CIPP Tools
cipp_ · 434 tools · Free 173 · Pro 247 · Business 14
CIPP hosted API; raw JSON passthrough.
Tenants
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_domain |
Pro | Write | [CIPP] Add a custom domain to a tenant via POST /api/AddDomain. CIPP body keys per spec: 'domain' (camelCase, the new domain to add) and 'tenantFilter' (camelCase, required). The domain will need DNS verification after adding. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_add_spn |
Pro | Write | [CIPP] Add CIPP service principal permissions to partner tenant. Required for CIPP API access. |
cipp_add_tenant |
Pro | Write | [CIPP] Add a new M365 tenant via POST /api/AddTenant. CIPP body keys are PascalCase: 'Action', 'AddressLine1', 'AddressLine2', 'City', 'CompanyName', 'Country', 'Email', 'FirstName', 'LastName', 'PhoneNumber', 'PostalCode', 'State', 'TenantName'. NOT scoped via tenantFilter — this creates a new tenant rather than acting on an existing one. 'Action' and 'TenantName' are also accepted as query parameters. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_domain_action |
Pro | Write | [CIPP] Delete a domain action / domain from a tenant via DELETE /api/ExecDomainAction. CIPP body keys per spec: 'Action' (PascalCase string — the operation verb), 'domain' (lowercase string — the domain to act on), 'tenantFilter' (camelCase string, required). The tool injects 'tenantFilter' from the typed parameter; pass 'Action' and 'domain' through fieldsJson. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_edit_tenant |
Pro | Write | [CIPP] Edit CIPP tenant configuration via POST /api/EditTenant. Body keys per spec: 'GroupId' (PascalCase), 'customerId' (camelCase), 'tenantAlias' (camelCase), 'tenantGroups' (camelCase). Note: this endpoint does NOT take 'tenantFilter' — the tenant is identified by 'customerId' instead. All body fields are string-typed per spec. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_edit_tenant_offboarding_defaults |
Pro | Write | [CIPP] Edit the default user-offboarding settings for a tenant via POST /api/EditTenantOffboardingDefaults. CIPP body keys are mixed: 'Alias' (PascalCase), 'Groups' (PascalCase, LabelValue object {label,value}), 'customerId' (camelCase), 'defaultDomainName' (camelCase), 'offboardingDefaults' (camelCase). Note: this endpoint does NOT take 'tenantFilter' — the tenant is identified by 'customerId' / 'defaultDomainName'. These defaults are applied by user-offboarding flows; this is NOT the tenant-offboard endpoint. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_get_organization |
Free | Read-only | [CIPP] Get organization profile information for a tenant including company name, address, technical contacts, and partner information. |
cipp_get_tenant_details |
Free | Read-only | [CIPP] Get detailed information for a specific M365 tenant including organization info, license counts, and domain details. |
cipp_list_app_consent_requests |
Free | Read-only | [CIPP] List pending application consent requests from users in the tenant awaiting admin approval. |
cipp_list_csp_licenses |
Free | Read-only | [CIPP] List CSP (Cloud Solution Provider) license subscriptions for a tenant including subscription name, quantity, and billing cycle. |
cipp_list_domains |
Free | Read-only | [CIPP] List all domains registered for a tenant including verification status, default domain flag, and DNS records. |
cipp_list_external_tenant_info |
Free | Read-only | [CIPP] Look up external tenant information by domain or tenant ID. Returns organization name, tenant ID, and federation status. |
cipp_list_licenses |
Free | Read-only | [CIPP] List all assigned licenses for a tenant including SKU name, total units, consumed units, and available units. |
cipp_list_oauth_apps |
Free | Read-only | [CIPP] List OAuth/enterprise applications registered in the tenant including app name, publisher, permissions granted, and consent status. |
cipp_list_service_health |
Free | Read-only | [CIPP] List current M365 service health status for a tenant. Returns service name, status, and any active incidents or advisories. |
cipp_list_tenant_alignment |
Free | Read-only | [CIPP] List tenant alignment status showing how tenant configuration compares to defined standards and best practices. |
cipp_list_tenant_onboarding |
Free | Read-only | [CIPP] List tenant onboarding status and progress via GET /api/ListTenantOnboarding. Spec marks the body required even on this GET endpoint — the request must carry a JSON object. Spec body keys (mixed casing): 'gdapRoles' (camelCase array), 'id' (lowercase, the onboarding job id), 'ignoreMissingRoles' (camelCase boolean), 'remapRoles' (camelCase boolean), 'standardsExcludeAllTenants' (camelCase boolean). Returns onboarding steps, completion state, and any pending actions. |
cipp_list_tenants |
Free | Read-only | [CIPP] List all M365 tenants managed by this CIPP instance via POST /api/ListTenants. Spec marks the body required even though no individual property is required — the request carries a JSON object. Spec body keys: 'ClearCache' (PascalCase boolean-as-string), 'TenantsOnly' (PascalCase boolean-as-string), 'integrationCompany' (camelCase string). Returns tenant display name, default domain, and customer ID. Use this first to discover available tenants and their domain filters. |
cipp_onboard_tenant |
Pro | Write | [CIPP] Onboard a new tenant to CIPP via POST /api/ExecOnboardTenant. CIPP body keys are mixed: 'Cancel' (PascalCase, string), 'Retry' (PascalCase, string), 'addMissingGroups' (camelCase, string), 'autoMapRoles' (camelCase, string), 'gdapRoles' (camelCase, LabelValue object {label,value}), 'id' (camelCase, LabelValue object {label,value} identifying the GDAP relationship/onboarding record), 'ignoreMissingRoles' (camelCase, boolean), 'remapRoles' (camelCase, string), 'standardsExcludeAllTenants' (camelCase, boolean). NOT scoped via tenantFilter — onboarding identifies the relationship via 'id'. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_remove_tenant_capabilities_cache |
Pro | Write | [CIPP] Clear the cached tenant capabilities data. Forces CIPP to re-evaluate tenant features and permissions on the next request. |
cipp_send_org_message |
Pro | Write | [CIPP] Send an organization-wide message via GET /api/ExecSendOrgMessage. Underlying client method takes no body — query parameters per spec are 'freq' (frequency), 'ID' (the message/template id), 'tenantFilter' (camelCase, required), 'type' (message type), 'URL' (target URL). The current client method overload accepts no parameters, so query parameters cannot be supplied through this tool — verify against runtime behavior. Use additionalFieldsJson when a body-capable overload is added. |
cipp_set_auth_method |
Pro | Write | [CIPP] Configure authentication method policies for a tenant via POST /api/SetAuthMethod. CIPP body keys are mixed: 'GroupIds' (PascalCase, string), 'Id' (PascalCase, the auth method policy ID, string), 'state' (lowercase, the enabled/disabled state, string), 'tenantFilter' (camelCase, required). Controls which Azure AD auth methods are available (FIDO2, Authenticator, SMS, etc.). Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_add_domain parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Domain configuration fields as JSON object. Required body key per spec: 'domain' (camelCase, the new custom domain to add). Example: {"domain":"newdomain.com"}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_add_tenant parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Tenant creation payload as JSON object. Body keys per spec (all PascalCase): 'Action' (operation verb — also forwardable as query parameter), 'TenantName' (the new tenant domain name — also forwardable as query parameter), 'CompanyName', 'AddressLine1', 'AddressLine2', 'City', 'State', 'PostalCode', 'Country', 'FirstName', 'LastName', 'Email', 'PhoneNumber'. Example: {"Action":"<verb>","TenantName":"contoso.onmicrosoft.com","CompanyName":"Contoso Ltd","FirstName":"...","LastName":"...","Email":"..."}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_delete_domain_action parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'Action' (PascalCase string — the action verb), 'domain' (lowercase string — the domain name to act on). Example: {"Action":"<verb>","domain":"contoso.com"}. The tool also injects 'tenantFilter' from the typed parameter. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_edit_tenant parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Tenant configuration as JSON object. Body keys per spec: 'GroupId' (PascalCase, the CIPP tenant group ID), 'customerId' (camelCase, the M365 customer/tenant ID identifying which tenant to edit), 'tenantAlias' (camelCase, display alias for the tenant in CIPP), 'tenantGroups' (camelCase, comma-separated group memberships). Example: {"customerId":"<tenant-guid>","tenantAlias":"Contoso Updated","GroupId":"...","tenantGroups":"..."}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_edit_tenant_offboarding_defaults parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Offboarding defaults as JSON object. Body keys per spec: 'Alias' (PascalCase, tenant alias string), 'Groups' (PascalCase, LabelValue object {label,value} identifying default groups), 'customerId' (camelCase, the M365 customer/tenant ID), 'defaultDomainName' (camelCase, the tenant's primary domain), 'offboardingDefaults' (camelCase, serialized JSON or string blob describing the defaults). Example: {"customerId":"<tenant-guid>","defaultDomainName":"contoso.onmicrosoft.com","Alias":"Contoso","Groups":{"label":"...","value":"..."},"offboardingDefaults":"..."}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_get_organization parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_get_tenant_details parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_app_consent_requests parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_csp_licenses parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_domains parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_licenses parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_oauth_apps parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_service_health parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_tenant_alignment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_tenant_onboarding parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'gdapRoles' (camelCase array), 'ignoreMissingRoles' (camelCase boolean), 'remapRoles' (camelCase boolean), 'standardsExcludeAllTenants' (camelCase boolean). |
id |
string | no | null | Optional onboarding job ID to filter by. Sent as body key 'id' (lowercase). |
cipp_list_tenants parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
clearCache |
string | no | null | When 'true', forces CIPP to bypass its tenant cache and re-query the partner relationship. Sent as body key 'ClearCache' (PascalCase, string-typed boolean per spec). |
integrationCompany |
string | no | null | Optional integration company filter. Sent as body key 'integrationCompany' (camelCase). |
tenantsOnly |
string | no | null | When 'true', returns only tenant identity records without related metadata. Sent as body key 'TenantsOnly' (PascalCase, string-typed boolean per spec). |
cipp_onboard_tenant parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Onboarding configuration as JSON object. Body keys per spec: 'Cancel' (PascalCase, string flag to cancel an in-progress onboard), 'Retry' (PascalCase, string flag to retry a failed onboard), 'addMissingGroups' (camelCase, string), 'autoMapRoles' (camelCase, string), 'gdapRoles' (camelCase, LabelValue object {label,value} identifying GDAP roles to assign), 'id' (camelCase, LabelValue object {label,value} identifying the onboarding/GDAP relationship), 'ignoreMissingRoles' (camelCase, boolean), 'remapRoles' (camelCase, string), 'standardsExcludeAllTenants' (camelCase, boolean — when true, excludes the tenant from all-tenant standards deployments). Example: {"id":{"label":"...","value":"<onboarding-id>"},"gdapRoles":{"label":"...","value":"..."},"standardsExcludeAllTenants":false,"ignoreMissingRoles":false}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_set_auth_method parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Auth method configuration as JSON object. Body keys per spec: 'GroupIds' (PascalCase, string of group IDs the policy applies to), 'Id' (PascalCase, the authentication method policy identifier), 'state' (lowercase 's', the policy state — values follow Microsoft Graph 'enabled'/'disabled'). Example: {"Id":"microsoftAuthenticator","state":"enabled","GroupIds":"..."}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
Users
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_bec_check |
Free | Read-only | [CIPP] Run a Business Email Compromise (BEC) check on a specific user. Analyzes recent sign-ins, inbox rules, and mail forwarding for indicators of compromise. |
cipp_get_user_ca_policies |
Free | Read-only | [CIPP] Get conditional access policies that apply to a specific user including policy name, state, conditions, and grant controls. |
cipp_get_user_devices |
Free | Read-only | [CIPP] Get devices registered or owned by a specific user including device name, OS, compliance status, and last sync time. |
cipp_get_user_groups |
Free | Read-only | [CIPP] Get all group memberships for a specific user including security groups, distribution lists, and M365 groups. |
cipp_get_user_mailbox |
Free | Read-only | [CIPP] Get mailbox details for a specific user including mailbox type, size, forwarding rules, and archive status. |
cipp_get_user_mfa |
Free | Read-only | [CIPP] Get per-user MFA status and configuration for a specific user including MFA state, default method, and registered methods. |
cipp_get_user_photo |
Free | Read-only | [CIPP] Get the profile photo for a specific user. Returns the photo data as a base64-encoded string. |
cipp_get_user_signin_logs |
Free | Read-only | [CIPP] Get recent sign-in log entries for a specific user including timestamp, IP address, location, app, and status. |
cipp_list_basic_auth_users |
Free | Read-only | [CIPP] List users who have basic authentication (legacy auth) enabled. These accounts are security risks and should be migrated to modern auth. |
cipp_list_deleted_users |
Free | Read-only | [CIPP] List soft-deleted users in the tenant recycle bin. These users can be restored within 30 days using cipp_restore_deleted_user. |
cipp_list_inactive_accounts |
Free | Read-only | [CIPP] List user accounts that have not signed in recently. Returns last sign-in date and account details for identifying stale accounts. |
cipp_list_mfa_users |
Free | Read-only | [CIPP] List all users with their MFA registration status and methods. Useful for identifying users without MFA configured. |
cipp_list_user_counts |
Free | Read-only | [CIPP] Get user count statistics for a tenant including total users, licensed users, guests, and disabled accounts. |
cipp_list_users |
Free | Read-only | [CIPP] List all users in a tenant including display name, UPN, license status, and account enabled state. Use this to discover user IDs for other user tools. |
cipp_bec_check parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_ca_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_devices parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_groups parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_mfa parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_photo parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_get_user_signin_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. |
cipp_list_basic_auth_users parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_deleted_users parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_inactive_accounts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_mfa_users parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_user_counts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_users parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
User Management
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_guest |
Pro | Write | [CIPP] Invite an external guest user to the tenant via POST /api/AddGuest. The guest's email is sent as the spec key `mail` (NOT `email`). Optional flags: sendInvite triggers the Microsoft invite email; redirectUri overrides the default post-acceptance landing page; message is included in the invite. |
cipp_add_jit_admin_template |
Pro | Write | [CIPP] Save a new Just-In-Time (JIT) admin template via POST /api/AddJITAdminTemplate. JIT templates pre-populate the cipp_jit_admin form (default user, roles, duration, expire action, etc.) so operators can elevate access with a single click. Body keys per spec: 'tenantFilter' (required), 'templateName' (string), 'defaultUserAction' (string enum: 'create' | 'select'), 'defaultFirstName' / 'defaultLastName' / 'defaultUserName' (strings), 'defaultDomain' / 'defaultDuration' / 'defaultExistingUser' / 'defaultExpireAction' / 'defaultRoles' (LabelValue {label,value} objects), 'defaultForTenant' (boolean), 'defaultNotificationActions' (string array, e.g., ['webhook','email','psa']), 'generateTAPByDefault' (boolean), 'reasonTemplate' (string). Use additionalFieldsJson to populate the LabelValue and array fields verbatim. |
cipp_add_user |
Pro | Write | [CIPP] Create a new user in the tenant via POST /api/AddUser. CIPP composes the UPN from `username` + `PrimDomain.value` (LabelValue object). The displayName parameter maps to the spec key `DisplayName` (PascalCase). When userPrincipalName is provided as a full address (e.g., john.smith@contoso.com), the tool splits on '@' to populate `username` and `PrimDomain` automatically. Use additionalFieldsJson for license assignment, copyFrom (LabelValue), userTemplate (LabelValue), Scheduled, jobTitle, department, etc. |
cipp_add_user_bulk |
Pro | Write | [CIPP] Create multiple users in a tenant in bulk via POST /api/AddUserBulk. Body keys per spec: 'tenantFilter' (required), 'BulkUser' (PascalCase, array of strings — typically CSV-style rows with the per-user attribute payload), 'licenses' (lowercase array of SKU IDs to assign to all created users), 'usageLocation' (LabelValue {label,value} country code applied to all users), 'label' (string) and 'value' (string) — top-level scalars consumed by CIPP's array-input handling. |
cipp_add_user_defaults |
Pro | Write | [CIPP] Save a new-user-creation defaults template for a tenant via POST /api/AddUserDefaults. Templates pre-populate licenses, groups, and profile settings for new users created through CIPP. Body keys per spec mix camelCase, PascalCase, and LabelValue objects: 'tenantFilter' (required), 'templateName' (camelCase), 'GUID' (PascalCase, optional template ID for updates), 'usernameFormat' (camelCase string template like '.'), 'defaultForTenant' (string), 'MustChangePass' (PascalCase boolean), 'removeLicenses' (camelCase boolean), 'licenses' (array of SKU IDs), 'displayName', 'givenName', 'surname', 'jobTitle', 'department', 'companyName', 'streetAddress', 'city', 'state', 'postalCode', 'country', 'mobilePhone', 'password', 'addedAliases', 'otherMails' (array). LabelValue objects: 'primDomain' {label,value}, 'usageLocation' {label,value}, 'copyFrom' {label,value}, 'setManager' {label,value}, 'setSponsor' {label,value}. |
cipp_bec_remediate |
Pro | Write | [CIPP] Execute Business Email Compromise remediation actions on a user via POST /api/ExecBECRemediate. The user's object ID maps to the spec key `userid` (lowercase) and the optional UPN maps to `username` (lowercase). Run cipp_bec_check first to assess the situation. Note: the spec body contains only userid/username/tenantFilter; specific remediation actions (reset password, revoke sessions, etc.) are configured via separate CIPP endpoints. |
cipp_bulk_license |
Pro | Write | [CIPP] Assign or remove licenses in bulk across multiple users. Provide the license configuration in fieldsJson. |
cipp_clear_immutable_id |
Pro | Write | [CIPP] Clear the on-premises immutable ID (sourceAnchor) for a user via POST /api/ExecClrImmId. Required when migrating from AD sync to cloud-only or when fixing sync conflicts. Body keys per spec: 'tenantFilter' (required) and 'ID' (UPPERCASE per spec, the user's object ID). The same 'ID' and 'tenantFilter' values also appear as query arguments per the spec. |
