit group

-

- - `cipp-cli edit-group` - Edit group

-

- **edit-intune-policy** - Manage edit intune policy

-

- - `cipp-cli edit-intune-policy` - Edit intune policy

-

- **edit-intune-script** - Manage edit intune script

-

- - `cipp-cli edit-intune-script` - Edit intune script

-

- **edit-jitadmin-template** - Manage edit jitadmin template

-

- - `cipp-cli edit-jitadmin-template` - Edit jitadmin template

-

- **edit-malware-filter** - Manage edit malware filter

-

- - `cipp-cli edit-malware-filter` - Edit malware filter

-

- **edit-policy** - Manage edit policy

-

- - `cipp-cli edit-policy` - Edit policy

-

- **edit-quarantine-policy** - Manage edit quarantine policy

-

- - `cipp-cli edit-quarantine-policy` - Edit quarantine policy

-

- **edit-room-list** - Manage edit room list

-

- - `cipp-cli edit-room-list` - Edit room list

-

- **edit-room-mailbox** - Manage edit room mailbox

-

- - `cipp-cli edit-room-mailbox` - Edit room mailbox

-

- **edit-safe-attachments-filter** - Manage edit safe attachments filter

-

- - `cipp-cli edit-safe-attachments-filter` - Edit safe attachments filter

-

- **edit-safe-links-policy** - Manage edit safe links policy

-

- - `cipp-cli edit-safe-links-policy` - This function modifies an existing Safe Links policy and its associated rule.

-

- **edit-safe-links-policy-template** - Manage edit safe links policy template

-

- - `cipp-cli edit-safe-links-policy-template` - This function updates an existing Safe Links policy template. #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **edit-spam-filter** - Manage edit spam filter

-

- - `cipp-cli edit-spam-filter` - Edit spam filter

-

- **edit-tenant** - Manage edit tenant

-

- - `cipp-cli edit-tenant` - Edit tenant

-

- **edit-tenant-offboarding-defaults** - Manage edit tenant offboarding defaults

-

- - `cipp-cli edit-tenant-offboarding-defaults` - Edit tenant offboarding defaults

-

- **edit-transport-rule** - Manage edit transport rule

-

- - `cipp-cli edit-transport-rule` - Edit transport rule

-

- **edit-user** - Manage edit user

-

- - `cipp-cli edit-user` - Edit user

-

- **edit-user-aliases** - Manage edit user aliases

-

- - `cipp-cli edit-user-aliases` - Edit user aliases

-

- **exec-access-checks** - Manage exec access checks

-

- - `cipp-cli exec-access-checks` - Exec access checks

-

- **exec-add-alert** - Manage exec add alert

-

- - `cipp-cli exec-add-alert` - Exec add alert

-

- **exec-add-gdaprole** - Manage exec add gdaprole

-

- - `cipp-cli exec-add-gdaprole` - Exec add gdaprole

-

- **exec-add-multi-tenant-app** - Manage exec add multi tenant app

-

- - `cipp-cli exec-add-multi-tenant-app` - Exec add multi tenant app

-

- **exec-add-spn** - Manage exec add spn

-

- - `cipp-cli exec-add-spn` - Exec add spn

-

- **exec-add-tenant** - Manage exec add tenant

-

- - `cipp-cli exec-add-tenant` - Exec add tenant

-

- **exec-add-trusted-ip** - Manage exec add trusted ip

-

- - `cipp-cli exec-add-trusted-ip` - Exec add trusted ip

-

- **exec-alerts-list** - Manage exec alerts list

-

- - `cipp-cli exec-alerts-list` - Exec alerts list

-

- **exec-api-client** - Manage exec api client

-

- - `cipp-cli exec-api-client` - Exec api client

-

- **exec-apipermission-list** - Manage exec apipermission list

-

- - `cipp-cli exec-apipermission-list` - Exec apipermission list

-

- **exec-app-approval** - Manage exec app approval

-

- - `cipp-cli exec-app-approval` - Exec app approval

-

- **exec-app-approval-template** - Manage exec app approval template

-

- - `cipp-cli exec-app-approval-template` - Exec app approval template

-

- **exec-app-insights-query** - Manage exec app insights query

-

- - `cipp-cli exec-app-insights-query` - Exec app insights query

-

- **exec-app-permission-template** - Manage exec app permission template

-

- - `cipp-cli exec-app-permission-template` - Exec app permission template

-

- **exec-app-upload** - Manage exec app upload

-

- - `cipp-cli exec-app-upload` - Exec app upload

-

- **exec-application** - Manage exec application

-

- - `cipp-cli exec-application` - Exec application

-

- **exec-assign-apdevice** - Manage exec assign apdevice

-

- - `cipp-cli exec-assign-apdevice` - Exec assign apdevice

-

- **exec-assign-app** - Manage exec assign app

-

- - `cipp-cli exec-assign-app` - Exec assign app

-

- **exec-assign-policy** - Manage exec assign policy

-

- - `cipp-cli exec-assign-policy` - Exec assign policy

-

- **exec-assignment-filter** - Manage exec assignment filter

-

- - `cipp-cli exec-assignment-filter` - Exec assignment filter

-

- **exec-audit-log-search** - Manage exec audit log search

-

- - `cipp-cli exec-audit-log-search` - Exec audit log search

-

- **exec-auto-extend-gdap** - Manage exec auto extend gdap

-

- - `cipp-cli exec-auto-extend-gdap` - Exec auto extend gdap

-

- **exec-az-bobby-tables** - Manage exec az bobby tables

-

- - `cipp-cli exec-az-bobby-tables` - This function is used to interact with Azure Tables.

-

- **exec-backend-urls** - Manage exec backend urls

-

- - `cipp-cli exec-backend-urls` - Exec backend urls

-

- **exec-backup-retention-config** - Manage exec backup retention config

-

- - `cipp-cli exec-backup-retention-config` - Exec backup retention config

-

- **exec-beccheck** - Manage exec beccheck

-

- - `cipp-cli exec-beccheck` - Exec beccheck

-

- **exec-becremediate** - Manage exec becremediate

-

- - `cipp-cli exec-becremediate` - Exec becremediate

-

- **exec-bitlocker-search** - Manage exec bitlocker search

-

- - `cipp-cli exec-bitlocker-search` - Exec bitlocker search

-

- **exec-bpa** - Manage exec bpa

-

- - `cipp-cli exec-bpa` - Exec bpa

-

- **exec-branding-settings** - Manage exec branding settings

-

- - `cipp-cli exec-branding-settings` - Exec branding settings

-

- **exec-breach-search** - Manage exec breach search

-

- - `cipp-cli exec-breach-search` - Exec breach search

-

- **exec-bulk-license** - Manage exec bulk license

-

- - `cipp-cli exec-bulk-license` - Exec bulk license

-

- **exec-cacheck** - Manage exec cacheck

-

- - `cipp-cli exec-cacheck` - Exec cacheck

-

- **exec-caexclusion** - Manage exec caexclusion

-

- - `cipp-cli exec-caexclusion` - Exec caexclusion

-

- **exec-caservice-exclusion** - Manage exec caservice exclusion

-

- - `cipp-cli exec-caservice-exclusion` - Exec caservice exclusion

-

- **exec-cipp-function** - Manage exec cipp function

-

- - `cipp-cli exec-cipp-function` - This function is used to execute a CIPPCore function from an HTTP request.

-

- **exec-cipp-logs-sas** - Manage exec cipp logs sas

-

- - `cipp-cli exec-cipp-logs-sas` - Creates a long-lived, read-only SAS URL for the CippLogs Azure Storage table. .FUNCTIONALITY Entrypoint .ROLE CIPP.

-

- **exec-cipp-replacemap** - Manage exec cipp replacemap

-

- - `cipp-cli exec-cipp-replacemap` - Exec cipp replacemap

-

- **exec-cippdbcache** - Manage exec cippdbcache

-

- - `cipp-cli exec-cippdbcache` - Exec cippdbcache

-

- **exec-clone-template** - Manage exec clone template

-

- - `cipp-cli exec-clone-template` - Exec clone template

-

- **exec-clr-imm-id** - Manage exec clr imm id

-

- - `cipp-cli exec-clr-imm-id` - Exec clr imm id

-

- **exec-combined-setup** - Manage exec combined setup

-

- - `cipp-cli exec-combined-setup` - Exec combined setup

-

- **exec-community-repo** - Manage exec community repo

-

- - `cipp-cli exec-community-repo` - This function makes changes to a community repository in table storage .FUNCTIONALITY Entrypoint,AnyTenant .ROLE CIPP.

-

- **exec-convert-mailbox** - Manage exec convert mailbox

-

- - `cipp-cli exec-convert-mailbox` - Exec convert mailbox

-

- **exec-copy-for-sent** - Manage exec copy for sent

-

- - `cipp-cli exec-copy-for-sent` - Exec copy for sent

-

- **exec-cpvpermissions** - Manage exec cpvpermissions

-

- - `cipp-cli exec-cpvpermissions` - Exec cpvpermissions

-

- **exec-cpvrefresh** - Manage exec cpvrefresh

-

- - `cipp-cli exec-cpvrefresh` - This endpoint is used to trigger a refresh of CPV for all tenants

-

- **exec-create-app-template** - Manage exec create app template

-

- - `cipp-cli exec-create-app-template` - Exec create app template

-

- **exec-create-default-groups** - Manage exec create default groups

-

- - `cipp-cli exec-create-default-groups` - This function creates a set of default tenant groups that are commonly used .FUNCTIONALITY Entrypoint,AnyTenant .

-

- **exec-create-samapp** - Manage exec create samapp

-

- - `cipp-cli exec-create-samapp` - Exec create samapp

-

- **exec-create-tap** - Manage exec create tap

-

- - `cipp-cli exec-create-tap` - Exec create tap

-

- **exec-csplicense** - Manage exec csplicense

-

- - `cipp-cli exec-csplicense create` - Exec csplicense

- - `cipp-cli exec-csplicense list` - Exec csplicense

-

- **exec-custom-data** - Manage exec custom data

-

- - `cipp-cli exec-custom-data` - Exec custom data

-

- **exec-custom-role** - Manage exec custom role

-

- - `cipp-cli exec-custom-role` - Exec custom role

-

- **exec-delete-gdaprelationship** - Manage exec delete gdaprelationship

-

- - `cipp-cli exec-delete-gdaprelationship` - Exec delete gdaprelationship

-

- **exec-delete-gdaprole-mapping** - Manage exec delete gdaprole mapping

-

- - `cipp-cli exec-delete-gdaprole-mapping` - Exec delete gdaprole mapping

-

- **exec-delete-safe-links-policy** - Manage exec delete safe links policy

-

- - `cipp-cli exec-delete-safe-links-policy` - This function deletes a Safe Links rule and its associated policy.

-

- **exec-device-action** - Manage exec device action

-

- - `cipp-cli exec-device-action` - Exec device action

-

- **exec-device-code-logon** - Manage exec device code logon

-

- - `cipp-cli exec-device-code-logon` - Exec device code logon

-

- **exec-device-delete** - Manage exec device delete

-

- - `cipp-cli exec-device-delete` - Exec device delete

-

- **exec-device-passcode-action** - Manage exec device passcode action

-

- - `cipp-cli exec-device-passcode-action` - Exec device passcode action

-

- **exec-diagnostics-presets** - Manage exec diagnostics presets

-

- - `cipp-cli exec-diagnostics-presets` - Exec diagnostics presets

-

- **exec-disable-user** - Manage exec disable user

-

- - `cipp-cli exec-disable-user` - Exec disable user

-

- **exec-dismiss-risky-user** - Manage exec dismiss risky user

-

- - `cipp-cli exec-dismiss-risky-user` - Exec dismiss risky user

-

- **exec-dns-config** - Manage exec dns config

-

- - `cipp-cli exec-dns-config` - Exec dns config

-

- **exec-domain-action** - Manage exec domain action

-

- - `cipp-cli exec-domain-action` - Exec domain action

-

- **exec-domain-analyser** - Manage exec domain analyser

-

- - `cipp-cli exec-domain-analyser` - Exec domain analyser

-

- **exec-drift-clone** - Manage exec drift clone

-

- - `cipp-cli exec-drift-clone` - Exec drift clone

-

- **exec-durable-functions** - Manage exec durable functions

-

- - `cipp-cli exec-durable-functions` - Exec durable functions

-

- **exec-edit-calendar-permissions** - Manage exec edit calendar permissions

-

- - `cipp-cli exec-edit-calendar-permissions` - Exec edit calendar permissions

-

- **exec-edit-mailbox-permissions** - Manage exec edit mailbox permissions

-

- - `cipp-cli exec-edit-mailbox-permissions` - Exec edit mailbox permissions

-

- **exec-edit-template** - Manage exec edit template

-

- - `cipp-cli exec-edit-template` - Exec edit template

-

- **exec-email-forward** - Manage exec email forward

-

- - `cipp-cli exec-email-forward` - Exec email forward

-

- **exec-enable-archive** - Manage exec enable archive

-

- - `cipp-cli exec-enable-archive` - Exec enable archive

-

- **exec-enable-auto-expanding-archive** - Manage exec enable auto expanding archive

-

- - `cipp-cli exec-enable-auto-expanding-archive` - Exec enable auto expanding archive

-

- **exec-exchange-role-repair** - Manage exec exchange role repair

-

- - `cipp-cli exec-exchange-role-repair` - Exec exchange role repair

-

- **exec-exclude-licenses** - Manage exec exclude licenses

-

- - `cipp-cli exec-exclude-licenses` - Exec exclude licenses

-

- **exec-exclude-tenant** - Manage exec exclude tenant

-

- - `cipp-cli exec-exclude-tenant` - Exec exclude tenant

-

- **exec-extension-mapping** - Manage exec extension mapping

-

- - `cipp-cli exec-extension-mapping` - Exec extension mapping

-

- **exec-extension-ninja-one-queue** - Manage exec extension ninja one queue

-

- - `cipp-cli exec-extension-ninja-one-queue` - Exec extension ninja one queue

-

- **exec-extension-sync** - Manage exec extension sync

-

- - `cipp-cli exec-extension-sync` - Exec extension sync

-

- **exec-extension-test** - Manage exec extension test

-

- - `cipp-cli exec-extension-test` - Exec extension test

-

- **exec-extensions-config** - Manage exec extensions config

-

- - `cipp-cli exec-extensions-config` - Exec extensions config

-

- **exec-feature-flag** - Manage exec feature flag

-

- - `cipp-cli exec-feature-flag` - Exec feature flag

-

- **exec-gdapaccess-assignment** - Manage exec gdapaccess assignment

-

- - `cipp-cli exec-gdapaccess-assignment` - Exec gdapaccess assignment

-

- **exec-gdapinvite** - Manage exec gdapinvite

-

- - `cipp-cli exec-gdapinvite` - Exec gdapinvite

-

- **exec-gdapinvite-approved** - Manage exec gdapinvite approved

-

- - `cipp-cli exec-gdapinvite-approved` - Exec gdapinvite approved

-

- **exec-gdapremove-garole** - Manage exec gdapremove garole

-

- - `cipp-cli exec-gdapremove-garole` - Exec gdapremove garole

-

- **exec-gdaprole-template** - Manage exec gdaprole template

-

- - `cipp-cli exec-gdaprole-template` - Exec gdaprole template

-

- **exec-gdaptrace** - Manage exec gdaptrace

-

- - `cipp-cli exec-gdaptrace` - GDAP Access Path Testing: 1. Validates input parameters (TenantFilter and UPN) 2.

-

- **exec-geo-iplookup** - Manage exec geo iplookup

-

- - `cipp-cli exec-geo-iplookup` - Exec geo iplookup

-

- **exec-get-local-admin-password** - Manage exec get local admin password

-

- - `cipp-cli exec-get-local-admin-password` - Exec get local admin password

-

- **exec-get-recovery-key** - Manage exec get recovery key

-

- - `cipp-cli exec-get-recovery-key` - Exec get recovery key

-

- **exec-git-hub-action** - Manage exec git hub action

-

- - `cipp-cli exec-git-hub-action` - Call GitHub API .ROLE CIPP.Extension.ReadWrite .