cipp_create_tap |
Pro | Write | [CIPP] Create a Temporary Access Pass (TAP) for a user via POST /api/ExecCreateTAP. TAPs allow passwordless onboarding or MFA recovery with a time-limited code. The user's object ID maps to the spec key `ID` (uppercase) and the validity duration maps to `lifetimeInMinutes` (NOT `lifetimeMinutes`). All values are string-typed per spec. |
cipp_device_delete_identity |
Pro | Write | [CIPP] Delete a device registration from Azure AD / Entra ID for a user. This removes the device from the identity directory. |
cipp_disable_user |
Pro | Write | [CIPP] Enable or disable a user account via POST /api/ExecDisableUser. The spec uses `Enable` (PascalCase, string-typed) to indicate the desired state — true enables, false disables. The user's object ID maps to the spec key `ID` (uppercase). Disabled users cannot sign in but their data is preserved. |
cipp_dismiss_risky_user |
Pro | Write | [CIPP] Dismiss a user's risk state in Azure AD Identity Protection via POST /api/ExecDismissRiskyUser. Use after investigating and confirming the user is not compromised. Body keys per spec: 'tenantFilter' (required), 'userId' (camelCase), 'userDisplayName' (camelCase, optional, used for audit/notification). |
cipp_edit_jit_admin_template |
Pro | Write | [CIPP] Update an existing Just-In-Time (JIT) admin template via POST /api/EditJITAdminTemplate. Body keys per spec are identical to AddJITAdminTemplate plus 'GUID' (PascalCase, the template ID — required to identify which template to update). Use cipp_list_jit_admin_templates to find the GUID. Body keys: 'tenantFilter' (required), 'GUID' (PascalCase, required for edit), 'templateName' (string), 'defaultUserAction' (string enum: 'create' | 'select'), 'defaultFirstName' / 'defaultLastName' / 'defaultUserName' (strings), 'defaultDomain' / 'defaultDuration' / 'defaultExistingUser' / 'defaultExpireAction' / 'defaultRoles' (LabelValue {label,value} objects), 'defaultForTenant' (boolean), 'defaultNotificationActions' (string array), 'generateTAPByDefault' (boolean), 'reasonTemplate' (string). Use additionalFieldsJson to populate the LabelValue and array fields verbatim. |
cipp_edit_user |
Pro | Write | [CIPP] Edit properties of an existing user via PATCH /api/EditUser. The user's object ID maps to the spec key `id` (lowercase) — pass the user's GUID/objectId or UPN. Spec key casing is mixed and intentional: top-level booleans like `Autopassword`, `MustChangePass`, `removeLicenses`, `sherweb` use varied casing per CIPP's contract. The `Scheduled` block uses PascalCase but its inner `enabled` is lowercase. Use additionalFieldsJson for fields like DisplayName, jobTitle, department, mobilePhone, licenses, AddToGroups (array), RemoveFromGroups (array), primDomain (LabelValue), usageLocation (LabelValue), setManager (LabelValue), setSponsor (LabelValue), userPrincipalName, etc. |
cipp_edit_user_aliases |
Pro | Write | [CIPP] Add or remove email aliases (proxy addresses) for a user account via POST /api/EditUserAliases. Body keys per spec: 'tenantFilter' (required), 'id' (lowercase, the user's object ID or UPN), 'AddedAliases' (PascalCase, newline-separated string of aliases to add), 'RemovedAliases' (PascalCase, newline-separated string of aliases to remove), 'MakePrimary' (PascalCase, alias address to promote to primary SMTP). |
cipp_jit_admin |
Pro | Write | [CIPP] Enable or configure Just-In-Time (JIT) admin access for a user via POST /api/ExecJITAdmin. Grants temporary elevated privileges that expire after a set duration. The body uses 'tenantFilter' (required) plus a mix of PascalCase and camelCase keys; 'userAction' is an enum: 'create' | 'select'. Use fieldsJson to populate the body. |
cipp_license_search |
Free | Write | [CIPP] Look up Microsoft license SKU details by SKU IDs via POST /api/ExecLicenseSearch. Returns SKU display names, included service plans, and pricing metadata for each SKU ID supplied. NOTE: this endpoint is NOT tenant-scoped — it queries the global Microsoft license catalog, so no tenantFilter is sent. Body keys per spec: 'skuIds' (string — typically a comma-separated list of SKU GUIDs). |
cipp_list_jit_admin |
Free | Read-only | [CIPP] List currently active Just-In-Time admin sessions. Returns user, role, expiration, and status. |
cipp_list_jit_admin_templates |
Free | Read-only | [CIPP] List available Just-In-Time admin templates. Returns template names, roles, and default durations. |
cipp_list_new_user_defaults |
Free | Read-only | [CIPP] List saved new user creation default templates. Returns template names, assigned licenses, groups, and profile settings. |
cipp_list_user_settings |
Free | Read-only | [CIPP] List CIPP user settings configuration including default behaviors for user management operations. |
cipp_list_user_trusted_blocked_senders |
Free | Read-only | [CIPP] List trusted and blocked senders configured per user. Returns sender addresses and list type (trusted or blocked). |
cipp_offboard_user |
Pro | Write | [CIPP] Run a multi-step user offboarding workflow against POST /api/ExecOffboardUser. Each action (license removal, mailbox conversion, access delegation, forwarding, session revocation, deletion, etc.) is a separate flag — set only the actions you want performed. This tool is destructive: it can permanently strip licenses, disable sign-in, convert the mailbox to shared, and delete the user. Confirm the UPN with cipp_list_users and inspect the user with cipp_get_user_mailbox_details before running. Runtime note: CIPP's live backend expects `user` as LabelValue objects ({label,value}) even though OpenAPI says string array; this tool sends the backend-compatible shape. When scheduledRunAt is set, CIPP queues the offboard rather than running immediately and the response is a queue acknowledgement, NOT per-action success — re-check the user later. The response is CIPP's raw {"Results":[...]} envelope: a mix of success and error strings with HTTP 200 even on per-action failure. The tool scans for known failure markers and surfaces them, but operators should still read the full Results text. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_offboarding_job_status |
Free | Read-only | [CIPP] Get the status of queued CIPP offboarding jobs via GET /api/CIPPOffboardingJob. When cipp_offboard_user is called with a scheduledRunAt, the response is only a queue acknowledgement; use this tool to check the actual per-action results once the job runs. Per spec, this endpoint takes no query/body parameters — it returns the current state of all known offboarding jobs. |
cipp_onedrive_provision |
Pro | Write | [CIPP] Provision a OneDrive for Business site for a user. Required before the user can access OneDrive. |
cipp_onedrive_shortcut |
Pro | Write | [CIPP] Create a OneDrive shortcut for a user to a SharePoint document library or folder. |
cipp_password_never_expires |
Pro | Write | [CIPP] Set or unset the password-never-expires flag for a user account via POST /api/ExecPasswordNeverExpires. Body keys per spec (all camelCase): 'tenantFilter' (required), 'userId', 'userPrincipalName', 'PasswordPolicy' (PascalCase, controls the policy applied — typically 'DisablePasswordExpiration' or empty/null to re-enable expiration). Use fieldsJson to populate the body. |
cipp_patch_user |
Pro | Write | [CIPP] Apply partial updates to a user record via PATCH /api/PatchUser. Per the live spec the body schema is empty — CIPP accepts arbitrary key/value pairs and forwards them to Microsoft Graph as a user PATCH. Pass the fields to update via fieldsJson; common keys include 'id' or 'userPrincipalName' to identify the user, plus any user property the Graph PATCH /users/ endpoint accepts (jobTitle, department, displayName, mailNickname, etc.). Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_per_user_mfa |
Pro | Write | [CIPP] Enable, disable, or enforce per-user (legacy) MFA for a specific user via POST /api/ExecPerUserMFA. Note: Conditional Access policies are the preferred MFA approach in modern tenants. Body keys per spec: 'tenantFilter' (required), 'userId' (camelCase), 'userPrincipalName' (camelCase, optional), 'State' (PascalCase string, typical values: 'Enabled' | 'Disabled' | 'Enforced'). |
cipp_remove_deleted_object |
Pro | Write | [CIPP] Permanently remove a soft-deleted object from the tenant recycle bin. This action is irreversible. WARNING: This permanently purges a deleted object. It cannot be recovered after this action. |
cipp_remove_jit_admin_template |
Pro | Write | [CIPP] Delete a Just-In-Time (JIT) admin template via POST /api/RemoveJITAdminTemplate. Body keys per spec: 'ID' (PascalCase, the template ID — required). NOTE: this endpoint does NOT take a tenantFilter (templates are partner-scope, not tenant-scope). Use cipp_list_jit_admin_templates to find the template ID before removing. |
cipp_remove_trusted_blocked_sender |
Pro | Write | [CIPP] Remove an entry from a user's trusted or blocked senders list. |
cipp_remove_user |
Pro | Write | [CIPP] Delete a user from the tenant via POST /api/RemoveUser. The user is soft-deleted and recoverable for 30 days through cipp_restore_deleted_user. WARNING: this permanently deletes the user account. Use cipp_disable_user for temporary suspension instead. Body keys per spec: 'tenantFilter' (required), 'ID' (UPPERCASE, the user's object ID), 'userPrincipalName' (camelCase, optional UPN used for audit/notification). The same 'ID', 'tenantFilter', and 'userPrincipalName' values can also appear as query arguments per the spec. |
cipp_remove_user_default_template |
Pro | Write | [CIPP] Remove a saved new user defaults template. Use cipp_list_new_user_defaults to find the template ID. |
cipp_reprocess_user_licenses |
Pro | Write | [CIPP] Reprocess license assignments for a user to fix license provisioning errors or stale service plan states. |
cipp_reset_mfa |
Pro | Write | [CIPP] Reset MFA registration for a user via POST /api/ExecResetMFA, requiring them to re-register their authentication methods on next sign-in. The user's object ID maps to the spec key `ID` (uppercase). |
cipp_reset_password |
Pro | Write | [CIPP] Reset a user's password via POST /api/ExecResetPass. CIPP generates a new random password server-side; the spec does not accept a caller-supplied password. The user's object ID maps to the spec key `ID` (uppercase). The mustChange flag (sent as `MustChange` PascalCase, string-typed per spec) controls whether the user must change the password on next sign-in. |
cipp_restore_deleted_user |
Pro | Write | [CIPP] Restore a soft-deleted user from the tenant recycle bin via POST /api/ExecRestoreDeleted. Users can be restored within 30 days of deletion. The user's object ID maps to the spec key `ID` (uppercase). Use cipp_list_deleted_users to find restorable users. |
cipp_revoke_sessions |
Pro | Write | [CIPP] Revoke all active sessions and refresh tokens for a user via POST /api/ExecRevokeSessions, forcing re-authentication on all devices. The spec uses `id` (lowercase) for the user object ID and `Username` (PascalCase) for the optional UPN. Pass userId for the GUID and optionally username for the UPN. |
cipp_send_push |
Pro | Write | [CIPP] Send a test push notification to a user's registered Microsoft Authenticator MFA device via POST /api/ExecSendPush. Body keys per spec (PascalCase): 'TenantFilter' (required, PascalCase!) and 'UserEmail' (PascalCase, the UPN of the target user). NOTE: this endpoint's body uses PascalCase 'TenantFilter' while the query argument added by the client is camelCase 'tenantFilter' — the tool merges fieldsJson so the caller can override with the correct key. |
cipp_set_cloud_managed |
Pro | Write | [CIPP] Convert a synced (hybrid) user to cloud-managed by removing the on-premises sync anchor. |
cipp_set_user_photo |
Pro | Write | [CIPP] Set, update, or remove the profile photo for a user via POST /api/ExecSetUserPhoto. Body keys per spec (all camelCase): 'tenantFilter' (required), 'userId' (the user's object ID or UPN), 'action' (typical values: 'upload' | 'delete'), 'photoData' (base64-encoded image bytes when action='upload'). The same 'action', 'userId', and 'tenantFilter' values can also appear as query arguments per the spec. |
cipp_add_guest parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | yes | Display name for the guest user. | |
mail |
string | yes | Email address of the guest to invite. Sent as the spec key 'mail'. | |
message |
string | no | null | Optional custom message included in the invitation email. |
redirectUri |
string | no | null | Optional URL the guest is redirected to after accepting the invite. |
sendInvite |
boolean | no | null | If true, send the Microsoft guest invitation email. Defaults to CIPP's tenant policy when omitted. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_add_jit_admin_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged LAST into the request body, overriding the typed parameters above. Use for the LabelValue object fields ('defaultDomain', 'defaultDuration', 'defaultExistingUser', 'defaultExpireAction', 'defaultRoles' — each {label,value}) and 'defaultNotificationActions' (string array). Keys are passed verbatim — caller is responsible for exact spec casing. |
defaultFirstName |
string | no | null | Default first name when defaultUserAction='create'. Sent as the spec key 'defaultFirstName'. |
defaultForTenant |
boolean | no | null | Default for tenant flag — when true, this template applies to the tenant by default. Sent as the spec key 'defaultForTenant' (boolean). |
defaultLastName |
string | no | null | Default last name when defaultUserAction='create'. Sent as the spec key 'defaultLastName'. |
defaultUserAction |
string | no | null | Pre-fill the JIT user-creation flow. Sent as the spec key 'defaultUserAction' (enum: 'create' | 'select'). 'create' provisions a new admin user; 'select' picks an existing user. |
defaultUserName |
string | no | null | Default username (mailNickname) when defaultUserAction='create'. Sent as the spec key 'defaultUserName'. |
generateTapByDefault |
boolean | no | null | If true, the template will issue a Temporary Access Pass (TAP) by default when elevating. Sent as the spec key 'generateTAPByDefault' (boolean). |
reasonTemplate |
string | no | null | Default reason text written into the audit log when the template is applied. Sent as the spec key 'reasonTemplate' (string). |
templateName |
string | yes | Display name for the saved JIT admin template. Sent as the spec key 'templateName' (camelCase). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter' (required by spec). |
cipp_add_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
displayName |
string | yes | Full display name for the new user (e.g., 'John Smith'). Sent as the spec key 'DisplayName' (PascalCase). | |
fieldsJson |
string | no | null | Additional fields as JSON object merged LAST into the request body (overrides the typed parameters above). Use this for fields like jobTitle, department, usageLocation (LabelValue), licenses, copyFrom (LabelValue), userTemplate (LabelValue), Scheduled, MustChangePass, password, mobilePhone, businessPhones, companyName, country, state, city, postalCode, streetAddress, givenName, surname, reference. Keys are passed verbatim — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userPrincipalName |
string | yes | User principal name / sign-in address (e.g., john.smith@contoso.com). The tool splits on '@' to populate the spec keys `username` (mailNickname) and `PrimDomain` (LabelValue {value: <domain>}). |
cipp_add_user_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Bulk user creation data as JSON object merged LAST into the request body. Spec body keys (exact casing): 'BulkUser' (PascalCase array of strings, the per-user records as understood by CIPP's bulk parser); 'licenses' (lowercase array of license SKU IDs to apply to every user created); 'usageLocation' (LabelValue object {label,value} for the country code); top-level 'label' and 'value' scalars consumed by CIPP's array-input handling. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_add_user_defaults parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | User defaults template as JSON object merged LAST into the request body. Spec body keys (exact casing): 'templateName' (camelCase string), 'GUID' (PascalCase template ID for updates), 'usernameFormat' (camelCase username format string), 'defaultForTenant' (string), 'MustChangePass' (PascalCase boolean), 'removeLicenses' (camelCase boolean), 'licenses' (array of SKU IDs), profile fields (camelCase: 'displayName', 'givenName', 'surname', 'jobTitle', 'department', 'companyName', 'streetAddress', 'city', 'state', 'postalCode', 'country', 'mobilePhone', 'password', 'addedAliases', 'otherMails' as array). LabelValue objects (each {label,value}): 'primDomain', 'usageLocation', 'copyFrom', 'setManager', 'setSponsor'. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_bec_remediate parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) of the compromised user. Sent as the spec key 'userid' (lowercase). Use cipp_list_users to find valid IDs. | |
username |
string | no | null | Optional UPN of the compromised user (e.g., user@contoso.com). Sent as the spec key 'username' (lowercase). CIPP uses it for audit/notification purposes. |
cipp_clear_immutable_id parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'ID' (UPPERCASE, the user's object ID — required for the operation to target a specific user). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
cipp_create_tap parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
isUsableOnce |
boolean | no | null | If true, the TAP can only be used once. Sent as the spec key 'isUsableOnce' (string-typed per spec). |
lifetimeInMinutes |
integer | no | null | TAP validity duration in minutes. Sent as the spec key 'lifetimeInMinutes' (string-typed per spec). If omitted, uses the tenant default. |
startDateTime |
string | no | null | Optional ISO 8601 start datetime when the TAP becomes valid. Sent as the spec key 'startDateTime'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) or UPN of the user. Sent as the spec key 'ID' (uppercase). Use cipp_list_users to find valid IDs. |
cipp_device_delete_identity parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object (e.g., {"deviceId": "..."}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_disable_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
disable |
boolean | no | true | True to disable the account, false to re-enable it. Defaults to true. Sent as the spec key 'Enable' (string-typed) with the inverse value: disable=true => Enable='false', disable=false => Enable='true'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) or UPN of the user. Sent as the spec key 'ID' (uppercase). Use cipp_list_users to find valid IDs. |
cipp_dismiss_risky_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
userId |
string | yes | User ID or UPN of the risky user to dismiss (e.g., user@contoso.com). Use cipp_list_users to find valid IDs. Sent as body key 'userId' (camelCase). |
cipp_edit_jit_admin_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged LAST into the request body, overriding the typed parameters above. Use for the LabelValue object fields ('defaultDomain', 'defaultDuration', 'defaultExistingUser', 'defaultExpireAction', 'defaultRoles' — each {label,value}) and 'defaultNotificationActions' (string array). Keys are passed verbatim — caller is responsible for exact spec casing. |
defaultFirstName |
string | no | null | Default first name when defaultUserAction='create'. Sent as the spec key 'defaultFirstName'. |
defaultForTenant |
boolean | no | null | Default for tenant flag — when true, this template applies to the tenant by default. Sent as the spec key 'defaultForTenant' (boolean). |
defaultLastName |
string | no | null | Default last name when defaultUserAction='create'. Sent as the spec key 'defaultLastName'. |
defaultUserAction |