-

- **exec-graph-explorer-preset** - Manage exec graph explorer preset

-

- - `cipp-cli exec-graph-explorer-preset` - Exec graph explorer preset

-

- **exec-groups-delete** - Manage exec groups delete

-

- - `cipp-cli exec-groups-delete` - Exec groups delete

-

- **exec-groups-delivery-management** - Manage exec groups delivery management

-

- - `cipp-cli exec-groups-delivery-management` - Exec groups delivery management

-

- **exec-groups-hide-from-gal** - Manage exec groups hide from gal

-

- - `cipp-cli exec-groups-hide-from-gal` - Exec groups hide from gal

-

- **exec-hide-from-gal** - Manage exec hide from gal

-

- - `cipp-cli exec-hide-from-gal` - Exec hide from gal

-

- **exec-hveuser** - Manage exec hveuser

-

- - `cipp-cli exec-hveuser` - Exec hveuser

-

- **exec-incidents-list** - Manage exec incidents list

-

- - `cipp-cli exec-incidents-list` - Exec incidents list

-

- **exec-jitadmin** - Manage exec jitadmin

-

- - `cipp-cli exec-jitadmin` - Just-in-time admin management API endpoint.

-

- **exec-jitadmin-settings** - Manage exec jitadmin settings

-

- - `cipp-cli exec-jitadmin-settings` - Exec jitadmin settings

-

- **exec-license-search** - Manage exec license search

-

- - `cipp-cli exec-license-search` - Exec license search

-

- **exec-list-app-id** - Manage exec list app id

-

- - `cipp-cli exec-list-app-id create` - Exec list app id

- - `cipp-cli exec-list-app-id list` - Exec list app id

-

- **exec-list-backup** - Manage exec list backup

-

- - `cipp-cli exec-list-backup` - Exec list backup

-

- **exec-log-retention-config** - Manage exec log retention config

-

- - `cipp-cli exec-log-retention-config` - Exec log retention config

-

- **exec-mail-test** - Manage exec mail test

-

- - `cipp-cli exec-mail-test` - Exec mail test

-

- **exec-mailbox-mobile-devices** - Manage exec mailbox mobile devices

-

- - `cipp-cli exec-mailbox-mobile-devices` - Exec mailbox mobile devices

-

- **exec-mailbox-restore** - Manage exec mailbox restore

-

- - `cipp-cli exec-mailbox-restore` - Exec mailbox restore

-

- **exec-maintenance-scripts** - Manage exec maintenance scripts

-

- - `cipp-cli exec-maintenance-scripts` - Exec maintenance scripts

-

- **exec-manage-retention-policies** - Manage exec manage retention policies

-

- - `cipp-cli exec-manage-retention-policies` - Exec manage retention policies

-

- **exec-manage-retention-tags** - Manage exec manage retention tags

-

- - `cipp-cli exec-manage-retention-tags` - Exec manage retention tags

-

- **exec-mdo-alerts-list** - Manage exec mdo alerts list

-

- - `cipp-cli exec-mdo-alerts-list` - Exec mdo alerts list

-

- **exec-modify-cal-perms** - Manage exec modify cal perms

-

- - `cipp-cli exec-modify-cal-perms` - Exec modify cal perms

-

- **exec-modify-contact-perms** - Manage exec modify contact perms

-

- - `cipp-cli exec-modify-contact-perms` - Exec modify contact perms

-

- **exec-modify-mbperms** - Manage exec modify mbperms

-

- - `cipp-cli exec-modify-mbperms` - Exec modify mbperms

-

- **exec-named-location** - Manage exec named location

-

- - `cipp-cli exec-named-location` - Exec named location

-

- **exec-new-safe-links-policy** - Manage exec new safe links policy

-

- - `cipp-cli exec-new-safe-links-policy` - This function creates a new Safe Links policy and an associated rule.

-

- **exec-notification-config** - Manage exec notification config

-

- - `cipp-cli exec-notification-config` - Exec notification config

-

- **exec-offboard-tenant** - Manage exec offboard tenant

-

- - `cipp-cli exec-offboard-tenant` - Exec offboard tenant

-

- **exec-offboard-user** - Manage exec offboard user

-

- - `cipp-cli exec-offboard-user` - Offboard a user with configurable options for mailbox conversion, access delegation, license removal, and more

-

- **exec-offload-functions** - Manage exec offload functions

-

- - `cipp-cli exec-offload-functions` - Exec offload functions

-

- **exec-onboard-tenant** - Manage exec onboard tenant

-

- - `cipp-cli exec-onboard-tenant` - Exec onboard tenant

-

- **exec-one-drive-short-cut** - Manage exec one drive short cut

-

- - `cipp-cli exec-one-drive-short-cut` - Exec one drive short cut

-

- **exec-onedrive-provision** - Manage exec onedrive provision

-

- - `cipp-cli exec-onedrive-provision` - Exec onedrive provision

-

- **exec-partner-mode** - Manage exec partner mode

-

- - `cipp-cli exec-partner-mode` - Exec partner mode

-

- **exec-partner-webhook** - Manage exec partner webhook

-

- - `cipp-cli exec-partner-webhook` - Exec partner webhook

-

- **exec-password-config** - Manage exec password config

-

- - `cipp-cli exec-password-config` - Exec password config

-

- **exec-password-never-expires** - Manage exec password never expires

-

- - `cipp-cli exec-password-never-expires` - Exec password never expires

-

- **exec-per-user-mfa** - Manage exec per user mfa

-

- - `cipp-cli exec-per-user-mfa` - Exec per user mfa

-

- **exec-permission-repair** - Manage exec permission repair

-

- - `cipp-cli exec-permission-repair` - Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM. .FUNCTIONALITY Entrypoint .

-

- **exec-quarantine-management** - Manage exec quarantine management

-

- - `cipp-cli exec-quarantine-management` - Exec quarantine management

-

- **exec-remove-mailbox-rule** - Manage exec remove mailbox rule

-

- - `cipp-cli exec-remove-mailbox-rule` - Exec remove mailbox rule

-

- **exec-remove-restricted-user** - Manage exec remove restricted user

-

- - `cipp-cli exec-remove-restricted-user` - Removes a user from the restricted senders list in Exchange Online.

-

- **exec-remove-teams-voice-phone-number-assignment** - Manage exec remove teams voice phone number assignment

-

- - `cipp-cli exec-remove-teams-voice-phone-number-assignment` - Exec remove teams voice phone number assignment

-

- **exec-remove-tenant** - Manage exec remove tenant

-

- - `cipp-cli exec-remove-tenant` - Exec remove tenant

-

- **exec-rename-apdevice** - Manage exec rename apdevice

-

- - `cipp-cli exec-rename-apdevice` - Exec rename apdevice

-

- **exec-reprocess-user-licenses** - Manage exec reprocess user licenses

-

- - `cipp-cli exec-reprocess-user-licenses` - Exec reprocess user licenses

-

- **exec-reset-mfa** - Manage exec reset mfa

-

- - `cipp-cli exec-reset-mfa` - Exec reset mfa

-

- **exec-reset-pass** - Manage exec reset pass

-

- - `cipp-cli exec-reset-pass` - Exec reset pass

-

- **exec-restore-backup** - Manage exec restore backup

-

- - `cipp-cli exec-restore-backup` - Exec restore backup

-

- **exec-restore-deleted** - Manage exec restore deleted

-

- - `cipp-cli exec-restore-deleted` - Exec restore deleted

-

- **exec-revoke-sessions** - Manage exec revoke sessions

-

- - `cipp-cli exec-revoke-sessions` - Exec revoke sessions

-

- **exec-run-backup** - Manage exec run backup

-

- - `cipp-cli exec-run-backup` - Exec run backup

-

- **exec-run-tenant-group-rule** - Manage exec run tenant group rule

-

- - `cipp-cli exec-run-tenant-group-rule` - This function executes dynamic tenant group rules for immediate membership updates .FUNCTIONALITY Entrypoint,AnyTenant .

-

- **exec-samapp-permissions** - Manage exec samapp permissions

-

- - `cipp-cli exec-samapp-permissions` - Exec samapp permissions

-

- **exec-samroles** - Manage exec samroles

-

- - `cipp-cli exec-samroles` - Exec samroles

-

- **exec-samsetup** - Manage exec samsetup

-

- - `cipp-cli exec-samsetup` - Exec samsetup

-

- **exec-schedule-mailbox-vacation** - Manage exec schedule mailbox vacation

-

- - `cipp-cli exec-schedule-mailbox-vacation` - Exec schedule mailbox vacation

-

- **exec-schedule-ooovacation** - Manage exec schedule ooovacation

-

- - `cipp-cli exec-schedule-ooovacation` - Exec schedule ooovacation

-

- **exec-scheduler-billing-run** - Manage exec scheduler billing run

-

- - `cipp-cli exec-scheduler-billing-run` - Exec scheduler billing run

-

- **exec-send-org-message** - Manage exec send org message

-

- - `cipp-cli exec-send-org-message` - Exec send org message

-

- **exec-send-push** - Manage exec send push

-

- - `cipp-cli exec-send-push` - Exec send push

-

- **exec-service-principals** - Manage exec service principals

-

- - `cipp-cli exec-service-principals` - Exec service principals

-

- **exec-set-apdevice-group-tag** - Manage exec set apdevice group tag

-

- - `cipp-cli exec-set-apdevice-group-tag` - Exec set apdevice group tag

-

- **exec-set-calendar-processing** - Manage exec set calendar processing

-

- - `cipp-cli exec-set-calendar-processing` - Exec set calendar processing

-

- **exec-set-cippauto-backup** - Manage exec set cippauto backup

-

- - `cipp-cli exec-set-cippauto-backup` - Exec set cippauto backup

-

- **exec-set-cloud-managed** - Manage exec set cloud managed

-

- - `cipp-cli exec-set-cloud-managed` - Sets the cloud-managed status of a user, group, or contact. #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **exec-set-litigation-hold** - Manage exec set litigation hold

-

- - `cipp-cli exec-set-litigation-hold` - Exec set litigation hold

-

- **exec-set-mailbox-email-size** - Manage exec set mailbox email size

-

- - `cipp-cli exec-set-mailbox-email-size` - Exec set mailbox email size

-

- **exec-set-mailbox-locale** - Manage exec set mailbox locale

-

- - `cipp-cli exec-set-mailbox-locale` - Exec set mailbox locale

-

- **exec-set-mailbox-quota** - Manage exec set mailbox quota

-

- - `cipp-cli exec-set-mailbox-quota` - Exec set mailbox quota

-

- **exec-set-mailbox-retention-policies** - Manage exec set mailbox retention policies

-

- - `cipp-cli exec-set-mailbox-retention-policies` - Exec set mailbox retention policies

-

- **exec-set-mailbox-rule** - Manage exec set mailbox rule

-

- - `cipp-cli exec-set-mailbox-rule` - Exec set mailbox rule

-

- **exec-set-mdo-alert** - Manage exec set mdo alert

-

- - `cipp-cli exec-set-mdo-alert` - Exec set mdo alert

-

- **exec-set-oo-o** - Manage exec set oo o

-

- - `cipp-cli exec-set-oo-o` - Exec set oo o

-

- **exec-set-package-tag** - Manage exec set package tag

-

- - `cipp-cli exec-set-package-tag` - Exec set package tag

-

- **exec-set-recipient-limits** - Manage exec set recipient limits

-

- - `cipp-cli exec-set-recipient-limits` - Exec set recipient limits

-

- **exec-set-retention-hold** - Manage exec set retention hold

-

- - `cipp-cli exec-set-retention-hold` - Exec set retention hold

-

- **exec-set-security-alert** - Manage exec set security alert

-

- - `cipp-cli exec-set-security-alert` - Exec set security alert

-

- **exec-set-security-incident** - Manage exec set security incident

-

- - `cipp-cli exec-set-security-incident` - Exec set security incident

-

- **exec-set-share-point-member** - Manage exec set share point member

-

- - `cipp-cli exec-set-share-point-member` - Exec set share point member

-

- **exec-set-user-photo** - Manage exec set user photo

-

- - `cipp-cli exec-set-user-photo` - Exec set user photo

-

- **exec-share-point-perms** - Manage exec share point perms

-

- - `cipp-cli exec-share-point-perms` - Exec share point perms

-

- **exec-standard-convert** - Manage exec standard convert

-

- - `cipp-cli exec-standard-convert` - Exec standard convert

-

- **exec-standards-run** - Manage exec standards run

-

- - `cipp-cli exec-standards-run` - Exec standards run

-

- **exec-start-managed-folder-assistant** - Manage exec start managed folder assistant

-

- - `cipp-cli exec-start-managed-folder-assistant` - Exec start managed folder assistant

-

- **exec-sync-apdevices** - Manage exec sync apdevices

-

- - `cipp-cli exec-sync-apdevices` - Exec sync apdevices

-

- **exec-sync-dep** - Manage exec sync dep

-

- - `cipp-cli exec-sync-dep` - Syncs devices from Apple Business Manager to Intune #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **exec-sync-vpp** - Manage exec sync vpp

-

- - `cipp-cli exec-sync-vpp` - Exec sync vpp

-

- **exec-teams-voice-phone-number-assignment** - Manage exec teams voice phone number assignment

-

- - `cipp-cli exec-teams-voice-phone-number-assignment` - Exec teams voice phone number assignment

-

- **exec-tenant-group** - Manage exec tenant group

-

- - `cipp-cli exec-tenant-group` - This function is used to manage tenant groups in CIPP .FUNCTIONALITY Entrypoint,AnyTenant .ROLE Tenant.Groups.

-

- **exec-test-run** - Manage exec test run

-

- - `cipp-cli exec-test-run` - Exec test run

-

- **exec-time-settings** - Manage exec time settings

-

- - `cipp-cli exec-time-settings` - Exec time settings

-

- **exec-token-exchange** - Manage exec token exchange

-

- - `cipp-cli exec-token-exchange` - Exec token exchange

-

- **exec-universal-search** - Manage exec universal search

-

- - `cipp-cli exec-universal-search` - Exec universal search

-

- **exec-universal-search-v2** - Manage exec universal search v2

-

- - `cipp-cli exec-universal-search-v2` - Exec universal search v2

-

- **exec-update-drift-deviation** - Manage exec update drift deviation

-

- - `cipp-cli exec-update-drift-deviation` - Exec update drift deviation

-

- **exec-update-refresh-token** - Manage exec update refresh token

-

- - `cipp-cli exec-update-refresh-token` - Exec update refresh token

-

- **exec-update-secure-score** - Manage exec update secure score

-

- - `cipp-cli exec-update-secure-score` - Exec update secure score

-

- **exec-user-bookmarks** - Manage exec user bookmarks

-

- - `cipp-cli exec-user-bookmarks` - Exec user bookmarks

-

- **exec-user-settings** - Manage exec user settings

-

- - `cipp-cli exec-user-settings` - Exec user settings

-

- **exec-webhook-subscriptions** - Manage exec webhook subscriptions

-

- - `cipp-cli exec-webhook-subscriptions` - Exec webhook subscriptions

-

- **get-cipp-alerts** - Manage get cipp alerts

-

- - `cipp-cli get-cipp-alerts` - Get cipp alerts

-

- **get-version** - Manage get version

-

- - `cipp-cli get-version` - Get version

-

- **list-admin-portal-licenses** - Manage list admin portal licenses

-

- - `cipp-cli list-admin-portal-licenses` - List admin portal licenses

-

- **list-alerts-queue** - Manage list alerts queue

-

- - `cipp-cli list-alerts-queue` - List alerts queue

-

- **list-all-tenant-device-compliance** - Manage list all tenant device compliance

-

- - `cipp-cli list-all-tenant-device-compliance` - List all tenant device compliance