string | no | null | Pre-fill the JIT user-creation flow. Sent as the spec key 'defaultUserAction' (enum: 'create' | 'select'). 'create' provisions a new admin user; 'select' picks an existing user. |
defaultUserName |
string | no | null | Default username (mailNickname) when defaultUserAction='create'. Sent as the spec key 'defaultUserName'. |
generateTapByDefault |
boolean | no | null | If true, the template will issue a Temporary Access Pass (TAP) by default when elevating. Sent as the spec key 'generateTAPByDefault' (boolean). |
guid |
string | yes | GUID of the JIT admin template to update. Sent as the spec key 'GUID' (PascalCase). Use cipp_list_jit_admin_templates to find available template IDs. | |
reasonTemplate |
string | no | null | Default reason text written into the audit log when the template is applied. Sent as the spec key 'reasonTemplate' (string). |
templateName |
string | yes | Display name for the saved JIT admin template. Sent as the spec key 'templateName' (camelCase). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter' (required by spec). |
cipp_edit_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Fields to update as JSON object merged LAST into the request body. Keys are passed verbatim — caller is responsible for exact spec casing (e.g., DisplayName, jobTitle, department, AddToGroups, RemoveFromGroups, licenses, primDomain {label,value}, usageLocation {label,value}, setManager {label,value}, Scheduled {Enabled,date}, postExecution {webhook,email,psa}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) or UPN of the user to edit. Sent as the spec key 'id' (lowercase). Use cipp_list_users to find valid IDs. |
cipp_edit_user_aliases parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Alias configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'id' (lowercase, user object ID or UPN); 'AddedAliases' (PascalCase string, newline-separated aliases to add — e.g., 'a@contoso.com\nb@contoso.com'); 'RemovedAliases' (PascalCase string, newline-separated aliases to remove); 'MakePrimary' (PascalCase string, alias to promote to primary SMTP). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_jit_admin parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | JIT admin configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'userAction' (enum: 'create' | 'select') controls whether to create a new user or select an existing one; 'existingUser' (LabelValue {label,value}) when userAction='select'; 'FirstName', 'LastName', 'Username', 'Domain' (LabelValue) when userAction='create'; 'AdminRoles' (LabelValue array/object), 'GroupMemberships' (string), 'useGroups' (boolean), 'useRoles' (boolean) — pick role-based or group-based elevation; 'StartDate' / 'EndDate' (ISO 8601 date-time); 'ExpireAction' (LabelValue) determines what happens at end-of-elevation; 'UseTAP' (boolean) issues a TAP for the elevation; 'Reason' (string) for audit; 'PostExecution' is an array of channel strings (e.g., ['webhook','email','psa']); 'jitAdminTemplate' (LabelValue) to apply a saved template. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_license_search parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
skuIds |
string | yes | Microsoft license SKU IDs to look up. Sent as the spec key 'skuIds' (string). Typically a comma-separated list of SKU GUIDs (e.g., '6fd2c87f-b296-42f0-b197-1e91e994b900,18181a46-0d4e-45cd-891e-60aabd171b4e'). |
cipp_list_jit_admin_templates parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Filter configuration as JSON object (e.g., {"tenantFilter": "contoso.onmicrosoft.com"}). |
cipp_list_new_user_defaults parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter configuration as JSON object (e.g., {"tenantFilter": "contoso.onmicrosoft.com"}). |
cipp_offboard_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
accessAutomapUpn |
string | no | null | UPN to grant FullAccess to this user's mailbox WITH automap (mailbox auto-mounts in their Outlook profile on next start). Use for permanent successors. Sent as the LabelValue object {"label":<upn>,"value":<upn>}. |
accessNoAutomapUpn |
string | no | null | UPN to grant FullAccess to this user's mailbox WITHOUT automap (mailbox does NOT auto-mount in their Outlook). Common for short-term coverage. Sent as the LabelValue object {"label":<upn>,"value":<upn>}. |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
clearImmutableId |
boolean | no | null | Clear the on-premises immutableId / sourceAnchor so the cloud account becomes cloud-managed. Use when severing AD Connect for this user. |
convertToShared |
boolean | no | null | Convert the mailbox to a shared mailbox so the data remains accessible without consuming an Exchange license. Mutually exclusive with deleteUser semantically — if both are set, CIPP will convert then delete. |
deleteUser |
boolean | no | null | Permanently delete the user account (soft-delete: recoverable for 30 days via cipp_restore_deleted_user). Last step of a typical termination flow; pair with convertToShared first if the mailbox should survive. |
disableForwarding |
boolean | no | null | Disable any existing forwarding rule on the mailbox. Use this OR forward — not both. |
disableSignIn |
boolean | no | null | Block the user from signing in by setting AccountEnabled = false. The user retains their data and licenses but cannot authenticate. |
forward |
string | no | null | Email address to set as a forwarding target on the leaver's mailbox so future incoming mail flows to a successor. Pair with keepCopyOfForward to also retain a copy in the original mailbox. |
hideFromGal |
boolean | no | null | Hide the user from the Global Address List so they no longer appear in Outlook address picks. Reversible. |
keepCopyOfForward |
boolean | no | null | When forward is set, also keep a copy of forwarded mail in the leaver's mailbox (sets DeliverToMailboxAndForward). Without this, mail is forwarded only and the original mailbox sees nothing. |
oneDriveAccessUpn |
string | no | null | UPN to grant access to this user's OneDrive root so the recipient can copy/move files before the OneDrive is purged. Sent as the LabelValue object {"label":<upn>,"value":<upn>}. |
outOfOfficeMessage |
string | no | null | Out-of-office auto-reply text to set on the mailbox (typically a bounce/contact message for senders). |
postExecutionEmail |
boolean | no | null | After completion, send the CIPP-configured notification email. One channel of the PostExecution notification block. |
postExecutionPsa |
boolean | no | null | After completion, post a ticket/note via the configured PSA integration. One channel of the PostExecution notification block. |
postExecutionWebhook |
boolean | no | null | After completion, fire the configured CIPP webhook(s). One channel of the PostExecution notification block. |
reference |
string | no | null | Free-form reference string written into the audit log alongside the offboard (e.g., a ticket number or change-request ID). Visible in CIPP history. |
removeCalendarInvites |
boolean | no | null | Cancel/decline calendar meetings the user organized so attendees see the meetings drop off their calendars. Irreversible for already-sent invites. |
removeCalendarPermissions |
boolean | no | null | Remove all calendar folder permissions other users held on this user's calendar. |
removeGroups |
boolean | no | null | Remove the user from every group (security, distribution, M365). Recommended when offboarding so the user loses all delegated access. |
removeLicenses |
boolean | no | null | Unassign every Microsoft 365 / Office 365 license from the user. Frees up SKUs but stops mailbox/SharePoint access — pair with convertToShared if data must remain reachable. |
removeMailboxPermissions |
boolean | no | null | Remove all mailbox FullAccess/SendAs/SendOnBehalf permissions other users had on this mailbox. Required hygiene step when the user leaves. |
removeMfaDevices |
boolean | no | null | Delete every registered MFA method (authenticator app, phone, FIDO key) so the user must re-register on next sign-in. Use during BEC. |
removeMobile |
boolean | no | null | Wipe and remove the user's enrolled mobile devices (Intune-managed). Use when the device should not be reused or when terminating an employee. |
removeRules |
boolean | no | null | Delete every server-side inbox rule on the user's mailbox. Important during BEC remediation to remove auto-forwarding/auto-delete rules left by an attacker. |
removeTeamsPhoneDid |
boolean | no | null | Release the user's Teams Phone Direct Inward Dial number back to the tenant pool so it can be reassigned. |
resetPassword |
boolean | no | null | Reset the user's password to a new random value. Use during BEC or when locking the user out before disable. |
revokeSessions |
boolean | no | null | Revoke all active OAuth refresh tokens and sign-in sessions, forcing the user off every device immediately. Critical for BEC and termination flows. |
scheduledRunAt |
string | no | null | Unix epoch seconds or ISO 8601 timestamp (e.g., 1777629600 or 2026-05-01T10:00:00Z) at which to run the offboard. The tool sends Unix epoch seconds because CIPP's runtime scheduler expects that shape. CRITICAL: when set, CIPP queues the task instead of running it immediately and the response will be a queue acknowledgement — per-action results arrive later via the scheduler. Leave null to run immediately. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
user |
string | yes | UPN of the user to offboard (e.g., user@contoso.com). The tool wraps this into CIPP's runtime-required 'user' LabelValue array ({label,value}) automatically. Use cipp_list_users to confirm the UPN before running. |
cipp_onedrive_provision parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Provisioning configuration as JSON object (e.g., {"userId": "user@contoso.com"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_onedrive_shortcut parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Shortcut configuration as JSON object (e.g., {"userId": "user@contoso.com", "siteUrl": "...", "libraryName": "Documents"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_password_never_expires parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'userId' (camelCase, user object ID); 'userPrincipalName' (camelCase, optional UPN); 'PasswordPolicy' (PascalCase string — typically 'DisablePasswordExpiration' to enable never-expires, or empty to revert). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_patch_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Patch payload as a JSON object merged into the request body. Per the live spec the body schema is empty so any key is accepted; typical caller payload identifies the user (e.g., 'id' or 'userPrincipalName') and lists the user properties to update (e.g., {"id":"<guid>","jobTitle":"Engineer","department":"R&D"}). Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_per_user_mfa parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | MFA configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'userId' (camelCase, user object ID); 'userPrincipalName' (camelCase, optional UPN); 'State' (PascalCase string, typical values: 'Enabled' | 'Disabled' | 'Enforced'). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_remove_deleted_object parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object (e.g., {"objectId": "...", "objectType": "User"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_jit_admin_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
id |
string | yes | ID of the JIT admin template to delete. Sent as the spec key 'ID' (PascalCase). Use cipp_list_jit_admin_templates to find available template IDs. |
cipp_remove_trusted_blocked_sender parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object (e.g., {"userId": "user@contoso.com", "sender": "spam@example.com", "listType": "Blocked"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'ID' (UPPERCASE, user object ID — required for the operation to target a specific user); 'userPrincipalName' (camelCase, optional UPN used for audit/notification). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
cipp_remove_user_default_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template configuration as JSON object (e.g., {"templateId": "..."}). |
cipp_reprocess_user_licenses parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object (e.g., {"userId": "user@contoso.com"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_reset_mfa parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) or UPN of the user. Sent as the spec key 'ID' (uppercase). Use cipp_list_users to find valid IDs. |
cipp_reset_password parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | no | null | Optional display name of the user, sent as the spec key 'displayName' (camelCase). CIPP uses it for audit/notification purposes. |
mustChange |
boolean | no | null | If true, the user must change their password on next sign-in. Sent as the spec key 'MustChange' (string-typed per spec — 'true'/'false'). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) or UPN of the user. Sent as the spec key 'ID' (uppercase). Use cipp_list_users to find valid IDs. |
cipp_restore_deleted_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | no | null | Optional display name of the user, sent as the spec key 'displayName' (camelCase). CIPP uses it for audit/notification purposes. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | Object ID (GUID) of the deleted user to restore. Sent as the spec key 'ID' (uppercase). Use cipp_list_deleted_users to find valid IDs. | |
userPrincipalName |
string | no | null | Optional UPN of the user, sent as the spec key 'userPrincipalName' (camelCase). CIPP uses it for audit/notification purposes. |
cipp_revoke_sessions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User object ID (GUID) of the user. Sent as the spec key 'id' (lowercase). Use cipp_list_users to find valid IDs. | |
username |
string | no | null | Optional UPN of the user. Sent as the spec key 'Username' (PascalCase). CIPP uses it for audit/notification purposes. |
cipp_send_push parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Push configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'TenantFilter' (PascalCase, required by spec), 'UserEmail' (PascalCase, the UPN of the user receiving the test push). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase query argument; the tool also seeds it into the body as 'tenantFilter' but the spec actually expects 'TenantFilter' (PascalCase) — supply via fieldsJson if CIPP rejects the camelCase variant. |
cipp_set_cloud_managed parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object (e.g., {"userId": "user@contoso.com"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_set_user_photo parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Photo configuration as JSON object merged LAST into the request body. Spec body keys (all camelCase): 'userId' (the user's object ID or UPN); 'action' (typical values: 'upload' | 'delete'); 'photoData' (base64-encoded image bytes, required when action='upload'). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
Groups
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_group |
Pro | Write | [CIPP] Create a new group in the tenant via POST /api/AddGroup. Required body keys (exact spec casing, all camelCase): 'tenantFilter', 'displayName', 'groupType' (enum: 'azurerole' | 'generic' | 'm365' | 'dynamic' | 'dynamicdistribution' | 'distribution' | 'security'). Optional body keys (exact spec casing): 'allowExternal' (boolean), 'description' (string), 'members' (array<string> of UPNs), 'membershipRules' (string, dynamic-membership rule expression), 'owners' (array<string> of UPNs), 'primDomain' (object — typically a LabelValue {"label":"<domain>","value":"<domain>"}), 'subscribeMembers' (boolean), 'username' (string). |
cipp_add_group_template |
Pro | Write | [CIPP] Save a new group template for reuse via POST /api/AddGroupTemplate. The CIPP body has NO 'tenantFilter' — templates are tenant-agnostic. CRITICAL CASING: the display name field is all-lowercase 'displayname' (NOT camelCase 'displayName'). Body keys (exact spec casing): PascalCase 'Description' (string) and 'GUID' (all-caps); camelCase 'allowExternal' (boolean), 'groupType' (string enum: 'azurerole' | 'generic' | 'm365' | 'dynamic' | 'dynamicDistribution' | 'distribution' | 'security' — note 'dynamicDistribution' is camelCase here unlike cipp_add_group), 'membershipRules' (string), 'subscribeMembers' (boolean), 'username' (string); ALL-LOWERCASE 'displayname' (string, the template display name). |
cipp_convert_group_to_team |
Pro | Write | [CIPP] Convert an existing M365 group into a Microsoft Teams team via POST /api/AddGroupTeam. The group must be an M365 group type. CIPP body field casing is PascalCase here: GroupId, TeamSettings, TenantFilter — note that TenantFilter in the BODY is PascalCase even though the same value is sent as a camelCase 'tenantFilter' query parameter. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_delete_group |
Pro | Write | [CIPP] Delete a group from a tenant via POST /api/ExecGroupsDelete. WARNING: this permanently deletes the group. For M365 groups, this also removes the associated SharePoint site, Teams team, and mailbox. The CIPP body uses MIXED casing — required: 'tenantFilter' (camelCase). Other body keys (exact spec casing): 'GroupType' (PascalCase, the group kind), 'displayName' (camelCase string), 'id' (lowercase string — the group ID, NOT 'groupId'). The same four values are also placed on the query string by the client. |
cipp_edit_group |
Pro | Write | [CIPP] Edit properties of an existing group via PATCH /api/EditGroup. The CIPP body uses MIXED casing. Required body key: 'tenantFilter' (camelCase). Membership change keys are PascalCase arrays of UPN strings: 'AddContact', 'AddMember', 'AddOwner', 'RemoveContact', 'RemoveMember', 'RemoveOwner'. Other body keys (exact spec casing): camelCase 'allowExternal' (boolean), 'description' (string), 'displayName' (string), 'groupId' (object, the target group identifier), 'groupName' (string), 'groupType' (string), 'hideFromOutlookClients' (boolean), 'mail' (string), 'mailNickname' (string), 'membershipRules' (string), 'securityEnabled' (boolean), 'sendCopies' (boolean), 'tenantId' (string), 'visibility' (string). |
cipp_group_delivery_management |
Pro | Write | [CIPP] Toggle whether a distribution/M365 group accepts mail only from internal senders via POST /api/ExecGroupsDeliveryManagement. Required body keys (exact spec casing): 'tenantFilter' (camelCase) and three PascalCase fields — 'GroupType' (string, the group kind), 'ID' (string, all-caps — the group ID, NOT 'groupId'), 'OnlyAllowInternal' (string boolean — 'true'/'false'). The same four values are also placed on the query string by the client. |
cipp_group_hide_from_gal |
Pro | Write | [CIPP] Show or hide a group from the Global Address List (GAL) via POST /api/ExecGroupsHideFromGAL. Required body keys (exact spec casing): 'tenantFilter' (camelCase) and three PascalCase fields — 'GroupType' (string, the group kind), 'HideFromGAL' (string boolean — 'true' to hide, 'false' to show; note 'GAL' is all-caps), 'ID' (string, all-caps — the group ID, NOT 'groupId'). The same four values are also placed on the query string by the client. |
cipp_list_group_sender_auth |
Free | Read-only | [CIPP] List groups with sender authentication settings. Returns whether external senders can email each group. |
cipp_list_group_templates |
Free | Read-only | [CIPP] List saved group templates. Returns template names, group types, and configured settings. |
cipp_list_groups |
Free | Read-only | [CIPP] List all groups in a tenant including security groups, distribution lists, M365 groups, and mail-enabled security groups. Returns group name, type, email, and member count. |
cipp_list_roles |
Free | Read-only | [CIPP] List all directory roles in a tenant including role name, description, and assigned members. Useful for auditing admin access. |
cipp_remove_group_template |
Pro | Write | [CIPP] Remove a saved group template via POST /api/RemoveGroupTemplate. Required body key (exact spec casing): 'ID' (PascalCase, all-caps — the template ID, NOT 'templateId'). The same 'ID' value is also placed on the query string by the client. Use cipp_list_group_templates to find the template ID. |