-

- **list-anti-phishing-filters** - Manage list anti phishing filters

-

- - `cipp-cli list-anti-phishing-filters` - List anti phishing filters

-

- **list-apdevices** - Manage list apdevices

-

- - `cipp-cli list-apdevices` - List apdevices

-

- **list-api-test** - Manage list api test

-

- - `cipp-cli list-api-test` - List api test

-

- **list-app-approval-templates** - Manage list app approval templates

-

- - `cipp-cli list-app-approval-templates` - List app approval templates

-

- **list-app-consent-requests** - Manage list app consent requests

-

- - `cipp-cli list-app-consent-requests` - List app consent requests

-

- **list-app-protection-policies** - Manage list app protection policies

-

- - `cipp-cli list-app-protection-policies` - List app protection policies

-

- **list-app-status** - Manage list app status

-

- - `cipp-cli list-app-status` - List app status

-

- **list-application-queue** - Manage list application queue

-

- - `cipp-cli list-application-queue` - List application queue

-

- **list-apps** - Manage list apps

-

- - `cipp-cli list-apps` - List apps

-

- **list-apps-repository** - Manage list apps repository

-

- - `cipp-cli list-apps-repository` - List apps repository

-

- **list-assignment-filter-templates** - Manage list assignment filter templates

-

- - `cipp-cli list-assignment-filter-templates` - List assignment filter templates

-

- **list-assignment-filters** - Manage list assignment filters

-

- - `cipp-cli list-assignment-filters` - List assignment filters

-

- **list-audit-log-searches** - Manage list audit log searches

-

- - `cipp-cli list-audit-log-searches` - List audit log searches

-

- **list-audit-log-test** - Manage list audit log test

-

- - `cipp-cli list-audit-log-test` - List audit log test

-

- **list-audit-logs** - Manage list audit logs

-

- - `cipp-cli list-audit-logs` - List audit logs

-

- **list-autopilotconfig** - Manage list autopilotconfig

-

- - `cipp-cli list-autopilotconfig` - List autopilotconfig

-

- **list-available-tests** - Manage list available tests

-

- - `cipp-cli list-available-tests` - List available tests

-

- **list-azure-adconnect-status** - Manage list azure adconnect status

-

- - `cipp-cli list-azure-adconnect-status` - List azure adconnect status

-

- **list-basic-auth** - Manage list basic auth

-

- - `cipp-cli list-basic-auth` - List basic auth

-

- **list-bpa** - Manage list bpa

-

- - `cipp-cli list-bpa` - List bpa

-

- **list-bpatemplates** - Manage list bpatemplates

-

- - `cipp-cli list-bpatemplates` - List bpatemplates

-

- **list-breaches-account** - Manage list breaches account

-

- - `cipp-cli list-breaches-account` - List breaches account

-

- **list-breaches-tenant** - Manage list breaches tenant

-

- - `cipp-cli list-breaches-tenant` - List breaches tenant

-

- **list-calendar-permissions** - Manage list calendar permissions

-

- - `cipp-cli list-calendar-permissions` - List calendar permissions

-

- **list-catemplates** - Manage list catemplates

-

- - `cipp-cli list-catemplates` - List catemplates

-

- **list-check-ext-alerts** - Manage list check ext alerts

-

- - `cipp-cli list-check-ext-alerts` - List check ext alerts

-

- **list-community-repos** - Manage list community repos

-

- - `cipp-cli list-community-repos` - This function lists community repositories in Table Storage .FUNCTIONALITY Entrypoint,AnyTenant .ROLE CIPP.Core.

-

- **list-compliance-policies** - Manage list compliance policies

-

- - `cipp-cli list-compliance-policies` - List compliance policies

-

- **list-conditional-access-policies** - Manage list conditional access policies

-

- - `cipp-cli list-conditional-access-policies` - List conditional access policies

-

- **list-conditional-access-policy-changes** - Manage list conditional access policy changes

-

- - `cipp-cli list-conditional-access-policy-changes` - List conditional access policy changes

-

- **list-connection-filter** - Manage list connection filter

-

- - `cipp-cli list-connection-filter` - List connection filter

-

- **list-connection-filter-templates** - Manage list connection filter templates

-

- - `cipp-cli list-connection-filter-templates` - List connection filter templates

-

- **list-contact-permissions** - Manage list contact permissions

-

- - `cipp-cli list-contact-permissions` - List contact permissions

-

- **list-contact-templates** - Manage list contact templates

-

- - `cipp-cli list-contact-templates` - List contact templates

-

- **list-contacts** - Manage list contacts

-

- - `cipp-cli list-contacts` - List contacts

-

- **list-csplicenses** - Manage list csplicenses

-

- - `cipp-cli list-csplicenses` - List csplicenses

-

- **list-cspsku** - Manage list cspsku

-

- - `cipp-cli list-cspsku` - List cspsku

-

- **list-custom-data-mappings** - Manage list custom data mappings

-

- - `cipp-cli list-custom-data-mappings` - List custom data mappings

-

- **list-custom-role** - Manage list custom role

-

- - `cipp-cli list-custom-role` - List custom role

-

- **list-custom-variables** - Manage list custom variables

-

- - `cipp-cli list-custom-variables` - List custom variables

-

- **list-dbcache** - Manage list dbcache

-

- - `cipp-cli list-dbcache` - List dbcache

-

- **list-defender-state** - Manage list defender state

-

- - `cipp-cli list-defender-state` - List defender state

-

- **list-defender-tvm** - Manage list defender tvm

-

- - `cipp-cli list-defender-tvm` - List defender tvm

-

- **list-deleted-items** - Manage list deleted items

-

- - `cipp-cli list-deleted-items` - List deleted items

-

- **list-detected-app-devices** - Manage list detected app devices

-

- - `cipp-cli list-detected-app-devices` - List detected app devices

-

- **list-detected-apps** - Manage list detected apps

-

- - `cipp-cli list-detected-apps` - List detected apps

-

- **list-device-details** - Manage list device details

-

- - `cipp-cli list-device-details` - List device details

-

- **list-devices** - Manage list devices

-

- - `cipp-cli list-devices` - List devices

-

- **list-diagnostics-presets** - Manage list diagnostics presets

-

- - `cipp-cli list-diagnostics-presets` - List diagnostics presets

-

- **list-directory-objects** - Manage list directory objects

-

- - `cipp-cli list-directory-objects` - List directory objects

-

- **list-domain-analyser** - Manage list domain analyser

-

- - `cipp-cli list-domain-analyser` - List domain analyser

-

- **list-domain-health** - Manage list domain health

-

- - `cipp-cli list-domain-health` - List domain health

-

- **list-domains** - Manage list domains

-

- - `cipp-cli list-domains` - List domains

-

- **list-equipment** - Manage list equipment

-

- - `cipp-cli list-equipment` - List equipment

-

- **list-ex-connector-templates** - Manage list ex connector templates

-

- - `cipp-cli list-ex-connector-templates` - List ex connector templates

-

- **list-exchange-connectors** - Manage list exchange connectors

-

- - `cipp-cli list-exchange-connectors` - List exchange connectors

-

- **list-excluded-licenses** - Manage list excluded licenses

-

- - `cipp-cli list-excluded-licenses` - List excluded licenses

-

- **list-exo-request** - Manage list exo request

-

- - `cipp-cli list-exo-request` - List exo request

-

- **list-extension-cache-data** - Manage list extension cache data

-

- - `cipp-cli list-extension-cache-data` - This function is used to list the extension cache data. .FUNCTIONALITY Entrypoint .ROLE CIPP.Core.

-

- **list-extension-sync** - Manage list extension sync

-

- - `cipp-cli list-extension-sync` - List extension sync

-

- **list-extensions-config** - Manage list extensions config

-

- - `cipp-cli list-extensions-config` - List extensions config

-

- **list-external-tenant-info** - Manage list external tenant info

-

- - `cipp-cli list-external-tenant-info` - List external tenant info

-

- **list-feature-flags** - Manage list feature flags

-

- - `cipp-cli list-feature-flags` - List feature flags

-

- **list-function-parameters** - Manage list function parameters

-

- - `cipp-cli list-function-parameters` - List function parameters

-

- **list-function-stats** - Manage list function stats

-

- - `cipp-cli list-function-stats` - List function stats

-

- **list-gdapaccess-assignments** - Manage list gdapaccess assignments

-

- - `cipp-cli list-gdapaccess-assignments` - List gdapaccess assignments

-

- **list-gdapinvite** - Manage list gdapinvite

-

- - `cipp-cli list-gdapinvite` - List gdapinvite

-

- **list-gdaproles** - Manage list gdaproles

-

- - `cipp-cli list-gdaproles` - List gdaproles

-

- **list-generic-test-function** - Manage list generic test function

-

- - `cipp-cli list-generic-test-function` - List generic test function

-

- **list-git-hub-release-notes** - Manage list git hub release notes

-

- - `cipp-cli list-git-hub-release-notes` - Returns release metadata for the provided repository and semantic version. Hotfix versions (e.g. v8.5.