cipp_add_group parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
displayName |
string | yes | Display name for the new group. Sent as 'displayName' (camelCase) per CIPP spec. | |
fieldsJson |
string | no | null | Optional fields as JSON object merged into the request body verbatim. Spec-listed body keys (exact casing): 'allowExternal' (boolean), 'description' (string), 'members' (array<string>), 'membershipRules' (string), 'owners' (array<string>), 'primDomain' (object — LabelValue {"label":"<domain>","value":"<domain>"}), 'subscribeMembers' (boolean), 'username' (string). Caller is responsible for exact spec casing. |
groupType |
string | yes | Group type. Spec enum (exact spec casing, lowercase): 'azurerole' | 'generic' | 'm365' | 'dynamic' | 'dynamicdistribution' | 'distribution' | 'security'. NOTE: the runtime validation here also accepts the legacy values 'Security'/'Distribution'/'M365'/'DynamicMembership'/'Mail-Enabled Security' for backward compatibility, but the spec requires the lowercase enum above. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_add_group_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'Description' (PascalCase string), 'GUID' (PascalCase, all-caps), 'allowExternal' (boolean), 'displayname' (ALL-LOWERCASE string — distinct from 'displayName'), 'groupType' (string enum: 'azurerole' | 'generic' | 'm365' | 'dynamic' | 'dynamicDistribution' | 'distribution' | 'security'), 'membershipRules' (string), 'subscribeMembers' (boolean), 'username' (string). NO 'tenantFilter'. Caller is responsible for exact spec casing. |
cipp_convert_group_to_team parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
groupId |
string | yes | M365 group ID to convert to a Team. Maps to body field 'GroupId' (PascalCase). Use cipp_list_groups to find valid M365 group IDs. | |
teamSettings |
string | no | null | Optional Teams settings payload as a string. Maps to body field 'TeamSettings' (PascalCase). Verify the exact expected format against the live CIPP backend before setting. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the camelCase 'tenantFilter' query string AND as the PascalCase 'TenantFilter' body field per the CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_delete_group parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GroupType' (PascalCase string), 'displayName' (camelCase string), 'id' (LOWERCASE string — distinct from 'groupId'). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_edit_group parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): membership changes — 'AddContact', 'AddMember', 'AddOwner', 'RemoveContact', 'RemoveMember', 'RemoveOwner' (all PascalCase array<string> of UPNs); properties — 'allowExternal' (boolean), 'description' (string), 'displayName' (string), 'groupName' (string), 'groupType' (string), 'hideFromOutlookClients' (boolean), 'mail' (string), 'mailNickname' (string), 'membershipRules' (string), 'securityEnabled' (boolean), 'sendCopies' (boolean), 'tenantId' (string), 'visibility' (string). Caller is responsible for exact spec casing. | |
groupId |
string | yes | Group ID to edit. Sent as 'groupId' (camelCase) per CIPP spec — note the spec types this as object, not string. Use cipp_list_groups to find valid IDs. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_group_delivery_management parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GroupType' (PascalCase string), 'ID' (PascalCase, all-caps — group ID), 'OnlyAllowInternal' (PascalCase string boolean — 'true'/'false'). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_group_hide_from_gal parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GroupType' (PascalCase string), 'HideFromGAL' (PascalCase, all-caps 'GAL'; string boolean — 'true'/'false'), 'ID' (PascalCase, all-caps — group ID). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_list_groups parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_roles parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_group_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'ID' (string, all-caps — template ID; distinct from 'templateId'). Caller is responsible for exact spec casing. |
Mailboxes
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_exec_mail_test |
Free | Read-only | [CIPP] Run an Exchange Online mail-flow / connectivity diagnostic via GET /api/ExecMailTest. Per spec the endpoint accepts a single query parameter 'Action' selecting which test to run, but the current CIPP client method is parameterless — this tool calls the endpoint without arguments and CIPP runs its default test. Read-only diagnostic; no mailbox state is changed. |
cipp_get_calendar_permissions |
Free | Read-only | [CIPP] Get calendar sharing permissions for a specific user's mailbox including delegate access levels and shared calendar settings. |
cipp_get_contact_permissions |
Free | Read-only | [CIPP] Get contacts folder sharing permissions for a specific user's mailbox. |
cipp_get_mailbox_cas |
Free | Read-only | [CIPP] Get Client Access Settings (CAS) for a specific mailbox including OWA, ActiveSync, POP, IMAP, and MAPI protocol enablement status. |
cipp_get_mailbox_mobile_devices |
Free | Read-only | [CIPP] Get mobile devices connected to a specific mailbox via ActiveSync or Outlook Mobile. Returns device name, OS, last sync time, and access state. |
cipp_get_mailbox_permissions |
Free | Read-only | [CIPP] Get permission assignments for a specific mailbox including Full Access, Send As, and Send on Behalf delegates. |
cipp_get_mailbox_rules |
Free | Read-only | [CIPP] Get inbox rules for a specific mailbox including rule name, conditions, actions, and enabled state. Useful for detecting suspicious forwarding rules. |
cipp_get_ooo |
Free | Read-only | [CIPP] Get the out-of-office (automatic reply) settings for a specific user including internal/external messages and schedule. |
cipp_list_exo_request |
Free | Read-only | [CIPP] Run a read-only Exchange Online PowerShell cmdlet via POST /api/ListExoRequest and return its raw output. Lets callers query EXO data not exposed by a dedicated CIPP endpoint. Body keys per spec (mixed casing): 'TenantFilter' (PascalCase!, required by spec — also accepted as a query parameter), 'Cmdlet' (PascalCase, the EXO cmdlet name to run, e.g., 'Get-Mailbox', 'Get-CASMailbox'), 'Anchor' (PascalCase, optional smtp anchor mailbox for cmdlet routing), 'AsApp' (PascalCase, BOOL — when true, runs as the app identity rather than a delegated user context), 'AvailableCmdlets' (PascalCase, optional listing-mode flag), 'Compliance' (PascalCase, BOOL — when true, routes via the Security/Compliance endpoint instead of EXO), 'Select' (PascalCase, optional comma-separated property selector), 'UseSystemMailbox' (PascalCase, optional override), 'cmdParams' (camelCase, JSON-encoded string of parameter name/value pairs to splat onto the cmdlet, e.g., '{"Identity":"user@contoso.com"}'). The casing split between Cmdlet (Pascal) and cmdParams (camel) is intentional per spec. Read-only by intent — but cmdlet selection is the caller's responsibility, so do NOT pass mutating cmdlets (Set-/Remove-/Add-/New-/Disable-/Enable-) through this tool. |
cipp_list_global_address_list |
Free | Read-only | [CIPP] List entries in the Global Address List (GAL). Returns all mail-enabled recipients visible in the organization's address book. |
cipp_list_mailbox_forwarding |
Free | Read-only | [CIPP] List mailbox forwarding configuration across the tenant via GET /api/ListMailboxForwarding. Reports each mailbox's ForwardingAddress / ForwardingSmtpAddress and whether DeliverToMailboxAndForward is set, plus inbox-rule-driven forwarding. Critical for BEC investigation. Spec query: 'tenantFilter' (required), 'UseReportDB' (string 'true'/'false' — when 'true', CIPP serves the cached/aggregated report DB instead of querying live; default lives behavior). |
cipp_list_mailbox_restores |
Free | Read-only | [CIPP] List pending and completed mailbox restore requests. Returns restore status, source, target, and completion percentage. |
cipp_list_mailboxes |
Free | Read-only | [CIPP] List all mailboxes in a tenant including user, shared, and resource mailboxes. Returns display name, primary SMTP address, mailbox type, and size. |
cipp_list_quarantine_message |
Free | Read-only | [CIPP] List detailed quarantine message information. Returns message headers, quarantine reason, and available actions. |
cipp_list_restricted_users |
Free | Read-only | [CIPP] List users who have been restricted from sending email due to suspected spam or compromise. Use cipp_remove_restricted_user to unblock. |
cipp_list_shared_mailbox_account_enabled |
Free | Read-only | [CIPP] List shared mailboxes that have sign-in enabled. Shared mailboxes with enabled accounts are a security risk as they can be used for direct login. |
cipp_list_shared_mailbox_stats |
Free | Read-only | [CIPP] List all shared mailboxes with usage statistics including size, item count, last activity date, and permission assignments. |
cipp_list_user_mailbox_rules |
Free | Read-only | [CIPP] List inbox rules across users via GET /api/ListUserMailboxRules. Per the live spec, the endpoint accepts query args 'tenantFilter' (required), 'userEmail', and 'UserID' (mixed-case 'UserID') for filtering, but the current CIPP client method exposes no typed query arguments — this tool calls the endpoint without filters and CIPP returns its default scope. To inspect rules for a specific mailbox today, prefer cipp_get_mailbox_rules (per-user). This is the broader cross-user list endpoint, useful for surfacing suspicious forwarding/auto-delete rules across the tenant. |
cipp_get_calendar_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_contact_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_mailbox_cas parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_mailbox_mobile_devices parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_mailbox_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_mailbox_rules parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_get_ooo parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. |
cipp_list_exo_request parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
anchor |
string | no | null | Optional anchor mailbox SMTP address used by EXO cmdlet routing in some scenarios. Sent as body key 'Anchor' (PascalCase, string). |
asApp |
boolean | no | null | When true, CIPP runs the cmdlet as the registered app identity instead of a delegated user context. Sent as body key 'AsApp' (PascalCase, boolean). |
availableCmdlets |
string | no | null | Optional listing-mode flag passed verbatim by some CIPP versions to enumerate cmdlets. Sent as body key 'AvailableCmdlets' (PascalCase, string). |
cmdParams |
string | no | null | Optional cmdlet arguments as a JSON-encoded string of name/value pairs CIPP splats onto the cmdlet (e.g., '{"Identity":"user@contoso.com","ResultSize":"100"}'). Sent as body key 'cmdParams' (camelCase, STRING-typed per spec — pass already-stringified JSON). |
cmdlet |
string | yes | Exchange Online cmdlet name to run (read-only verbs only — Get-* / Find-* / Search-*). Sent as body key 'Cmdlet' (PascalCase, string). | |
compliance |
boolean | no | null | When true, CIPP routes the cmdlet through the Security/Compliance PowerShell endpoint instead of standard Exchange Online. Required for cmdlets like Get-ComplianceCase, Get-RetentionCompliancePolicy. Sent as body key 'Compliance' (PascalCase, boolean). |
select |
string | no | null | Optional comma-separated property selector to project from the cmdlet output (e.g., 'DisplayName,PrimarySMTPAddress'). Sent as body key 'Select' (PascalCase, string). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'TenantFilter' body field (PascalCase!, required per spec) AND accepted as a 'TenantFilter' query parameter. Use cipp_list_tenants to discover available tenants. | |
useSystemMailbox |
string | no | null | Optional override for the system mailbox CIPP uses to run the cmdlet. Sent as body key 'UseSystemMailbox' (PascalCase, string). |
cipp_list_mailbox_forwarding parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' query parameter (camelCase, required per spec). Use cipp_list_tenants to discover available tenants. | |
useReportDB |
string | no | null | When 'true', serve cached/aggregated data from CIPP's report DB instead of querying live Exchange — faster but may be stale. Sent as the 'UseReportDB' query parameter (PascalCase, STRING-typed per spec — pass 'true' or 'false'). |
cipp_list_mailboxes parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_restricted_users parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_shared_mailbox_stats parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
Mailbox Management
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_shared_mailbox |
Pro | Write | [CIPP] Create a new shared mailbox via POST /api/AddSharedMailbox. Shared mailboxes do not require a license and can be accessed by multiple users. The primary SMTP address is constructed by CIPP as username@domain. |
cipp_convert_mailbox |
Pro | Write | [CIPP] Convert a mailbox between types via POST /api/ExecConvertMailbox. Shared mailboxes under 50GB do not require a license. Valid MailboxType values: 'UserMailbox', 'SharedMailbox', 'RoomMailbox', 'EquipmentMailbox'. |
cipp_copy_for_sent |
Pro | Write | [CIPP] Configure whether items sent on behalf of a mailbox by a delegate are also copied to the mailbox owner's Sent Items folder via POST /api/ExecCopyForSent. Body keys per spec: 'tenantFilter' (required), 'ID' (UPPERCASE, the mailbox owner's user object ID or UPN), 'messageCopyState' (camelCase string — typical values include 'Enabled' | 'Disabled'). The same 'ID', 'messageCopyState', and 'tenantFilter' values can also appear as query arguments per the spec. |
cipp_edit_calendar_permissions |
Pro | Write | [CIPP] Grant, change, or revoke a delegate's access to a mailbox's calendar folder via POST /api/ExecEditCalendarPermissions. RUNTIME CONTRACT: CIPP's live backend consumes the exact autocomplete objects its own React UI emits — it unwraps `$Request.Body.Permissions.value`, `$Request.Body.UserToGetPermissions.value`, and `$Request.Body.RemoveAccess.value`. Sending those fields as BARE STRINGS makes the backend read $null and fail with `Cannot convert value "System.String[]" to type MailboxFolderAccessRight[]`. This tool builds the backend-compatible {value,label} object shape (and a real JSON boolean for CanViewPrivateItems) from the typed parameters below, so callers pass plain strings/booleans. To GRANT or CHANGE access leave removeAccess=false and supply permissionLevel; to REVOKE access set removeAccess=true (permissionLevel/canViewPrivateItems are then ignored). Response is CIPP's raw {"Results":[...]} envelope (HTTP 200 even on per-operation failure). Use additionalFieldsJson only for forward-compatibility with new CIPP fields. |
cipp_edit_mailbox_permissions |
Pro | Write | [CIPP] Add or remove mailbox permissions (Full Access, Send As, Send on Behalf) on a mailbox via POST /api/ExecEditMailboxPermissions. NOTE: the body uses lowercase 'tenantfilter' and uppercase 'userID' — these casings are intentional and must not be normalized. |
cipp_enable_archive |
Pro | Write | [CIPP] Enable the online archive mailbox for a user via POST /api/ExecEnableArchive. Archive mailboxes provide additional storage and auto-expanding archive capabilities. Provide either 'username' (UPN) OR 'id' (object ID) — supplying both is allowed but redundant. |
cipp_enable_auto_expanding_archive |
Pro | Write | [CIPP] Enable auto-expanding archive for a mailbox via POST /api/ExecEnableAutoExpandingArchive. Allows the archive mailbox to grow beyond the initial 100 GB limit by adding additional auxiliary archive mailboxes as needed. Body keys per spec: 'tenantFilter' (required), 'ID' (UPPERCASE, the user's object ID), 'username' (lowercase, the user's UPN). Provide either ID or username (or both). |
cipp_exec_mailbox_mobile_devices |
Pro | Write | [CIPP] Perform an admin action on a mailbox-attached mobile device via GET /api/ExecMailboxMobileDevices — typically Quarantine (block sync until reviewed) or Delete (remove the partnership and trigger remote wipe). The CIPP client method exposes no typed query arguments; per the spec, the relevant query parameters are 'Delete', 'deviceid', 'guid', 'Quarantine', 'tenantFilter' (required), 'Userid'. Because the underlying client method is parameterless, this tool currently exposes the endpoint with no parameter passthrough — it triggers CIPP's default ExecMailboxMobileDevices flow. Destructive: 'Delete' wipes the device. WARNING: until the client method is widened to accept query args, prefer cipp_get_mailbox_mobile_devices (read-only) for inventory and use the CIPP UI for one-off Delete/Quarantine actions. |
cipp_hide_from_gal |
Pro | Write | [CIPP] Show or hide a mailbox from the Global Address List (GAL) via POST /api/ExecHideFromGAL. Hidden mailboxes are not visible in the address book but can still receive email. |
cipp_hve_user |
Pro | Write | [CIPP] Create a High Volume Email (HVE) user account via POST /api/ExecHVEUser. HVE accounts are designed for line-of-business applications (CRM, ticketing, automation) that need to send large volumes of internal email without consuming a full Exchange mailbox license. Body keys per spec (PascalCase TenantFilter): 'TenantFilter' (PascalCase!, required), 'displayName' (camelCase, the HVE account's display name), 'primarySMTPAddress' (camelCase, the SMTP address — note 'SMTP' in caps), 'password' (camelCase, the initial password for the HVE account). |
cipp_mailbox_restore |
Pro | Write | [CIPP] Restore mailbox data from a soft-deleted mailbox via POST /api/ExecMailboxRestore. NOTE: the body uses uppercase 'TenantFilter' (intentional, do not normalize) and 'Identity' for the source mailbox reference. Most fields use PascalCase per Exchange cmdlet conventions. |
cipp_message_trace |
Pro | Write | [CIPP] Trace email messages via POST /api/ListMessageTrace by sender, recipient, and date range. Returns delivery status, timestamps, and routing details. Useful for troubleshooting email delivery issues. dateFilter='relative' (uses 'days') OR 'startEnd' (uses 'startDate'/'endDate'). |
cipp_modify_calendar_perms |
Pro | Write | [CIPP] Modify calendar folder permissions via POST /api/ExecModifyCalPerms — the cmdlet-style batch alternative to cipp_edit_calendar_permissions. The backend expects body key 'permissions' to be a JSON ARRAY of permission-entry objects (NOT a JSON-encoded string). Each entry's PermissionLevel/UserID are unwrapped via `.value ?? <scalar>`, so this tool sends {value,label} objects. It builds a single-entry array from the typed parameters below; supply permissionsJson to send a full multi-entry array instead. Response is CIPP's raw {"Results":[...]} envelope (HTTP 500 if any entry errored). |
cipp_modify_contact_perms |
Pro | Write | [CIPP] Modify a mailbox owner's Contacts-folder permissions via POST /api/ExecModifyContactPerms (cmdlet-style batch). Controls who can view or edit a user's personal Contacts folder. The backend expects body key 'permissions' to be a JSON ARRAY of permission-entry objects (NOT a JSON-encoded string). Each entry's PermissionLevel/UserID are unwrapped via `.value ?? <scalar>`, so this tool sends {value,label} objects. It builds a single-entry array from the typed parameters below; supply permissionsJson for a full multi-entry array. NOTE (differs from calendar perms): the Contacts helper has NO CanViewPrivateItems/delegate flag, and FolderName defaults to 'Contact'. Response is CIPP's raw {"Results":[...]} envelope (HTTP 500 if any entry errored). |
cipp_modify_mailbox_perms |
Pro | Write | [CIPP] Modify mailbox-level permissions on a mailbox via POST /api/ExecModifyMBPerms (cmdlet-style alternative to cipp_edit_mailbox_permissions). The spec body is intentionally untyped (oneOf<array<object>, object>) — the caller assembles the cmdlet-shaped payload (FullAccess, SendAs, SendOnBehalf grant/revoke pairs) and passes it through fieldsJson. NOTE: this tool does NOT seed a tenantFilter into the body — include it explicitly in fieldsJson if the endpoint needs it. |
cipp_remove_mailbox_rule |
Pro | Write | [CIPP] Remove a specific inbox rule from a mailbox via POST /api/ExecRemoveMailboxRule. Use cipp_get_mailbox_rules first to find rule IDs. Commonly used to remove suspicious forwarding rules during incident response. NOTE: the body uses uppercase 'TenantFilter' (intentional). |
cipp_remove_restricted_user |
Pro | Write | [CIPP] Unblock a user who has been restricted from sending email via POST /api/ExecRemoveRestrictedUser. Use cipp_list_restricted_users first to see blocked sender addresses. |
cipp_schedule_mailbox_vacation |
Pro | Write | [CIPP] Schedule a mailbox-vacation workflow against POST /api/ExecScheduleMailboxVacation. The endpoint queues a future job that grants delegate access (FullAccess + optional calendar permissions) to one or more 'mailboxOwners' starting at startDate and reverting at endDate. All scalar fields are STRING-typed in the spec (booleans pass as 'true'/'false'). Body keys per spec (camelCase): 'autoMap' (string 'true'/'false' — whether the delegate's mailbox auto-mounts), 'calendarPermission' (string — Outlook role like 'Reviewer', 'Editor', 'AvailabilityOnly', 'LimitedDetails'), 'canViewPrivateItems' (string 'true'/'false'), 'delegates' (string — typically a JSON-encoded list of delegate UPNs CIPP unwraps), 'endDate' (string — ISO 8601), 'includeCalendar' (string 'true'/'false' — whether calendar permissions are added in addition to FullAccess), 'mailboxOwners' (string — typically JSON-encoded list of vacationing-user UPNs), 'permissionTypes' (string — comma-separated permission verb list, e.g., 'FullAccess,SendAs'), 'postExecution' (object — typical shape {webhook:bool,email:bool,psa:bool}), 'reference' (string — audit reference), 'startDate' (string — ISO 8601), 'tenantFilter' (camelCase, required — also accepted as a query parameter). Use additionalFieldsJson for forward-compat. Destructive note: this grants long-lived FullAccess; revoke after the vacation window closes if the schedule does not auto-revert. |
cipp_schedule_ooo_vacation |
Pro | Write | [CIPP] Schedule a future out-of-office (auto-reply) window for one or more users via POST /api/ExecScheduleOOOVacation. CIPP queues the job; auto-replies turn on at startDate and turn off at endDate. Body keys per spec: 'Users' (PascalCase!, STRING-typed — typically a JSON-encoded list of UPN strings CIPP unwraps), 'startDate' (camelCase, ISO 8601 string), 'endDate' (camelCase, ISO 8601 string), 'externalMessage' (camelCase, the auto-reply body sent to external senders), 'internalMessage' (camelCase, the auto-reply body sent to internal senders), 'postExecution' (object — typical shape {webhook:bool,email:bool,psa:bool}), 'reference' (camelCase, audit reference string), 'tenantFilter' (camelCase, required — also accepted as a query parameter). Note the casing split: 'Users' is PascalCase while the rest of the body uses camelCase — this is intentional per the CIPP spec and must not be normalized. |
cipp_set_calendar_processing |
Pro | Write | [CIPP] Configure calendar processing settings for a resource mailbox (room or equipment) via POST /api/ExecSetCalendarProcessing — includes auto-accept, booking window, conflict resolution, processing of external meeting messages, and so on. NOTE: most numeric/boolean values in this spec are STRING-typed (passed as 'true'/'false' or numeric strings). Body keys per spec: 'tenantFilter' (required), 'UPN' (PascalCase, the resource mailbox UPN), 'addOrganizerToSubject', 'additionalResponse', 'allowConflicts', 'allowRecurringMeetings', 'automaticallyAccept', 'automaticallyProcess', 'bookingWindowInDays', 'deleteComments', 'deleteSubject', 'maxConflicts', 'maximumDurationInMinutes', 'minimumDurationInMinutes', 'processExternalMeetingMessages', 'removeCanceledMeetings', 'removeOldMeetingMessages', 'removePrivateProperty', 'scheduleOnlyDuringWorkHours' (all camelCase strings). |
cipp_set_email_forward |
Pro | Write | [CIPP] Configure email forwarding for a mailbox via POST /api/ExecEmailForward. Forwarding can target an internal recipient (ForwardInternal) OR an external address (ForwardExternal) — set whichever applies. KeepCopy controls whether forwarded messages also remain in the source mailbox. NOTE: the body uses 'userID' (uppercase ID). |
cipp_set_litigation_hold |
Pro | Write | [CIPP] Enable or disable litigation hold on a mailbox via POST /api/ExecSetLitigationHold. Litigation hold preserves all mailbox content including deleted items for legal discovery. The CIPP body uses 'disable' (string) — pass 'true' to disable hold, omit/empty to enable. Optional 'days' sets a hold duration. |
cipp_set_mailbox_email_size |
Pro | Write | [CIPP] Set the maximum send/receive message size for a mailbox via POST /api/ExecSetMailboxEmailSize. Controls the largest single message (including attachments) that can be sent from or received by the mailbox. Body keys per spec: 'tenantFilter' (required), 'UPN' (PascalCase, the mailbox UPN), 'id' (lowercase, the mailbox object ID), 'maxSendSize' (camelCase string with units, e.g., '35MB'), 'maxReceiveSize' (camelCase string with units, e.g., '35MB'). |
cipp_set_mailbox_locale |
Pro | Write | [CIPP] Set the language and regional settings for a mailbox via POST /api/ExecSetMailboxLocale. |
cipp_set_mailbox_quota |
Pro | Write | [CIPP] Set storage quota limits for a mailbox via POST /api/ExecSetMailboxQuota including prohibit send, prohibit send/receive, and warning thresholds. NOTE: the body uses lowercase 'tenantfilter' (intentional, do not normalize). Quotas are passed as strings with units (e.g., '50GB', '49.5GB'). |
cipp_set_mailbox_rule |
Pro | Write | [CIPP] Enable or disable an existing server-side inbox rule on a mailbox via POST /api/ExecSetMailboxRule. NOTE: this endpoint does not create a new rule — use 'Disable' or 'Enable' on an existing rule identified by ruleId or ruleName. Body keys per spec: 'TenantFilter' (PascalCase!, required), 'userPrincipalName' (camelCase, mailbox owner UPN), 'ruleId' (camelCase, the rule's identifier), 'ruleName' (camelCase, alternative to ruleId), 'Enable' (PascalCase, string 'true'/'false'), 'Disable' (PascalCase, string 'true'/'false'). Set exactly one of Enable/Disable. |
cipp_set_ooo |
Pro | Write | [CIPP] Configure out-of-office (automatic reply) settings for a mailbox via POST /api/ExecSetOoO with separate internal and external messages. AutoReplyState valid values: 'Enabled', 'Disabled', 'Scheduled'. When 'Scheduled', set StartTime and EndTime as ISO-8601 timestamps. |
cipp_set_recipient_limits |
Pro | Write | [CIPP] Set the maximum number of recipients per outbound email message for a mailbox via POST /api/ExecSetRecipientLimits. Helps contain mass-mailing damage from compromised accounts. Body keys per spec: 'tenantFilter' (required), 'Identity' (PascalCase, mailbox identifier — UPN, alias, or DN), 'userid' (lowercase, mailbox object ID), 'recipientLimit' (camelCase string — numeric limit as a string, e.g., '500'). |
cipp_set_retention_hold |
Pro | Write | [CIPP] Enable or disable retention hold on a mailbox via POST /api/ExecSetRetentionHold. When enabled, retention policies temporarily stop deleting/moving items so a user (e.g., on leave) does not lose mail to retention while away. Body keys per spec: 'tenantFilter' (required), 'UPN' (PascalCase, mailbox UPN), 'Identity' (PascalCase, alternative mailbox identifier — alias, DN, GUID), 'disable' (lowercase string 'true'/'false' — pass 'true' to DISABLE retention hold; omit/empty to enable). |
cipp_start_managed_folder_assistant |
Pro | Write | [CIPP] Start the Managed Folder Assistant for a mailbox via POST /api/ExecStartManagedFolderAssistant to immediately process retention policies and tags instead of waiting for the next automatic cycle. Body keys per spec: 'tenantFilter' (required), 'Id' (mixed-case 'Id' — capital I lowercase d, the mailbox object ID), 'UserPrincipalName' (PascalCase, the mailbox UPN). The same 'Id' and 'tenantFilter' values can also appear as query arguments per the spec. |
cipp_add_shared_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
addedAliases |
string | no | null | Optional comma-separated list of additional alias addresses (e.g., 'helpdesk@contoso.com,it@contoso.com'). Sent as body key 'addedAliases'. |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | yes | Display name for the shared mailbox (e.g., 'IT Support'). Sent as body key 'displayName'. | |
domain |
string | yes | Domain portion of the primary SMTP address (e.g., 'contoso.com'). Must be a verified domain in the target tenant. Sent as body key 'domain'. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the tenantFilter query argument; the body uses tenantID for the resolved tenant identifier. | |
tenantID |
string | no | null | Optional explicit tenant identifier (Microsoft tenant ID GUID). When omitted, CIPP resolves it from tenantFilter. Sent as body key 'tenantID'. |
username |
string | yes | Local part of the primary SMTP address (e.g., 'support' for support@contoso.com). Sent as body key 'username'. |
cipp_convert_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
mailboxType |
string | yes | Target mailbox type. Valid values: 'UserMailbox', 'SharedMailbox', 'RoomMailbox', 'EquipmentMailbox'. Sent as body key 'MailboxType'. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
userId |
string | yes | User ID or UPN of the mailbox to convert (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'ID'. |
cipp_copy_for_sent parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'ID' (UPPERCASE, mailbox owner's user object ID or UPN); 'messageCopyState' (camelCase string — typical values: 'Enabled' | 'Disabled'). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
cipp_edit_calendar_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding anything the typed parameters set. Use only for new CIPP fields this tool does not yet expose. Keys passed verbatim — caller owns exact spec casing. |
canViewPrivateItems |
boolean | no | false | Enable delegate sharing with private-item visibility ('Delegate,CanViewPrivateItems') so the shared calendar auto-appears in the delegate's Outlook and private items are visible. Only meaningful for the 'Editor' role on a grant. Sent as body key 'CanViewPrivateItems' as a JSON BOOLEAN (never a string — PowerShell treats the string "false" as $true, which would silently enable the flag). Default false. |
delegateUserOrGroup |
string | yes | The delegate being granted or revoked — the UPN or object id of the user OR security group to give/remove calendar access (e.g., group@contoso.com). The tool wraps this into the backend's autocomplete shape automatically: on grant it becomes body key 'UserToGetPermissions' (array of {value,label}, mirroring the UI's multi-select); on revoke it becomes 'RemoveAccess' ({value,label}). | |
folderName |
string | no | "Calendar" | Calendar folder name to target. Almost always 'Calendar' (the default). Sent as body key 'FolderName'. |
mailboxUserId |
string | yes | The mailbox OWNER whose calendar is being shared — UPN or user object id (e.g., owner@contoso.com). Sent as body key 'userid' (lowercase, per the CIPP entrypoint). | |
permissionLevel |
string | no | null | Outlook calendar role to grant: 'Owner' | 'PublishingEditor' | 'Editor' | 'PublishingAuthor' | 'Author' | 'NonEditingAuthor' | 'Reviewer' | 'Contributor' | 'AvailabilityOnly' | 'LimitedDetails' | 'None'. REQUIRED when granting (removeAccess=false); ignored when removeAccess=true. Sent as body key 'Permissions' = {value,label}. |
removeAccess |
boolean | no | false | Set true to REVOKE the delegate's access instead of granting it. When true, permissionLevel and canViewPrivateItems are ignored and the delegate is sent as body key 'RemoveAccess'; the tool never emits an empty RemoveAccess (an empty value would flip a grant into a revoke in the backend). Default false = grant/change. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the tenantFilter query argument and body key. |
cipp_edit_mailbox_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Permission changes as JSON object using the exact CIPP keys: AddFullAccess, AddFullAccessNoAutoMap, AddSendAs, AddSendOnBehalf, RemoveFullAccess, RemoveSendAs, RemoveSendOnBehalf (each typically an array of UPN strings). Merged into the request body LAST so it overrides typed fields. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both the tenantFilter query argument AND as body key 'tenantfilter' (lowercase, intentional). | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'userID' (uppercase ID, intentional). |
cipp_enable_archive parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | no | null | Optional Microsoft Graph object ID (GUID) of the user. Used when CIPP cannot resolve the user by UPN. Sent as body key 'id'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
username |
string | no | null | UPN of the mailbox (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid UPNs. Sent as body key 'username'. |
cipp_enable_auto_expanding_archive parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'ID' (UPPERCASE, user object ID); 'username' (lowercase, user UPN). Provide either ID or username (or both). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_hide_from_gal parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
hide |
boolean | no | true | True to hide from GAL, false to show in GAL. Defaults to true. Sent as body key 'HideFromGAL' as the string 'true' or 'false'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
userId |
string | yes | User ID or UPN of the mailbox (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'ID' (uppercase, intentional). |
cipp_hve_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | HVE configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'TenantFilter' (PascalCase!, required by spec); 'displayName' (camelCase, HVE account display name); 'primarySMTPAddress' (camelCase with 'SMTP' in caps, the HVE account's SMTP address); 'password' (camelCase, initial password). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase query argument; the spec body actually expects 'TenantFilter' (PascalCase) — supply via fieldsJson if CIPP rejects the camelCase variant the tool seeds. |
cipp_mailbox_restore parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Restore action verb passed verbatim by CIPP (e.g., 'New' to create a new restore request). Sent as body key 'Action'. |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use for advanced fields like AcceptLargeDataLoss, BadItemLimit, ConflictResolutionOption, ExcludeDumpster, ExcludeFolders/IncludeFolders, LargeItemLimit, RequestName, SourceIsArchive, SourceMailbox, SourceRootFolder, TargetIsArchive, TargetType, AssociatedMessagesCopyOption, BatchName, CompletedRequestAgeLimit. Keys are passed verbatim — caller is responsible for exact spec casing. |
identity |
string | yes | Source mailbox identity — typically the soft-deleted mailbox's distinguished name, alias, or GUID. Sent as body key 'Identity'. | |
targetMailbox |
string | no | null | Destination mailbox UPN that will receive the restored data (e.g., admin@contoso.com). Sent as body key 'TargetMailbox'. |
targetRootFolder |
string | no | null | Optional sub-folder under the target mailbox where restored content lands (e.g., 'Restored'). Sent as body key 'TargetRootFolder'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the tenantFilter query argument AND as body key 'TenantFilter' (uppercase, intentional). |
cipp_message_trace parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
dateFilter |
string | no | null | Date filter mode. Valid values: 'relative' (use the 'days' parameter) or 'startEnd' (use 'startDate' and 'endDate'). Sent as body key 'dateFilter'. |
days |
number | no | null | Number of days back to trace when dateFilter='relative' (e.g., 7). Sent as body key 'days'. |
endDate |
string | no | null | End date for the trace in ISO 8601 format (e.g., '2024-01-07T23:59:59Z'). Sent as body key 'endDate'. |
fromIP |
string | no | null | Originating IP address filter. Sent as body key 'fromIP'. |
messageId |
string | no | null | Specific Exchange Internet Message ID to look up. Sent as body key 'MessageId'. |
recipient |
string | no | null | Recipient email address to filter by. CIPP wraps this into a single-element array under body key 'recipient'. |
sender |
string | no | null | Sender email address to filter by. CIPP wraps this into a single-element array under body key 'sender'. |
startDate |
string | no | null | Start date for the trace in ISO 8601 format (e.g., '2024-01-01T00:00:00Z'). Sent as body key 'startDate'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
toIP |
string | no | null | Destination IP address filter. Sent as body key 'toIP'. |
traceDetail |
string | no | null | Trace detail level passed verbatim by CIPP (e.g., 'Summary', 'Detailed'). Sent as body key 'traceDetail'. |
cipp_modify_calendar_perms parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object merged into the TOP-LEVEL request body LAST (alongside tenantFilter/userID/permissions), overriding earlier keys. Keys passed verbatim. |
canViewPrivateItems |
boolean | no | false | Enable delegate private-item visibility for this entry (Editor role only). Sent as the entry's 'CanViewPrivateItems' JSON boolean. Default false. |
delegateUserOrGroup |
string | no | null | The delegate user/group UPN or id being granted or removed. Wrapped into the entry's 'UserID' array of {value,label}. Required unless permissionsJson is supplied. |
folderName |
string | no | "Calendar" | Calendar folder name for the entry. Default 'Calendar'. Sent as the entry's 'FolderName'. |
mailboxUserId |
string | yes | The mailbox OWNER whose calendar is modified — UPN or user object id. Sent as body key 'userID' (PascalCase 'ID', per the CIPP entrypoint). CIPP resolves a UPN to an object id via Graph. | |
modification |
string | no | "Add" | 'Add' to grant/update the permission or 'Remove' to revoke it. Sent verbatim as the entry's 'Modification'. Default 'Add'. |
permissionLevel |
string | no | null | Outlook calendar role for the entry (e.g., 'Editor', 'Reviewer', 'Owner', 'AvailabilityOnly'). Sent as the entry's 'PermissionLevel' = {value,label}. Required when modification='Add'. |
permissionsJson |
string | no | null | Advanced: a JSON ARRAY of full permission-entry objects to send as body key 'permissions', REPLACING the single-entry array built from the typed parameters. Each entry may contain: UserID (array of objects or a bare UPN), PermissionLevel ( object or a bare role string), Modification ('Add'|'Remove'), CanViewPrivateItems (bool), FolderName. Use to batch multiple delegates in one call. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_modify_contact_perms parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object merged into the TOP-LEVEL request body LAST (alongside tenantFilter/userID/permissions), overriding earlier keys. Keys passed verbatim. |
delegateUserOrGroup |
string | no | null | The delegate user/group UPN or id being granted or removed. Wrapped into the entry's 'UserID' array of {value,label}. Required unless permissionsJson is supplied. |
folderName |
string | no | "Contact" | Contacts folder name for the entry. Default 'Contact' (the Contacts helper's default — NOT 'Calendar'). Sent as the entry's 'FolderName'. |
mailboxUserId |
string | yes | The mailbox OWNER whose Contacts folder is modified — UPN or user object id. Sent as body key 'userID' (PascalCase 'ID', per the CIPP entrypoint). CIPP resolves a UPN to an object id via Graph. | |
modification |
string | no | "Add" | 'Add' to grant/update the permission or 'Remove' to revoke it. Sent verbatim as the entry's 'Modification'. Default 'Add'. |
permissionLevel |
string | no | null | Outlook permission role for the entry (e.g., 'Editor', 'Reviewer', 'Owner', 'AvailabilityOnly'). Sent as the entry's 'PermissionLevel' = {value,label}. Required when modification='Add'. |
permissionsJson |