-

- **list-global-address-list** - Manage list global address list

-

- - `cipp-cli list-global-address-list` - List global address list

-

- **list-graph-bulk-request** - Manage list graph bulk request

-

- - `cipp-cli list-graph-bulk-request` - List graph bulk request

-

- **list-graph-explorer-presets** - Manage list graph explorer presets

-

- - `cipp-cli list-graph-explorer-presets` - List graph explorer presets

-

- **list-graph-request** - Manage list graph request

-

- - `cipp-cli list-graph-request` - List graph request

-

- **list-group-sender-authentication** - Manage list group sender authentication

-

- - `cipp-cli list-group-sender-authentication` - List group sender authentication

-

- **list-group-templates** - Manage list group templates

-

- - `cipp-cli list-group-templates` - List group templates

-

- **list-groups** - Manage list groups

-

- - `cipp-cli list-groups` - List groups

-

- **list-halo-clients** - Manage list halo clients

-

- - `cipp-cli list-halo-clients` - List halo clients

-

- **list-inactive-accounts** - Manage list inactive accounts

-

- - `cipp-cli list-inactive-accounts` - List inactive accounts

-

- **list-intune-intents** - Manage list intune intents

-

- - `cipp-cli list-intune-intents` - List intune intents

-

- **list-intune-policy** - Manage list intune policy

-

- - `cipp-cli list-intune-policy` - List intune policy

-

- **list-intune-reusable-setting-templates** - Manage list intune reusable setting templates

-

- - `cipp-cli list-intune-reusable-setting-templates` - List intune reusable setting templates

-

- **list-intune-reusable-settings** - Manage list intune reusable settings

-

- - `cipp-cli list-intune-reusable-settings` - List intune reusable settings

-

- **list-intune-script** - Manage list intune script

-

- - `cipp-cli list-intune-script` - List intune script

-

- **list-intune-templates** - Manage list intune templates

-

- - `cipp-cli list-intune-templates` - List intune templates

-

- **list-ipwhitelist** - Manage list ipwhitelist

-

- - `cipp-cli list-ipwhitelist` - List ipwhitelist

-

- **list-jitadmin** - Manage list jitadmin

-

- - `cipp-cli list-jitadmin` - List Just-in-time admin users for a tenant or all tenants. #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **list-jitadmin-templates** - Manage list jitadmin templates

-

- - `cipp-cli list-jitadmin-templates` - List jitadmin templates

-

- **list-known-ipdb** - Manage list known ipdb

-

- - `cipp-cli list-known-ipdb` - List known ipdb

-

- **list-licenses** - Manage list licenses

-

- - `cipp-cli list-licenses` - List licenses

-

- **list-logs** - Manage list logs

-

- - `cipp-cli list-logs` - List logs

-

- **list-mail-quarantine** - Manage list mail quarantine

-

- - `cipp-cli list-mail-quarantine` - List mail quarantine

-

- **list-mail-quarantine-message** - Manage list mail quarantine message

-

- - `cipp-cli list-mail-quarantine-message` - List mail quarantine message

-

- **list-mailbox-cas** - Manage list mailbox cas

-

- - `cipp-cli list-mailbox-cas` - List mailbox cas

-

- **list-mailbox-forwarding** - Manage list mailbox forwarding

-

- - `cipp-cli list-mailbox-forwarding` - List mailbox forwarding

-

- **list-mailbox-mobile-devices** - Manage list mailbox mobile devices

-

- - `cipp-cli list-mailbox-mobile-devices` - List mailbox mobile devices

-

- **list-mailbox-restores** - Manage list mailbox restores

-

- - `cipp-cli list-mailbox-restores` - List mailbox restores

-

- **list-mailbox-rules** - Manage list mailbox rules

-

- - `cipp-cli list-mailbox-rules` - List mailbox rules

-

- **list-mailboxes** - Manage list mailboxes

-

- - `cipp-cli list-mailboxes` - List mailboxes

-

- **list-malware-filters** - Manage list malware filters

-

- - `cipp-cli list-malware-filters` - List malware filters

-

- **list-message-trace** - Manage list message trace

-

- - `cipp-cli list-message-trace` - List message trace

-

- **list-mfausers** - Manage list mfausers

-

- - `cipp-cli list-mfausers` - List mfausers

-

- **list-named-locations** - Manage list named locations

-

- - `cipp-cli list-named-locations` - List named locations

-

- **list-new-user-defaults** - Manage list new user defaults

-

- - `cipp-cli list-new-user-defaults` - List new user defaults

-

- **list-notification-config** - Manage list notification config

-

- - `cipp-cli list-notification-config` - List notification config

-

- **list-oauth-apps** - Manage list oauth apps

-

- - `cipp-cli list-oauth-apps` - List oauth apps

-

- **list-oo-o** - Manage list oo o

-

- - `cipp-cli list-oo-o` - List oo o

-

- **list-org** - Manage list org

-

- - `cipp-cli list-org` - List org

-

- **list-partner-relationships** - Manage list partner relationships

-

- - `cipp-cli list-partner-relationships` - List partner relationships

-

- **list-pending-webhooks** - Manage list pending webhooks

-

- - `cipp-cli list-pending-webhooks` - List pending webhooks

-

- **list-per-user-mfa** - Manage list per user mfa

-

- - `cipp-cli list-per-user-mfa` - List per user mfa

-

- **list-potential-apps** - Manage list potential apps

-

- - `cipp-cli list-potential-apps` - List potential apps

-

- **list-quarantine-policy** - Manage list quarantine policy

-

- - `cipp-cli list-quarantine-policy` - List quarantine policy

-

- **list-restricted-users** - Manage list restricted users

-

- - `cipp-cli list-restricted-users` - Lists users from the restricted senders list in Exchange Online.

-

- **list-roles** - Manage list roles

-

- - `cipp-cli list-roles` - List roles

-

- **list-room-lists** - Manage list room lists

-

- - `cipp-cli list-room-lists` - List room lists

-

- **list-rooms** - Manage list rooms

-

- - `cipp-cli list-rooms` - List rooms

-

- **list-safe-attachments-filters** - Manage list safe attachments filters

-

- - `cipp-cli list-safe-attachments-filters` - List safe attachments filters

-

- **list-safe-links-policy** - Manage list safe links policy

-

- - `cipp-cli list-safe-links-policy` - This function is used to list the Safe Links policies in the tenant, including unmatched rules and policies.

-

- **list-safe-links-policy-details** - Manage list safe links policy details

-

- - `cipp-cli list-safe-links-policy-details` - This function retrieves details for a specific Safe Links policy and rule.

-

- **list-safe-links-policy-template-details** - Manage list safe links policy template details

-

- - `cipp-cli list-safe-links-policy-template-details` - This function retrieves details for a specific Safe Links policy template.

-

- **list-safe-links-policy-templates** - Manage list safe links policy templates

-

- - `cipp-cli list-safe-links-policy-templates` - List safe links policy templates

-

- **list-scheduled-item-details** - Manage list scheduled item details

-

- - `cipp-cli list-scheduled-item-details` - List scheduled item details

-

- **list-scheduled-items** - Manage list scheduled items

-

- - `cipp-cli list-scheduled-items` - List scheduled items

-

- **list-service-health** - Manage list service health

-

- - `cipp-cli list-service-health` - List service health

-

- **list-shared-mailbox-account-enabled** - Manage list shared mailbox account enabled

-

- - `cipp-cli list-shared-mailbox-account-enabled` - List shared mailbox account enabled