string | no | null | Advanced: a JSON ARRAY of full permission-entry objects to send as body key 'permissions', REPLACING the single-entry array built from the typed parameters. Each entry may contain: UserID (array of objects or a bare UPN), PermissionLevel ( object or a bare role string), Modification ('Add'|'Remove'), FolderName, SendNotificationToUser (bool). Use to batch multiple delegates in one call. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_modify_mailbox_perms parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Permission configuration as JSON object passed verbatim as the request body. The spec is open-ended (oneOf<array<object>, object>); the typical shape mirrors CIPP's cmdlet wrapper and includes 'tenantFilter' (camelCase, recommended), the mailbox identifier (commonly 'userId' or 'userPrincipalName'), and grant/revoke fields like 'AddFullAccess', 'AddSendAs', 'AddSendOnBehalf', 'RemoveFullAccess', 'RemoveSendAs', 'RemoveSendOnBehalf' (PascalCase, each typically an array of UPN strings). Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_remove_mailbox_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
ruleId |
string | no | null | Rule ID to remove. Use cipp_get_mailbox_rules to find valid rule IDs. Sent as body key 'ruleId'. Either ruleId or ruleName must be supplied. |
ruleName |
string | no | null | Rule display name to remove (alternative to ruleId). Sent as body key 'ruleName'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the tenantFilter query argument AND as body key 'TenantFilter' (uppercase, intentional). | |
userPrincipalName |
string | yes | UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid UPNs. Sent as body key 'userPrincipalName'. |
cipp_remove_restricted_user parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
senderAddress |
string | yes | Sender SMTP address of the restricted user (e.g., user@contoso.com). Use cipp_list_restricted_users to find blocked addresses. Sent as body key 'SenderAddress'. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
cipp_schedule_mailbox_vacation parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
autoMap |
boolean | no | null | When true, mounts the delegate's access to the vacationing mailbox so it auto-loads in Outlook. Sent as body key 'autoMap' (camelCase, STRING-typed: emitted as 'true' or 'false'). |
calendarPermission |
string | no | null | Outlook calendar role granted to the delegate when includeCalendar is true. Typical values: 'Reviewer' | 'Editor' | 'AvailabilityOnly' | 'LimitedDetails' | 'Owner' | 'PublishingEditor' | 'Author' | 'PublishingAuthor' | 'Contributor' | 'NonEditingAuthor'. Sent as body key 'calendarPermission' (camelCase, string). |
canViewPrivateItems |
boolean | no | null | When true, the delegate can view items in the calendar marked as Private (otherwise hidden). Sent as body key 'canViewPrivateItems' (camelCase, STRING-typed: emitted as 'true' or 'false'). |
delegates |
string | yes | Delegate users who receive coverage access — typically a JSON-encoded list of UPN strings. Sent as body key 'delegates' (camelCase, STRING-typed per spec). | |
endDate |
string | yes | ISO 8601 timestamp when the vacation/coverage window ends (e.g., '2026-05-15T17:00:00Z'). Sent as body key 'endDate' (camelCase, string-typed). | |
includeCalendar |
boolean | no | null | When true, also grant the delegate calendar folder permissions (in addition to mailbox FullAccess). Sent as body key 'includeCalendar' (camelCase, STRING-typed: emitted as 'true' or 'false'). |
mailboxOwners |
string | yes | Vacationing mailbox owners — typically a JSON-encoded list of UPN strings as understood by CIPP (e.g., '["user1@contoso.com","user2@contoso.com"]'). Sent as body key 'mailboxOwners' (camelCase, STRING-typed per spec — pass already-stringified JSON). | |
permissionTypes |
string | no | null | Comma-separated permission verbs to grant the delegates (e.g., 'FullAccess', 'FullAccess,SendAs'). Sent as body key 'permissionTypes' (camelCase, string). |
postExecutionEmail |
boolean | no | null | After completion, send the CIPP-configured notification email. Channel of the postExecution notification block. |
postExecutionPsa |
boolean | no | null | After completion, post a ticket/note via the configured PSA integration. Channel of the postExecution notification block. |
postExecutionWebhook |
boolean | no | null | After completion, fire the configured CIPP webhook(s). Channel of the postExecution notification block. |
reference |
string | no | null | Free-form audit reference string written into CIPP history (e.g., a ticket number). Sent as body key 'reference' (camelCase, string). |
startDate |
string | yes | ISO 8601 timestamp when the vacation/coverage window begins (e.g., '2026-05-01T09:00:00Z'). Sent as body key 'startDate' (camelCase, string-typed). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) AND accepted as a 'tenantFilter' query parameter per the CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_schedule_ooo_vacation parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
endDate |
string | yes | ISO 8601 timestamp when the OOO ends (e.g., '2026-05-15T17:00:00Z'). Sent as body key 'endDate' (camelCase, string). | |
externalMessage |
string | no | null | Auto-reply text sent to external senders. Plain text or HTML. Sent as body key 'externalMessage' (camelCase, string). |
internalMessage |
string | no | null | Auto-reply text sent to internal senders (same tenant). Plain text or HTML. Sent as body key 'internalMessage' (camelCase, string). |
postExecutionEmail |
boolean | no | null | After completion, send the CIPP-configured notification email. Channel of the postExecution notification block. |
postExecutionPsa |
boolean | no | null | After completion, post a ticket/note via the configured PSA integration. Channel of the postExecution notification block. |
postExecutionWebhook |
boolean | no | null | After completion, fire the configured CIPP webhook(s). Channel of the postExecution notification block. |
reference |
string | no | null | Free-form audit reference string written into CIPP history (e.g., a ticket number). Sent as body key 'reference' (camelCase, string). |
startDate |
string | yes | ISO 8601 timestamp when the OOO begins (e.g., '2026-05-01T09:00:00Z'). Sent as body key 'startDate' (camelCase, string). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) AND accepted as a 'tenantFilter' query parameter per the CIPP spec. Use cipp_list_tenants to discover available tenants. | |
users |
string | yes | Users whose OOO is being scheduled — typically a JSON-encoded list of UPN strings as understood by CIPP (e.g., '["user1@contoso.com","user2@contoso.com"]'). Sent as body key 'Users' (PascalCase!, STRING-typed per spec — pass already-stringified JSON). The PascalCase 'Users' is intentional; do not normalize. |
cipp_set_calendar_processing parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Calendar processing settings as JSON object merged LAST into the request body. Spec body keys (exact casing, all values STRING-typed in spec — pass 'true'/'false' or numeric strings): 'UPN' (PascalCase, resource mailbox UPN); camelCase strings: 'addOrganizerToSubject', 'additionalResponse', 'allowConflicts', 'allowRecurringMeetings', 'automaticallyAccept', 'automaticallyProcess', 'bookingWindowInDays', 'deleteComments', 'deleteSubject', 'maxConflicts', 'maximumDurationInMinutes', 'minimumDurationInMinutes', 'processExternalMeetingMessages', 'removeCanceledMeetings', 'removeOldMeetingMessages', 'removePrivateProperty', 'scheduleOnlyDuringWorkHours'. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_set_email_forward parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
forwardExternal |
string | no | null | External forwarding target — full SMTP address outside the tenant (e.g., archive@partner.com). Sent as body key 'ForwardExternal'. |
forwardInternal |
string | no | null | Internal forwarding target — UPN of an internal recipient in the same tenant (e.g., manager@contoso.com). Sent as body key 'ForwardInternal'. |
forwardOption |
string | no | null | Forwarding mode/option string passed verbatim by some CIPP versions (e.g., 'forward', 'disable'). Sent as body key 'forwardOption'. |
keepCopy |
boolean | no | null | When true, keep a copy of forwarded messages in the source mailbox in addition to forwarding (DeliverToMailboxAndForward). Sent as body key 'KeepCopy'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'userID' (uppercase ID). |
cipp_set_litigation_hold parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
days |
string | no | null | Hold duration in days. When omitted, hold is indefinite. Sent as body key 'days' (string). |
disable |
boolean | no | null | When true, DISABLE litigation hold (CIPP toggles by passing this flag). When false or null, the hold is enabled. Sent as body key 'disable' as the string 'true' or 'false'. |
identity |
string | no | null | Optional explicit Identity reference (mailbox alias, distinguished name, or GUID) when CIPP cannot resolve the mailbox by UPN alone. Sent as body key 'Identity'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
upn |
string | yes | UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'UPN'. |
cipp_set_mailbox_email_size parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'UPN' (PascalCase, mailbox UPN); 'id' (lowercase, mailbox object ID); 'maxSendSize' (camelCase string with size + units, e.g., '35MB'); 'maxReceiveSize' (camelCase string, same format). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_set_mailbox_locale parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
locale |
string | no | null | Locale identifier (e.g., 'en-US', 'de-DE', 'fr-FR'). Sent as body key 'locale'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
user |
string | yes | UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'user'. |
cipp_set_mailbox_quota parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
issueWarningQuota |
string | no | null | Threshold at which the user is warned but mail still flows (e.g., '49GB'). Sent as body key 'IssueWarningQuota'. |
prohibitSendQuota |
string | no | null | Threshold at which sending is blocked (e.g., '49.5GB'). Sent as body key 'ProhibitSendQuota'. |
prohibitSendReceiveQuota |
string | no | null | Threshold at which both sending and receiving are blocked (e.g., '50GB'). Sent as body key 'ProhibitSendReceiveQuota'. |
quota |
string | no | null | Generic quota value (e.g., '50GB'). Used when CIPP applies a single quota rather than the granular thresholds. Sent as body key 'quota'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the tenantFilter query argument AND as body key 'tenantfilter' (lowercase, intentional). | |
user |
string | yes | User ID or UPN of the mailbox (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'user'. |
cipp_set_mailbox_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Inbox rule configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'TenantFilter' (PascalCase!, required by spec); 'userPrincipalName' (camelCase, mailbox owner UPN); 'ruleId' (camelCase) OR 'ruleName' (camelCase) to identify the rule; 'Enable' (PascalCase string 'true'/'false') OR 'Disable' (PascalCase string 'true'/'false') — set exactly one. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase query argument; the spec body actually expects 'TenantFilter' (PascalCase) — supply via fieldsJson if CIPP rejects the camelCase variant the tool seeds. |
cipp_set_ooo parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
autoReplyState |
string | no | null | Auto-reply state. Valid values: 'Enabled', 'Disabled', 'Scheduled'. When 'Scheduled', also set startTime and endTime. Sent as body key 'AutoReplyState'. |
endTime |
string | no | null | ISO-8601 end timestamp for scheduled OOO (e.g., '2026-05-15T17:00:00Z'). Required when autoReplyState='Scheduled'. Sent as body key 'EndTime'. |
externalMessage |
string | no | null | Auto-reply message body for external senders. Plain text or HTML. Sent as body key 'ExternalMessage'. |
internalMessage |
string | no | null | Auto-reply message body for internal senders. Plain text or HTML. Sent as body key 'InternalMessage'. |
startTime |
string | no | null | ISO-8601 start timestamp for scheduled OOO (e.g., '2026-05-01T09:00:00Z'). Required when autoReplyState='Scheduled'. Sent as body key 'StartTime'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. | |
userId |
string | yes | User ID or UPN of the mailbox owner (e.g., user@contoso.com). Use cipp_list_mailboxes to find valid IDs. Sent as body key 'userId'. |
cipp_set_recipient_limits parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'Identity' (PascalCase, mailbox identifier — UPN/alias/DN); 'userid' (lowercase, mailbox object ID); 'recipientLimit' (camelCase string — numeric limit as a string, e.g., '500'). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_set_retention_hold parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'UPN' (PascalCase, mailbox UPN); 'Identity' (PascalCase, alternative mailbox identifier — alias, DN, GUID); 'disable' (LOWERCASE string 'true'/'false' — pass 'true' to DISABLE retention hold; omit/empty to enable). The 'disable' semantics are reversed from a friendlier 'enable' parameter, matching CIPP's spec. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as body key 'tenantFilter'. |
cipp_start_managed_folder_assistant parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Configuration as JSON object merged LAST into the request body. Spec body keys (exact casing): 'Id' (mixed case 'Id' — capital I lowercase d, mailbox object ID); 'UserPrincipalName' (PascalCase, mailbox UPN). Provide either Id or UserPrincipalName (or both). Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as both query argument and body key 'tenantFilter'. |
Mailbox Retention
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_delete_retention_policies |
Pro | Write | [CIPP] Delete retention policies for a tenant via DELETE /api/ExecManageRetentionPolicies. Spec marks the body required with required camelCase 'tenantFilter'. Optional body keys: 'CreatePolicies' (PascalCase array), 'ModifyPolicies' (PascalCase array), 'DeletePolicies' (PascalCase array). WARNING: Deleting retention policies may affect legal hold compliance. |
cipp_delete_retention_tags |
Pro | Write | [CIPP] Delete retention tags for a tenant via DELETE /api/ExecManageRetentionTags. Spec marks the body required with required camelCase 'tenantFilter'. Optional body keys: 'Comment' (PascalCase string), 'CreateTags' (PascalCase array), 'ModifyTags' (PascalCase array), 'DeleteTags' (PascalCase array). WARNING: Removing retention tags affects how mailbox items are managed and may impact compliance. |
cipp_set_mailbox_retention_policies |
Pro | Write | [CIPP] Assign a retention policy to one or more mailboxes via POST /api/ExecSetMailboxRetentionPolicies. CIPP body keys per spec: 'Mailboxes' (PascalCase, string — typically a comma-separated list of UPNs / a JSON-encoded blob of mailbox identities), 'PolicyName' (PascalCase, string — the Exchange retention policy display name), 'tenantFilter' (camelCase, required — also accepted as a query parameter). The 'Mailboxes' field is documented as STRING-typed per spec, not an array. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_retention_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'CreatePolicies' (PascalCase array), 'ModifyPolicies' (PascalCase array), 'DeletePolicies' (PascalCase array — typically the policy identities to remove). Tool injects camelCase 'tenantFilter' from the typed parameter — do NOT add it here. Pass null for a minimal body. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the 'tenantFilter' (camelCase) query argument AND body field per the live spec. |
cipp_delete_retention_tags parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'Comment' (PascalCase string), 'CreateTags' (PascalCase array), 'ModifyTags' (PascalCase array), 'DeleteTags' (PascalCase array — typically the tag identities to remove). Tool injects camelCase 'tenantFilter' from the typed parameter — do NOT add it here. Pass null for a minimal body. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the 'tenantFilter' (camelCase) query argument AND body field per the live spec. |
cipp_set_mailbox_retention_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Retention assignment as JSON object. Body keys per spec: 'Mailboxes' (PascalCase, STRING-typed — typically a comma-separated list of UPNs or a JSON-encoded blob of identities; NOT an array per spec), 'PolicyName' (PascalCase, the Exchange Online retention policy display name to assign). Example: {"Mailboxes":"user1@contoso.com,user2@contoso.com","PolicyName":"Default MRM Policy"}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) AND accepted as a 'tenantFilter' query parameter per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
Contacts & Resources
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_contact |
Pro | Write | [CIPP] Create a new mail contact in a tenant directory via POST /api/AddContact. Mail contacts are external people that appear in the GAL but cannot sign in. The CIPP body uses MIXED casing — preserve verbatim: address fields are PascalCase ('City', 'Company', 'CountryOrRegion', 'PostalCode', 'State', 'StreetAddress', 'Title'), name/contact fields are camelCase ('displayName', 'email', 'firstName', 'lastName', 'mailTip', 'mobilePhone', 'phone', 'website'), the GAL flag is 'hidefromGAL' (specific casing — string-typed in the create body, unlike the boolean used by EditContact), and the tenant id is 'tenantid' (all-lowercase here, NOT 'tenantID'). |
cipp_add_contact_template |
Pro | Write | [CIPP] Create a new CIPP contact template via POST /api/AddContactTemplates. Stores the contact attributes for later bulk deployment (via cipp_deploy_contact_templates) across tenants. Not tenant-scoped — this is the CIPP-internal template store. CIPP body keys are MOSTLY camelCase per spec: businessPhone, city, companyName, country, displayName, email, firstName, hidefromGAL (boolean — note specific casing 'hidefromGAL'), jobTitle, lastName, mailTip, mobilePhone, postalCode, state, streetAddress, website. Display name and email are typically required for the underlying contact. |
cipp_add_equipment_mailbox |
Pro | Write | [CIPP] Create a new equipment mailbox for a bookable resource (projector, vehicle, conference phone, etc.) via POST /api/AddEquipmentMailbox. Equipment mailboxes are bookable through Outlook calendaring. The CIPP body uses camelCase 'displayName' and 'userPrincipalName'/'username', a LabelValue 'domain' object, and a body field 'tenantID' (camel-ish all-caps ID — DIFFERENT from AddRoomMailbox's all-lowercase 'tenantid'). The endpoint is also wrapped with a query-string tenant by the connector for routing, but the spec body schema does NOT include 'tenantFilter' — only 'tenantID' selects the destination tenant. |
cipp_add_room_list |
Pro | Write | [CIPP] Create a new room list (group of rooms by building/floor/location) via POST /api/AddRoomList. Room lists group rooms so users can browse them by category in Outlook's room finder. CIPP body uses camelCase + a LabelValue 'primDomain' object. tenantFilter is sent on BOTH the query string AND the body. |
cipp_add_room_mailbox |
Pro | Write | [CIPP] Create a new room mailbox via POST /api/AddRoomMailbox. Room mailboxes are bookable through Outlook calendaring. The CIPP body uses exact-cased keys: 'DisplayName' (PascalCase), 'ResourceCapacity' (PascalCase, string-typed even though it represents a number), 'domain' (LabelValue {label,value} where value is the accepted domain), 'tenantid' (lowercase, required tenant ID), 'userPrincipalName', and 'username'. The tenantFilter parameter is also placed on the query string by the client. |
cipp_deploy_contact_templates |
Pro | Write | [CIPP] Bulk-deploy CIPP contact templates to create mail contacts across one or more tenants via POST /api/DeployContactTemplates. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). |
cipp_edit_contact |
Pro | Write | [CIPP] Edit an existing mail contact via POST /api/EditContact. The CIPP body uses MIXED casing — preserve verbatim: address fields are PascalCase ('City', 'Company', 'CountryOrRegion', 'LastName', 'PostalCode', 'State', 'StreetAddress', 'Title'), name/contact fields are camelCase ('displayName', 'email', 'firstName', 'mailTip', 'mobilePhone', 'phone', 'website'), the contact identifier is 'ContactID' (PascalCase, all-caps ID), the GAL flag is 'hidefromGAL' (specific casing), and the tenant ID is 'tenantID' (camel-ish, all-caps ID). The tenantFilter parameter is also placed on the query string by the client. |
cipp_edit_contact_template |
Pro | Write | [CIPP] Modify an existing CIPP contact template via POST /api/EditContactTemplates. The template is identified by 'ContactTemplateID' in the body (not the same key as live contact's 'ContactID'). Not tenant-scoped — this edits the CIPP-internal template store. CIPP body keys are MOSTLY camelCase per spec; preserve casing exactly. Use cipp_list_contact_templates to find the ContactTemplateID. |
cipp_edit_equipment_mailbox |
Pro | Write | [CIPP] Edit properties of an existing equipment mailbox via POST /api/EditEquipmentMailbox — display name, booking settings, calendar processing, location, and resource metadata. Endpoint is NOT tenant-scoped at the URL/query level; the destination tenant is identified by the body 'tenantID' field. |
cipp_edit_room_list |
Pro | Write | [CIPP] Modify an existing room list via POST /api/EditRoomList — rename it, add/remove member rooms, or update its delivery settings. The CIPP body reuses the underlying group-edit shape (PascalCase Add*/Remove* arrays + camelCase descriptive fields). tenantFilter is sent on BOTH the query string AND the body. |
cipp_edit_room_mailbox |
Pro | Write | [CIPP] Edit properties of an existing room mailbox via POST /api/EditRoomMailbox — display name, capacity, booking settings, calendar processing, location, and accessibility. Endpoint is NOT tenant-scoped at the URL/query level; the destination tenant is identified by the body 'tenantID' field. CIPP body uses MOSTLY PascalCase booking settings + camelCase location fields. |
cipp_list_contact_templates |
Free | Read-only | [CIPP] List CIPP contact templates from the CIPP template store via GET /api/ListContactTemplates. Returns template IDs and contact attribute payloads for reuse via cipp_deploy_contact_templates. Not tenant-scoped. The spec defines an optional 'id' query parameter; the underlying client wrapper does not currently surface it, so this tool always returns the full list. |
cipp_list_contacts |
Free | Read-only | [CIPP] List all mail contacts in a tenant. Returns display name, email address, and contact type for external contacts in the directory. |
cipp_list_equipment |
Free | Read-only | [CIPP] List all equipment mailboxes in a tenant. Equipment mailboxes represent bookable resources like projectors, vehicles, or conference phones. |
cipp_list_room_lists |
Free | Read-only | [CIPP] List room lists (groups of rooms) in a tenant. Room lists organize meeting rooms by floor, building, or location. |
cipp_list_rooms |
Free | Read-only | [CIPP] List all room mailboxes in a tenant. Returns room name, email address, capacity, and booking settings. |
cipp_remove_contact |
Pro | Write | [CIPP] Remove a mail contact via POST /api/RemoveContact. Permanently deletes the contact entry. The CIPP body uses 'GUID' (PascalCase, all-caps) for the contact identifier and 'Mail' (PascalCase) for the optional mail address — at least one of these is required to identify the contact. 'tenantFilter' (camelCase) is the only required body field and is also placed on the query string by the client. |
cipp_remove_contact_template |
Pro | Write | [CIPP] Permanently delete a CIPP contact template via POST /api/RemoveContactTemplates. Spec body: ; query also accepts ID. Destructive: removes the template only — already-deployed tenant contacts remain intact. Not tenant-scoped. Use cipp_list_contact_templates to find the template ID. |
cipp_add_contact parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
displayName |
string | yes | Display name for the contact. Sent as 'displayName' (camelCase). | |
email |
string | yes | External email address for the contact. Sent as 'email' (camelCase). | |
fieldsJson |
string | no | null | Optional additional fields as a JSON object. CIPP body keys (mixed casing, exact spec casing): camelCase strings — 'firstName', 'lastName', 'mobilePhone', 'phone', 'website', 'mailTip'. PascalCase strings — 'Title', 'Company', 'StreetAddress', 'City', 'State', 'PostalCode', 'CountryOrRegion'. Specific casing — 'hidefromGAL' (string, not boolean here), 'tenantid' (all-lowercase). Keys are passed verbatim and merged into the body — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string and added to the body as 'tenantFilter' by the tool. Use cipp_list_tenants to discover available tenants. |
cipp_add_contact_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Contact template fields as a JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): 'displayName' (camelCase string — typically required), 'email' (camelCase string — external email address; typically required), 'firstName' (camelCase string), 'lastName' (camelCase string), 'companyName' (camelCase string), 'jobTitle' (camelCase string), 'businessPhone' (camelCase string), 'mobilePhone' (camelCase string), 'mailTip' (camelCase string), 'website' (camelCase string), 'streetAddress' (camelCase string), 'city' (camelCase string), 'state' (camelCase string), 'postalCode' (camelCase string), 'country' (camelCase string), 'hidefromGAL' (boolean — NOTE the specific casing: lowercase 'hidefrom' + uppercase 'GAL'). Pass the full intended template body verbatim. |
cipp_add_equipment_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | yes | Display name for the equipment (e.g., 'Projector - Room 101'). Sent as 'displayName' (camelCase) per spec. | |
domain |
string | yes | Accepted domain for the mailbox (e.g., 'contoso.com'). Sent as the LabelValue object 'domain' = {label,value} per spec. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Used by the connector to route the request via the query string. Use cipp_list_tenants to discover available tenants. | |
tenantId |
string | yes | Tenant id (GUID) for the destination tenant. Sent as the body field 'tenantID' (camel-ish, all-caps ID) per spec — note this differs from AddRoomMailbox which uses lowercase 'tenantid'. | |
userPrincipalName |
string | yes | UPN for the new equipment mailbox (e.g., 'projector1@contoso.com'). Sent as 'userPrincipalName' (camelCase) per spec. | |
username |
string | yes | Mailbox alias / local-part before @ (e.g., 'projector1'). Sent as 'username' (lowercase) per spec. |
cipp_add_room_list parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Room list configuration as a JSON object. CIPP body keys (mostly camelCase, exact spec casing): 'displayName' (string, REQUIRED — name of the room list shown in Outlook), 'username' (string — mailbox alias / local-part for the list itself), 'tenantid' (string — tenant id GUID; ALL-LOWERCASE per spec), 'primDomain' (LabelValue {label, value} where value is the accepted domain to use, e.g. {"label":"contoso.com","value":"contoso.com"}). Note: there is no spec field for the initial member list — add rooms afterwards via cipp_edit_room_list. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string and added to the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_add_room_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
displayName |
string | yes | Display name for the room (e.g., 'Conference Room A - 2nd Floor'). Sent as 'DisplayName' (PascalCase). | |
domain |
string | no | null | Accepted domain to use for the mailbox (e.g., 'contoso.com'). Sent as the LabelValue object 'domain': {"label":<domain>,"value":<domain>}. |
resourceCapacity |
string | no | null | Resource capacity (number of seats). CIPP expects this as a STRING, not a number — pass '10' rather than 10. Sent as 'ResourceCapacity' (PascalCase). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as TenantFilter. Use cipp_list_tenants to discover available tenants. | |
tenantId |
string | no | null | Tenant ID GUID for the destination tenant. Sent as 'tenantid' (lowercase) per CIPP spec — distinct from the query-string TenantFilter. |
userPrincipalName |
string | no | null | User principal name (UPN) for the room mailbox (e.g., 'roomA@contoso.com'). Sent as 'userPrincipalName' (camelCase). Required by Exchange. |
username |
string | no | null | Mailbox alias / local-part (the part before @). Sent as 'username' (lowercase). |
cipp_deploy_contact_templates parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Deployment configuration as a JSON object. CIPP body keys (exact spec casing): 'TemplateList' (object with 'Count' string property — CIPP-internal template selection envelope; pass the value returned by cipp_list_contact_templates), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_edit_contact parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
city |
string | no | null | City. Sent as 'City' (PascalCase) per CIPP spec. |
company |
string | no | null | Company name. Sent as 'Company' (PascalCase) per CIPP spec. |
contactId |
string | yes | Contact identifier to edit. Sent as 'ContactID' (PascalCase, all-caps ID) per CIPP spec. Use cipp_list_contacts to find valid IDs. | |
countryOrRegion |
string | no | null | Country or region. Sent as 'CountryOrRegion' (PascalCase) per CIPP spec. |
displayName |
string | no | null | New display name. Sent as 'displayName' (camelCase). |
email |
string | no | null | Email address. Sent as 'email' (camelCase). |
firstName |
string | no | null | First name. Sent as 'firstName' (camelCase). |
hideFromGal |
boolean | no | null | Hide the contact from the Global Address List. Sent as 'hidefromGAL' (lowercase 'hidefrom' + uppercase 'GAL') per CIPP spec. |
lastName |
string | no | null | Last name. Sent as 'LastName' (PascalCase) per CIPP spec. |
mailTip |
string | no | null | MailTip text shown to senders in Outlook. Sent as 'mailTip' (camelCase). |
mobilePhone |
string | no | null | Mobile phone number. Sent as 'mobilePhone' (camelCase). |
phone |
string | no | null | Phone number. Sent as 'phone' (camelCase). |
postalCode |
string | no | null | Postal/zip code. Sent as 'PostalCode' (PascalCase) per CIPP spec. |
state |
string | no | null | State or province. Sent as 'State' (PascalCase) per CIPP spec. |
streetAddress |
string | no | null | Street address. Sent as 'StreetAddress' (PascalCase) per CIPP spec. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as TenantFilter. Use cipp_list_tenants to discover available tenants. | |
tenantId |
string | no | null | Tenant ID GUID. Sent as 'tenantID' (camel-ish with all-caps ID) per CIPP spec — distinct from the query-string TenantFilter. |
title |
string | no | null | Job title. Sent as 'Title' (PascalCase) per CIPP spec. |
website |
string | no | null | Website URL. Sent as 'website' (camelCase). |
cipp_edit_contact_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Updated contact template fields as a JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): 'ContactTemplateID' (PascalCase string — REQUIRED, the template identifier from cipp_list_contact_templates), 'displayName' (camelCase string), 'email' (camelCase string), 'firstName' (camelCase string), 'lastName' (camelCase string), 'companyName' (camelCase string), 'jobTitle' (camelCase string), 'businessPhone' (camelCase string), 'mobilePhone' (camelCase string), 'mailTip' (camelCase string), 'website' (camelCase string), 'streetAddress' (camelCase string), 'city' (camelCase string), 'state' (camelCase string), 'postalCode' (camelCase string), 'country' (camelCase string), 'hidefromGAL' (boolean — NOTE the specific casing: lowercase 'hidefrom' + uppercase 'GAL'). Only include fields you want to change; ContactTemplateID is required. |
cipp_edit_equipment_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Equipment mailbox update as a JSON object. CIPP body keys (exact spec casing): 'equipmentId' (string, REQUIRED — Exchange equipment mailbox identifier; camelCase), 'tenantID' (string — tenant id GUID; camel-ish with all-caps ID), 'userPrincipalName' (string), 'DisplayName' (string — PascalCase). Booking booleans (real JSON booleans, camelCase): 'allowConflicts', 'allowRecurringMeetings', 'forwardRequestsToDelegates', 'processExternalMeetingMessages', 'scheduleOnlyDuringWorkHours', 'hiddenFromAddressListsEnabled'. Booking strings (camelCase): 'automateProcessing', 'workDays', 'workHoursEndTime', 'workHoursStartTime', 'workingHoursTimeZone'. Booking integers: 'bookingWindowInDays', 'maximumDurationInMinutes'. Location fields (camelCase strings): 'city', 'company', 'countryOrRegion', 'department', 'phone', 'postalCode', 'stateOrProvince', 'streetAddress'. Other: 'tags' (array<string>). Note this endpoint uses largely camelCase, in contrast to EditRoomMailbox which uses PascalCase for its booking fields. |
cipp_edit_room_list parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Room list update as a JSON object. CIPP body keys (exact spec casing): 'groupId' (string, REQUIRED — Exchange room list identifier; camelCase). Membership arrays (PascalCase, array of UPN/email strings): 'AddMember', 'RemoveMember', 'AddOwner', 'RemoveOwner'. Descriptive fields (camelCase strings): 'displayName', 'description', 'mailNickname'. Other: 'allowExternal' (boolean). Only include the fields you want to change. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string and added to the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_edit_room_mailbox parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Room mailbox update as a JSON object. CIPP body keys (exact spec casing): 'roomId' (string, REQUIRED — Exchange room mailbox identifier; camelCase), 'tenantID' (string — tenant id GUID; camel-ish with all-caps ID), 'userPrincipalName' (string), 'DisplayName' (string — PascalCase). Booking booleans (real JSON booleans, all PascalCase): 'AddOrganizerToSubject', 'AllowConflicts', 'AllowRecurringMeetings', 'DeleteSubject', 'EnforceCapacity', 'ForwardRequestsToDelegates', 'ProcessExternalMeetingMessages', 'RemoveCanceledMeetings', 'ScheduleOnlyDuringWorkHours'. Booking strings (PascalCase): 'AutomateProcessing', 'WorkDays', 'WorkHoursEndTime', 'WorkHoursStartTime', 'WorkingHoursTimeZone'. Booking integers: 'BookingWindowInDays', 'MaximumDurationInMinutes'. Location/AV fields (camelCase strings): 'audioDeviceName', 'building', 'city', 'countryOrRegion', 'displayDeviceName', 'floorLabel', 'phone', 'postalCode', 'state', 'street', 'videoDeviceName'. Location integers: 'capacity', 'floor'. Accessibility booleans (camelCase): 'hiddenFromAddressListsEnabled', 'isWheelChairAccessible'. Other: 'tags' (array<string>). |
cipp_list_contacts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_equipment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_room_lists parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_rooms parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_contact parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
contactId |
string | no | null | Contact identifier to remove. Sent as 'GUID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_contacts to find valid IDs. Optional — provide either contactId or mail to identify the contact. |
mail |
string | no | null | Mail address of the contact to remove. Sent as 'Mail' (PascalCase) per CIPP spec. Optional — provide either contactId or mail to identify the contact. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_remove_contact_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | yes | Template identifier to remove. Sent in the body as 'ID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_contact_templates to find valid IDs. |
Transport & Spam
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_connection_filter |
Pro | Write | [CIPP] Create a new connection filter policy via POST /api/AddConnectionFilter. CIPP deploys the policy by running PowerShellCommand (a Set-HostedConnectionFilterPolicy command) against each tenant in selectedTenants. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). |
cipp_add_connection_filter_template |
Pro | Write | [CIPP] Save a connection filter policy as a reusable CIPP template via POST /api/AddConnectionFilterTemplate. This is a CIPP-internal template store, not a tenant action — no tenantFilter is required. The spec body is intentionally minimal: just the PowerShell command that defines the policy plus a name. |
cipp_add_edit_transport_rule |
Pro | Write | [CIPP] Add or edit a full Exchange transport rule via POST /api/AddEditTransportRule (the unified high-fidelity authoring endpoint, distinct from the thin cipp_add_transport_rule and cipp_edit_transport_rule). The body schema mirrors the Exchange Online New-TransportRule / Set-TransportRule cmdlets — almost every condition/exception/action parameter is a separate body key. Casing is PascalCase for Exchange parameters, camelCase for CIPP control flags. Set ruleId to update an existing rule; omit to create. Most string fields accept comma-separated lists or single values; *MemberOf fields accept group identifiers; *MatchesPatterns fields accept regex patterns. |
cipp_add_ex_connector_template |
Pro | Write | [CIPP] Save an Exchange connector configuration as a reusable CIPP template via POST /api/AddExConnectorTemplate. This is a CIPP-internal template store, not a tenant action — no tenantFilter is required. The spec body is intentionally minimal: {cippconnectortype:string, name:string}. Use cipp_list_ex_connector_templates to view stored templates. |
cipp_add_exchange_connector |
Pro | Write | [CIPP] Create a new Exchange connector for mail routing via POST /api/AddExConnector. CIPP deploys the connector by running a PowerShell New-InboundConnector / New-OutboundConnector command (passed verbatim in PowerShellCommand) against each tenant in selectedTenants. TemplateList is a LabelValue object referencing a saved connector template; if supplied, CIPP uses the template body and PowerShellCommand can be omitted. The body keys use the casing shown here (PascalCase PowerShellCommand/TemplateList, lowercase comment/selectedTenants) — preserve verbatim. |
cipp_add_quarantine_policy |
Pro | Write | [CIPP] Create a new quarantine policy via POST /api/AddQuarantinePolicy. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). Booleans (PascalCase) define end-user release/preview/block permissions; ReleaseActionPreference is a LabelValue object selecting the release behavior. |
cipp_add_spam_filter |
Pro | Write | [CIPP] Create a new spam filter policy via POST /api/AddSpamFilter. CIPP deploys the policy by running PowerShellCommand (a New-HostedContentFilterPolicy / Set-HostedContentFilterPolicy command) against each tenant in selectedTenants. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). |
cipp_add_spam_filter_template |
Pro | Write | [CIPP] Save a spam filter policy as a reusable CIPP template via POST /api/AddSpamFilterTemplate. This is a CIPP-internal template store, not a tenant action — no tenantFilter is required. The spec body is intentionally minimal: just the PowerShell command that defines the policy plus a name. Pair with cipp_list_spam_filter_templates to view stored templates. |
cipp_add_tenant_allow_block |
Pro | Write | [CIPP] Add entries to the Tenant Allow/Block List via POST /api/AddTenantAllowBlockList. listMethod and listType are LabelValue objects (sent as {label,value}). listType identifies the kind of entry (Sender / Url / FileHash) and listMethod identifies the action (Allow / Block). The tenant goes into a body key named tenantID (NOT tenantFilter — preserve casing verbatim). |
cipp_add_transport_rule |
Pro | Write | [CIPP] Create a new Exchange transport rule (mail flow rule) via POST /api/AddTransportRule. CIPP creates the rule by running a PowerShell New-TransportRule command (passed verbatim in PowerShellCommand) against each tenant in selectedTenants. PSObject is the rule definition object. TemplateList is a saved-template object reference. Spec body: {name (camelCase string), PSObject (PascalCase string), PowerShellCommand (PascalCase string), TemplateList (PascalCase object), selectedTenants (camelCase string)}. Use cipp_add_edit_transport_rule for full condition/action authoring; this tool is a thin name+payload wrapper. |