-

- **list-shared-mailbox-statistics** - Manage list shared mailbox statistics

-

- - `cipp-cli list-shared-mailbox-statistics` - List shared mailbox statistics

-

- **list-sharepoint-admin-url** - Manage list sharepoint admin url

-

- - `cipp-cli list-sharepoint-admin-url` - List sharepoint admin url

-

- **list-sharepoint-quota** - Manage list sharepoint quota

-

- - `cipp-cli list-sharepoint-quota` - List sharepoint quota

-

- **list-sharepoint-settings** - Manage list sharepoint settings

-

- - `cipp-cli list-sharepoint-settings` - List sharepoint settings

-

- **list-sign-ins** - Manage list sign ins

-

- - `cipp-cli list-sign-ins` - List sign ins

-

- **list-site-members** - Manage list site members

-

- - `cipp-cli list-site-members` - List site members

-

- **list-sites** - Manage list sites

-

- - `cipp-cli list-sites` - List sites

-

- **list-spam-filter-templates** - Manage list spam filter templates

-

- - `cipp-cli list-spam-filter-templates` - List spam filter templates

-

- **list-spamfilter** - Manage list spamfilter

-

- - `cipp-cli list-spamfilter` - List spamfilter

-

- **list-standard-templates** - Manage list standard templates

-

- - `cipp-cli list-standard-templates` - List standard templates

-

- **list-standards** - Manage list standards

-

- - `cipp-cli list-standards` - List standards

-

- **list-standards-compare** - Manage list standards compare

-

- - `cipp-cli list-standards-compare` - List standards compare

-

- **list-teams** - Manage list teams

-

- - `cipp-cli list-teams` - List teams

-

- **list-teams-activity** - Manage list teams activity

-

- - `cipp-cli list-teams-activity` - List teams activity

-

- **list-teams-lis-location** - Manage list teams lis location

-

- - `cipp-cli list-teams-lis-location` - List teams lis location

-

- **list-teams-voice** - Manage list teams voice

-

- - `cipp-cli list-teams-voice` - List teams voice

-

- **list-tenant-alignment** - Manage list tenant alignment

-

- - `cipp-cli list-tenant-alignment` - List tenant alignment

-

- **list-tenant-allow-block-list** - Manage list tenant allow block list

-

- - `cipp-cli list-tenant-allow-block-list` - List tenant allow block list

-

- **list-tenant-details** - Manage list tenant details

-

- - `cipp-cli list-tenant-details` - List tenant details

-

- **list-tenant-drift** - Manage list tenant drift

-

- - `cipp-cli list-tenant-drift` - List tenant drift

-

- **list-tenant-groups** - Manage list tenant groups

-

- - `cipp-cli list-tenant-groups` - Entrypoint for listing tenant groups

-

- **list-tenant-onboarding** - Manage list tenant onboarding

-

- - `cipp-cli list-tenant-onboarding` - List tenant onboarding

-

- **list-tenants** - Manage list tenants

-

- - `cipp-cli list-tenants` - List tenants

-

- **list-test-reports** - Manage list test reports

-

- - `cipp-cli list-test-reports` - Lists all available test reports from JSON files and database

-

- **list-tests** - Manage list tests

-

- - `cipp-cli list-tests` - Lists tests for a tenant, optionally filtered by report ID

-

- **list-transport-rules** - Manage list transport rules

-

- - `cipp-cli list-transport-rules` - List transport rules

-

- **list-transport-rules-templates** - Manage list transport rules templates

-

- - `cipp-cli list-transport-rules-templates` - List transport rules templates

-

- **list-user-conditional-access-policies** - Manage list user conditional access policies

-

- - `cipp-cli list-user-conditional-access-policies` - List user conditional access policies

-

- **list-user-counts** - Manage list user counts

-

- - `cipp-cli list-user-counts` - List user counts

-

- **list-user-devices** - Manage list user devices

-

- - `cipp-cli list-user-devices` - List user devices

-

- **list-user-groups** - Manage list user groups

-

- - `cipp-cli list-user-groups` - List user groups

-

- **list-user-mailbox-details** - Manage list user mailbox details

-

- - `cipp-cli list-user-mailbox-details` - List user mailbox details

-

- **list-user-mailbox-rules** - Manage list user mailbox rules

-

- - `cipp-cli list-user-mailbox-rules` - List user mailbox rules

-

- **list-user-photo** - Manage list user photo

-

- - `cipp-cli list-user-photo` - List user photo

-

- **list-user-settings** - Manage list user settings

-

- - `cipp-cli list-user-settings` - List user settings

-

- **list-user-signin-logs** - Manage list user signin logs

-

- - `cipp-cli list-user-signin-logs` - List user signin logs

-

- **list-user-trusted-blocked-senders** - Manage list user trusted blocked senders

-

- - `cipp-cli list-user-trusted-blocked-senders` - List user trusted blocked senders

-

- **list-users** - Manage list users

-

- - `cipp-cli list-users` - List users

-

- **list-users-and-groups** - Manage list users and groups

-

- - `cipp-cli list-users-and-groups` - List users and groups

-

- **list-webhook-alert** - Manage list webhook alert

-

- - `cipp-cli list-webhook-alert` - List webhook alert

-

- **listmailbox-permissions** - Manage listmailbox permissions

-

- - `cipp-cli listmailbox-permissions` - Listmailbox permissions

-

- **patch-user** - Manage patch user

-

- - `cipp-cli patch-user` - Patch user

-

- **public-phishing-check** - Manage public phishing check

-

- - `cipp-cli public-phishing-check` - Public phishing check

-

- **public-ping** - Manage public ping

-

- - `cipp-cli public-ping` - Public ping

-

- **public-webhooks** - Manage public webhooks

-

- - `cipp-cli public-webhooks` - Public webhooks

-

- **remove-apdevice** - Manage remove apdevice

-

- - `cipp-cli remove-apdevice` - Remove apdevice

-

- **remove-app** - Manage remove app

-

- - `cipp-cli remove-app` - Remove app

-

- **remove-assignment-filter-template** - Manage remove assignment filter template

-

- - `cipp-cli remove-assignment-filter-template` - Remove assignment filter template

-

- **remove-autopilot-config** - Manage remove autopilot config

-

- - `cipp-cli remove-autopilot-config` - Remove autopilot config

-

- **remove-bpatemplate** - Manage remove bpatemplate

-

- - `cipp-cli remove-bpatemplate` - Remove bpatemplate

-

- **remove-capolicy** - Manage remove capolicy

-

- - `cipp-cli remove-capolicy` - Remove capolicy

-

- **remove-catemplate** - Manage remove catemplate

-

- - `cipp-cli remove-catemplate` - Remove catemplate

-

- **remove-connectionfilter-template** - Manage remove connectionfilter template

-

- - `cipp-cli remove-connectionfilter-template` - Remove connectionfilter template

-

- **remove-contact** - Manage remove contact

-

- - `cipp-cli remove-contact` - Remove contact

-

- **remove-contact-templates** - Manage remove contact templates

-

- - `cipp-cli remove-contact-templates` - Remove contact templates

-

- **remove-deleted-object** - Manage remove deleted object

-

- - `cipp-cli remove-deleted-object` - Remove deleted object

-

- **remove-ex-connector** - Manage remove ex connector

-

- - `cipp-cli remove-ex-connector` - Remove ex connector

-

- **remove-ex-connector-template** - Manage remove ex connector template

-

- - `cipp-cli remove-ex-connector-template` - Remove ex connector template

-

- **remove-group-template** - Manage remove group template

-

- - `cipp-cli remove-group-template` - Remove group template

-

- **remove-intune-reusable-setting** - Manage remove intune reusable setting

-

- - `cipp-cli remove-intune-reusable-setting` - Remove intune reusable setting

-

- **remove-intune-reusable-setting-template** - Manage remove intune reusable setting template

-

- - `cipp-cli remove-intune-reusable-setting-template` - Remove intune reusable setting template

-

- **remove-intune-script** - Manage remove intune script

-

- - `cipp-cli remove-intune-script` - Remove intune script

-

- **remove-intune-template** - Manage remove intune template

-

- - `cipp-cli remove-intune-template` - Remove intune template

-

- **remove-jitadmin-template** - Manage remove jitadmin template

-

- - `cipp-cli remove-jitadmin-template` - Remove jitadmin template

-

- **remove-policy** - Manage remove policy

-

- - `cipp-cli remove-policy` - Remove policy

-

- **remove-quarantine-policy** - Manage remove quarantine policy

-

- - `cipp-cli remove-quarantine-policy` - Remove quarantine policy

-

- **remove-queued-alert** - Manage remove queued alert

-

- - `cipp-cli remove-queued-alert` - Remove queued alert

-

- **remove-queued-app** - Manage remove queued app

-

- - `cipp-cli remove-queued-app` - Remove queued app

-

- **remove-safe-links-policy-template** - Manage remove safe links policy template

-

- - `cipp-cli remove-safe-links-policy-template` - Remove safe links policy template

-

- **remove-scheduled-item** - Manage remove scheduled item

-

- - `cipp-cli remove-scheduled-item` - Removes a scheduled item from CIPP's scheduler. #> [CmdletBinding()] param($Request, $TriggerMetadata)

-

- **remove-spamfilter** - Manage remove spamfilter

-

- - `cipp-cli remove-spamfilter` - Remove spamfilter

-

- **remove-spamfilter-template** - Manage remove spamfilter template

-

- - `cipp-cli remove-spamfilter-template` - Remove spamfilter template

-

- **remove-standard** - Manage remove standard

-

- - `cipp-cli remove-standard` - Remove standard

-

- **remove-standard-template** - Manage remove standard template

-

- - `cipp-cli remove-standard-template` - Remove standard template

-

- **remove-tenant-allow-block-list** - Manage remove tenant allow block list

-

- - `cipp-cli remove-tenant-allow-block-list` - Remove tenant allow block list

-

- **remove-tenant-capabilities-cache** - Manage remove tenant capabilities cache

-

- - `cipp-cli remove-tenant-capabilities-cache` - Remove tenant capabilities cache

-

- **remove-transport-rule** - Manage remove transport rule

-

- - `cipp-cli remove-transport-rule` - Remove transport rule

-

- **remove-transport-rule-template** - Manage remove transport rule template

-

- - `cipp-cli remove-transport-rule-template` - Remove transport rule template

-

- **remove-trusted-blocked-sender** - Manage remove trusted blocked sender

-

- - `cipp-cli remove-trusted-blocked-sender` - Remove trusted blocked sender

-

- **remove-user** - Manage remove user

-

- - `cipp-cli remove-user` - Remove user

-

- **remove-user-default-template** - Manage remove user default template

-

- - `cipp-cli remove-user-default-template` - Remove user default template

-

- **set-auth-method** - Manage set auth method

-

- - `cipp-cli set-auth-method` - Set auth method

-

-

- ### Finding the right command

-

- When you know what you want to do but not which command does it, ask the CLI directly:

-

- ```bash

- cipp-cli which "<capability in your own words>"

- ```

-

- `which` resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code `0` means at least one match; exit code `2` means no confident match - fall back to `--help` or use a narrower query.

-

- ## Recipes

-

- ### Fleet MFA posture for a QBR

-

- ```bash

- cipp-cli posture --dimension mfa --agent --select tenant,metrics

- ```

-

- Narrow the cross-tenant matrix to just MFA columns for a clean QBR export.

-

- ### Find dormant licensed accounts

-

- ```bash

- cipp-cli users stale --days 90 --all-tenants --json

- ```

-

- Surface licensed accounts fleet-wide with no sign-in in 90 days for cleanup and cost recovery.

-

- ### List users across all tenants

-

- ```bash

- cipp-cli fanout --endpoint /ListUsers --all-tenants --save --json

- ```

-

- Run one read command fleet-wide with throttle-aware backoff, narrowing the deeply-nested response to the fields that matter.

-

- ### What drifted since last week

-

- ```bash

- cipp-cli standards drift --agent

- ```

-

- Diff each tenant's security baseline against the prior synced snapshot.

-

- ## Auth Setup

-

- CIPP is self-hosted, so point the CLI at your own instance and authenticate with an API client created in CIPP > Integrations > CIPP-API. Run `cipp-cli auth login` with your Client ID, Client Secret, Tenant ID, and base URL (which must include /api); the CLI performs the OAuth2 client-credentials exchange against login.microsoftonline.com and caches the bearer token to expiry. A static bearer token (CIPP_API_KEY) is also accepted. If you get 401/403, check the API client's IP allowlist and that your base URL ends in /api.

-

- Run `cipp-cli doctor` to verify setup.

-

- ## Agent Mode

-

- Add `--agent` to any command. Expands to: `--json --compact --no-input --no-color --yes`.

-

- - **Pipeable** - JSON on stdout, errors on stderr

- - **Filterable** - `--select` keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs:

-

- ```bash

- cipp-cli best-practice-analyser-list --agent --select id,name,status

- ```

- - **Previewable** - `--dry-run` shows the request without sending

- - **Offline-friendly** - the analytics commands (`posture`, `licenses waste`, `users stale`, `standards drift`, `analytics`) read the local SQLite store populated by `fanout --save`

- - **Non-interactive** - never prompts, every input is a flag

- - **Explicit retries** - use `--idempotent` only when an already-existing create should count as success

-

- ### Response envelope

-

- Commands that read from the local store or the API wrap output in a provenance envelope:

-

- ```json

- {

- "meta": {"source": "live" | "local", "synced_at": "...", "reason": "..."},

- "results": <data>

- }

- ```

-

- Parse `.results` for data and `.meta.source` to know whether it's live or local. A human-readable `N results (live)` summary is printed to stderr only when stdout is a terminal AND no machine-format flag (`--json`, `--csv`, `--compact`, `--quiet`, `--plain`, `--select`) is set - piped/agent consumers and explicit-format runs get pure JSON on stdout.

-

- ## Agent Feedback

-

- When you (or the agent) notice something off about this CLI, record it:

-

- ```

- cipp-cli feedback "the --since flag is inclusive but docs say exclusive"

- cipp-cli feedback --stdin < notes.txt

- cipp-cli feedback list --json --limit 10

- ```

-

- Entries are stored locally at `~/.local/share/cipp-cli/feedback.jsonl`. They are never POSTed unless `CIPP_FEEDBACK_ENDPOINT` is set AND either `--send` is passed or `CIPP_FEEDBACK_AUTO_SEND=true`. Default behavior is local-only.

-

- Write what *surprised* you, not a bug report. Short, specific, one line: that is the part that compounds.

-

- ## Output Delivery

-

- Every command accepts `--deliver <sink>`. The output goes to the named sink in addition to (or instead of) stdout, so agents can route command results without hand-piping. Three sinks are supported:

-

- | Sink | Effect |

- |------|--------|

- | `stdout` | Default; write to stdout only |

- | `file:<path>` | Atomically write output to `<path>` (tmp + rename) |

- | `webhook:<url>` | POST the output body to the URL (`application/json` or `application/x-ndjson` when `--compact`) |

-

- Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr.

-

- ## Named Profiles

-

- A profile is a saved set of flag values, reused across invocations. Use it when a scheduled agent calls the same command every run with the same configuration - HeyGen's "Beacon" pattern.

-

- ```

- cipp-cli profile save briefing --json

- cipp-cli --profile briefing best-practice-analyser-list

- cipp-cli profile list --json

- cipp-cli profile show briefing

- cipp-cli profile delete briefing --yes

- ```

-

- Explicit flags always win over profile values; profile values win over defaults. `agent-context` lists all available profiles under `available_profiles` so introspecting agents discover them at runtime.

-

- ## Exit Codes

-

- | Code | Meaning |

- |------|---------|

- | 0 | Success |

- | 2 | Usage error (wrong arguments) |

- | 3 | Resource not found |

- | 4 | Authentication required |

- | 5 | API error (upstream issue) |

- | 7 | Rate limited (wait and retry) |

- | 10 | Config error |

-

- ## Argument Parsing

-

- Parse `$ARGUMENTS`:

-

- 1. **Empty, `help`, or `--help`** → show `cipp-cli --help` output

- 2. **Starts with `install`** → ends with `mcp` → MCP installation; otherwise → see Prerequisites above

- 3. **Anything else** → Direct Use (execute as CLI command with `--agent`)

-

- ## MCP Server Installation

-

- 1. Install the MCP server (the installer drops both `cipp-cli` and `cipp-mcp`):

- ```bash

- bash <(curl -fsSL https://raw.githubusercontent.com/servosity/msp-skills/main/skills/cipp/install.sh)

- ```

- 2. Register with Claude Code:

- ```bash

- claude mcp add cipp-mcp -- cipp-mcp

- ```

- 3. Verify: `claude mcp list`

-

- For Claude Desktop, ChatGPT, GitHub Copilot, and the remote path, see [mcp-install.md](./mcp-install.md).