cipp_add_transport_rule_template |
Pro | Write | [CIPP] Save a transport (mail flow) rule as a reusable CIPP template via POST /api/AddTransportTemplate. This is a CIPP-internal template store, not a tenant action — no tenantFilter is required. The spec body is intentionally minimal: just the PowerShell command that creates the rule plus a name. Pair with cipp_list_transport_rules_templates to view stored templates. |
cipp_edit_anti_phishing_filter |
Pro | Write | [CIPP] Edit an anti-phishing filter policy via POST /api/EditAntiPhishingFilter. The spec body is narrow: only {RuleName (PascalCase string — the rule's policy name), State (PascalCase string — target rule state), tenantFilter (camelCase string, required)}. Query also accepts the same three keys; this tool emits them in the body. CIPP only supports state-toggle and rename-by-rule on this endpoint — to author full anti-phishing policy bodies use the Microsoft Graph / Exchange Online cmdlets directly. |
cipp_edit_exchange_connector |
Pro | Write | [CIPP] Edit an existing Exchange connector's configuration including routing, TLS settings, and address space. |
cipp_edit_malware_filter |
Pro | Write | [CIPP] Edit a malware filter policy via POST /api/EditMalwareFilter. The spec body is narrow: only {RuleName (PascalCase string — the rule's policy name), State (PascalCase string — target rule state), tenantFilter (camelCase string, required)}. Query also accepts the same three keys; this tool emits them in the body. CIPP only supports state-toggle and rename-by-rule on this endpoint — to author full malware policy bodies (file-type lists, ZAP, etc.) use the Microsoft Graph / Exchange Online cmdlets directly. |
cipp_edit_quarantine_policy |
Pro | Write | [CIPP] Edit an existing quarantine policy via POST /api/EditQuarantinePolicy. CRITICAL: this endpoint's body uses TenantFilter (PascalCase) — NOT camelCase tenantFilter. Most boolean-like fields are STRING ('true'/'false') not bool — preserve string casing as the spec lists them (string type, not boolean). Query also accepts tenantFilter (camelCase) and Type. |
cipp_edit_safe_attachments_filter |
Pro | Write | [CIPP] Edit a Safe Attachments (ATP) filter policy via POST /api/EditSafeAttachmentsFilter. The spec body is narrow: only {RuleName (PascalCase string — the rule's policy name), State (PascalCase string — target rule state), tenantFilter (camelCase string, required)}. Query also accepts the same three keys; this tool emits them in the body. CIPP only supports state-toggle and rename-by-rule on this endpoint — to author full Safe Attachments policy bodies (detonation mode, redirect URL, action) use the Microsoft Graph / Exchange Online cmdlets directly. |
cipp_edit_spam_filter |
Pro | Write | [CIPP] Edit a spam filter policy via POST /api/EditSpamFilter. The spec body is narrow: only {name, state}. tenantFilter and the policy name go on the query string, NOT in the body — name in the query selects the policy and the body's name/state describe the new values. Use cipp_list_spam_filters to discover policy names. |
cipp_edit_transport_rule |
Pro | Write | [CIPP] Edit an existing Exchange transport rule via POST /api/EditTransportRule. The rule is identified by its guid (NOT ruleId — preserve casing). Both guid and state are accepted on the query string AND in the body; this tool emits them in the body which is the canonical CIPP shape. Use cipp_list_transport_rules to discover guids. |
cipp_list_connection_filter_templates |
Free | Read-only | [CIPP] List saved connection filter policy templates. Returns template names and configured IP allow/block lists for reuse. |
cipp_list_connection_filters |
Free | Read-only | [CIPP] List connection filter policies for a tenant. Connection filters control which IP addresses are allowed or blocked from sending email to the tenant. |
cipp_list_ex_connector_templates |
Free | Read-only | [CIPP] List saved Exchange connector templates from the CIPP template store via GET /api/ListExConnectorTemplates. Returns template names, IDs, and connector configuration for reuse across tenants. Not tenant-scoped — these are CIPP-stored reusable templates. The spec defines an optional 'id' query parameter; the underlying client wrapper does not currently surface it, so this tool always returns the full list. |
cipp_list_exchange_connectors |
Free | Read-only | [CIPP] List all Exchange connectors for a tenant including inbound and outbound connectors, their type, status, and routing configuration. |
cipp_list_quarantine |
Free | Read-only | [CIPP] List quarantined email messages for a tenant. Returns message subject, sender, recipient, quarantine reason, and received date. |
cipp_list_quarantine_policy |
Free | Read-only | [CIPP] List quarantine policies for a tenant via POST /api/ListQuarantinePolicy. CRITICAL: this endpoint's body uses TenantFilter (PascalCase) — NOT camelCase tenantFilter. Spec body is minimal: {TenantFilter (PascalCase string)}. Query also accepts tenantFilter (camelCase) and Type. Returns policy names, end-user access settings, and notification configuration. |
cipp_list_spam_filter_templates |
Free | Read-only | [CIPP] List saved spam filter policy templates. Returns template names and configured settings for reuse across tenants. |
cipp_list_spam_filters |
Free | Read-only | [CIPP] List spam filter policies for a tenant including policy name, spam action thresholds, allowed/blocked senders, and content filtering settings. |
cipp_list_tenant_allow_block |
Free | Read-only | [CIPP] List entries in the Tenant Allow/Block List including blocked senders, URLs, and file hashes. |
cipp_list_transport_rules |
Free | Read-only | [CIPP] List all Exchange transport rules (mail flow rules) for a tenant. Returns rule name, priority, state, conditions, and actions. |
cipp_list_transport_rules_templates |
Free | Read-only | [CIPP] List saved transport (mail flow) rule templates from the CIPP template store via GET /api/ListTransportRulesTemplates. Returns template names, IDs, and the PowerShell command they will run when deployed. Not tenant-scoped — these are CIPP-stored reusable templates. The spec defines an optional 'id' query parameter; the underlying client wrapper does not currently surface it, so this tool always returns the full list. |
cipp_manage_quarantine |
Pro | Write | [CIPP] Manage a quarantined message via POST /api/ExecQuarantineManagement. The message is identified by Identity (PascalCase — preserve casing). Type (PascalCase) selects the action verb, and AllowSender (PascalCase) optionally allowlists the sender as part of a Release. Use cipp_list_quarantine to discover Identity values. |
cipp_remove_connection_filter_template |
Pro | Write | [CIPP] Permanently delete a connection filter policy template from the CIPP template store via POST /api/RemoveConnectionfilterTemplate (note: 'Connectionfilter' lowercase 'f' in the URL — preserve the underlying CIPP path). Spec body: . Destructive: removes the template only — tenant policies created from it remain intact. Use cipp_list_connection_filter_templates to find the template ID. Not tenant-scoped. |
cipp_remove_ex_connector_template |
Pro | Write | [CIPP] Permanently delete an Exchange connector template from the CIPP template store via POST /api/RemoveExConnectorTemplate. Spec body: ; query also accepts ID. Destructive: removes the template only — tenant connectors created from it remain intact. Use cipp_list_ex_connector_templates to find the template ID. Not tenant-scoped. |
cipp_remove_exchange_connector |
Pro | Write | [CIPP] Remove an Exchange connector. Use cipp_list_exchange_connectors first to find the connector ID. |
cipp_remove_quarantine_policy |
Pro | Write | [CIPP] Remove a quarantine policy via POST /api/RemoveQuarantinePolicy. CRITICAL: this endpoint's body uses TenantFilter (PascalCase) — NOT camelCase tenantFilter. Spec body: {Identity (PascalCase string — the quarantine policy Identity to remove), Name (PascalCase string), TenantFilter (PascalCase string)}. Query also accepts Identity, Name, and tenantFilter (camelCase). Use cipp_list_quarantine_policy first to find Identity. |
cipp_remove_spam_filter |
Pro | Write | [CIPP] Remove a spam filter policy via POST /api/RemoveSpamfilter (note: 'Spamfilter' lowercase 'f' in the URL — preserve the underlying CIPP path). Spec body is narrow: only {name (camelCase string — policy name)}. Query also accepts name and tenantFilter (camelCase). The body has NO tenantFilter — that travels exclusively on the query string. Use cipp_list_spam_filters first to find the policy name. WARNING: Removing a spam filter policy may expose the tenant to increased spam/phishing. |
cipp_remove_spam_filter_template |
Pro | Write | [CIPP] Permanently delete a spam filter policy template from the CIPP template store via POST /api/RemoveSpamfilterTemplate (note: 'Spamfilter' lowercase 'f' in the URL — preserve the underlying CIPP path). Spec body: . Destructive: removes the template only — tenant policies created from it remain intact. Use cipp_list_spam_filter_templates to find the template ID. Not tenant-scoped. |
cipp_remove_tenant_allow_block |
Pro | Write | [CIPP] Remove an entry from the Tenant Allow/Block List. Use cipp_list_tenant_allow_block first to find entries. |
cipp_remove_transport_rule |
Pro | Write | [CIPP] Remove an Exchange transport rule via POST /api/RemoveTransportRule. The rule is identified by its guid (NOT ruleId — preserve casing). Use cipp_list_transport_rules first to find the guid. WARNING: Deleting a transport rule takes effect immediately and may affect mail flow. |
cipp_remove_transport_rule_template |
Pro | Write | [CIPP] Permanently delete a transport rule template from the CIPP template store via POST /api/RemoveTransportRuleTemplate. Spec body: ; query also accepts ID. Destructive: removes the template only — tenant rules created from it remain intact. Use cipp_list_transport_rules_templates to find the template ID. Not tenant-scoped. |
cipp_add_connection_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Connection filter configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): PowerShellCommand (PascalCase string — full Set-HostedConnectionFilterPolicy / New-HostedConnectionFilterPolicy command, e.g., 'Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @'), TemplateList (PascalCase object — saved template reference, LabelValue {label, value} shape), selectedTenants (camelCase string — comma-separated tenant domains, identifies target tenants). NOTE: this endpoint does NOT take tenantFilter — use selectedTenants instead. |
cipp_add_connection_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
name |
string | yes | Template name shown in CIPP. Sent in the body as 'name' (camelCase per spec). | |
powerShellCommand |
string | yes | Full PowerShell command that configures the connection filter policy when this template is later deployed (e.g., 'Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @'). Sent in the body as 'PowerShellCommand' (PascalCase per spec). |
cipp_add_edit_transport_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Transport rule definition as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY). Identity & meta: ruleId (camelCase string — set to update an existing rule, omit to create), Name (PascalCase string), Comments (PascalCase string), Priority (PascalCase number), State (PascalCase string), Mode (PascalCase object), Enabled (PascalCase boolean), StopRuleProcessing (PascalCase boolean), ActivationDate (PascalCase string date-time), ExpiryDate (PascalCase string date-time), applyToAllMessages (camelCase boolean), conditionType (camelCase array<string>), exceptionType (camelCase array<string>), actionType (camelCase array<string>), Count (PascalCase string), value (camelCase string). Sender/recipient conditions: From (PascalCase string), FromMemberOf (PascalCase string), FromScope (PascalCase string), FromAddressContainsWords (PascalCase string), FromAddressMatchesPatterns (PascalCase string), SentTo (PascalCase string), SentToMemberOf (PascalCase string), SentToScope (PascalCase string), AnyOfToHeader (PascalCase string), AnyOfToHeaderMemberOf (PascalCase string), AnyOfToCcHeader (PascalCase string), AnyOfToCcHeaderMemberOf (PascalCase string), AnyOfCcHeader (PascalCase string), AnyOfCcHeaderMemberOf (PascalCase string), AnyOfRecipientAddressContainsWords (PascalCase string), AnyOfRecipientAddressMatchesPatterns (PascalCase string), RecipientAddressContainsWords (PascalCase string), RecipientAddressMatchesPatterns (PascalCase string), RecipientDomainIs (PascalCase string), SenderDomainIs (PascalCase string), SenderIpRanges (PascalCase string), SenderAddressLocation (PascalCase object). Subject/body/header conditions: SubjectContainsWords (PascalCase string), SubjectMatchesPatterns (PascalCase string), SubjectOrBodyContainsWords (PascalCase string), SubjectOrBodyMatchesPatterns (PascalCase string), HeaderContainsWords (PascalCase string), HeaderContainsWordsMessageHeader (PascalCase string), HeaderMatchesPatterns (PascalCase string), HeaderMatchesPatternsMessageHeader (PascalCase string). Attachment conditions: AttachmentContainsWords (PascalCase string), AttachmentExtensionMatchesWords (PascalCase string), AttachmentHasExecutableContent (PascalCase string), AttachmentIsPasswordProtected (PascalCase string), AttachmentIsUnsupported (PascalCase string), AttachmentMatchesPatterns (PascalCase string), AttachmentNameMatchesPatterns (PascalCase string), AttachmentProcessingLimitExceeded (PascalCase string), AttachmentPropertyContainsWords (PascalCase string), AttachmentSizeOver (PascalCase string). Other conditions: MessageSizeOver (PascalCase string), MessageTypeMatches (PascalCase string), SCLOver (PascalCase string), WithImportance (PascalCase string). Exceptions (every condition has an ExceptIf-prefixed twin — preserve casing and PascalCase): ExceptIfFrom, ExceptIfFromMemberOf, ExceptIfFromScope, ExceptIfFromAddressContainsWords, ExceptIfFromAddressMatchesPatterns, ExceptIfSentTo, ExceptIfSentToMemberOf, ExceptIfSentToScope, ExceptIfAnyOfToHeader, ExceptIfAnyOfToHeaderMemberOf, ExceptIfAnyOfToCcHeader, ExceptIfAnyOfToCcHeaderMemberOf, ExceptIfAnyOfCcHeader, ExceptIfAnyOfCcHeaderMemberOf, ExceptIfAnyOfRecipientAddressContainsWords, ExceptIfAnyOfRecipientAddressMatchesPatterns, ExceptIfRecipientAddressContainsWords, ExceptIfRecipientAddressMatchesPatterns, ExceptIfRecipientDomainIs, ExceptIfSenderDomainIs, ExceptIfSenderIpRanges, ExceptIfSubjectContainsWords, ExceptIfSubjectMatchesPatterns, ExceptIfSubjectOrBodyContainsWords, ExceptIfSubjectOrBodyMatchesPatterns, ExceptIfHeaderContainsWords, ExceptIfHeaderContainsWordsMessageHeader, ExceptIfHeaderMatchesPatterns, ExceptIfHeaderMatchesPatternsMessageHeader, ExceptIfAttachmentContainsWords, ExceptIfAttachmentExtensionMatchesWords, ExceptIfAttachmentHasExecutableContent, ExceptIfAttachmentIsPasswordProtected, ExceptIfAttachmentIsUnsupported, ExceptIfAttachmentMatchesPatterns, ExceptIfAttachmentNameMatchesPatterns, ExceptIfAttachmentProcessingLimitExceeded, ExceptIfAttachmentPropertyContainsWords, ExceptIfAttachmentSizeOver, ExceptIfMessageSizeOver, ExceptIfMessageTypeMatches, ExceptIfSCLOver, ExceptIfWithImportance. Actions: ApplyClassification (PascalCase string), ApplyHtmlDisclaimerFallbackAction (PascalCase object), ApplyHtmlDisclaimerLocation (PascalCase object), ApplyHtmlDisclaimerText (PascalCase string), ApplyOME (PascalCase string), BlindCopyTo (PascalCase string), CopyTo (PascalCase string), DeleteMessage (PascalCase string), GenerateIncidentReport (PascalCase string), GenerateNotification (PascalCase string), IncidentReportContent (PascalCase array of LabelValue {label, value} objects — preserve {label,value} shape verbatim per item), ModerateMessageByManager (PascalCase string), ModerateMessageByUser (PascalCase string), PrependSubject (PascalCase string), Quarantine (PascalCase string), RedirectMessageTo (PascalCase string), RejectMessageEnhancedStatusCode (PascalCase string), RejectMessageReasonText (PascalCase string), RemoveHeader (PascalCase string), RouteMessageOutboundConnector (PascalCase string), SetAuditSeverity (PascalCase object), SetHeaderName (PascalCase string), SetHeaderValue (PascalCase string), SetSCL (PascalCase string). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_add_ex_connector_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
cippConnectorType |
string | yes | Connector type identifier. Sent in the body as 'cippconnectortype' (all-lowercase per spec). Common values: 'Inbound' / 'Outbound' (matches the Exchange connector kind being captured). | |
name |
string | yes | Template name shown in CIPP. Sent in the body as 'name' (camelCase per spec). |
cipp_add_exchange_connector parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
comment |
string | no | null | Optional: free-form comment recorded in the CIPP audit log alongside the deployment. |
powerShellCommand |
string | no | null | Optional: full PowerShell command to deploy the connector (e.g., 'New-InboundConnector -Name "Inbound from Partner" -SenderDomains *.partner.com'). Either this or templateLabel must be provided. |
selectedTenants |
string | no | null | Optional: comma-separated list of tenant domains to deploy the connector to. When omitted, CIPP applies to the tenantFilter tenant only. |
templateLabel |
string | no | null | Optional: label of a saved connector template (LabelValue.label). When set, CIPP looks up the template by label/value and uses its stored connector body. Pair with templateValue. |
templateValue |
string | no | null | Optional: value/id of the saved connector template (LabelValue.value). Pair with templateLabel. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Used as the tenantFilter query-string parameter. Use cipp_list_tenants to discover available tenants. |
cipp_add_quarantine_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Quarantine policy configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): Name (PascalCase string — policy name), AllowSender (PascalCase boolean — allow end-users to allowlist sender on release), BlockSender (PascalCase boolean — allow end-users to blocklist sender), Delete (PascalCase boolean — allow delete from quarantine), Preview (PascalCase boolean — allow preview of quarantined message), QuarantineNotification (PascalCase boolean — enable end-user notification emails), IncludeMessagesFromBlockedSenderAddress (PascalCase boolean), ReleaseActionPreference (object — LabelValue {label, value} object selecting the release approval flow), TemplateList (object — saved template reference, LabelValue {label, value} shape), selectedTenants (camelCase string — comma-separated tenant domains, identifies target tenants). NOTE: this endpoint does NOT take tenantFilter — use selectedTenants instead. |
cipp_add_spam_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Spam filter configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): name (camelCase string — policy display name), Priority (PascalCase string — priority value relative to other policies), PowerShellCommand (PascalCase string — full New-HostedContentFilterPolicy / Set-HostedContentFilterPolicy command to execute), TemplateList (PascalCase object — saved template reference, LabelValue {label, value} shape), selectedTenants (camelCase string — comma-separated tenant domains, identifies target tenants). NOTE: this endpoint does NOT take tenantFilter — use selectedTenants instead. |
cipp_add_spam_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
name |
string | yes | Template name shown in CIPP. Sent in the body as 'name' (camelCase per spec). | |
powerShellCommand |
string | yes | Full PowerShell command that creates the spam filter policy when this template is later deployed (e.g., 'New-HostedContentFilterPolicy -Name "Strict Spam" -SpamAction Quarantine'). Sent in the body as 'PowerShellCommand' (PascalCase per spec). |
cipp_add_tenant_allow_block parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
entries |
string | yes | Entries to add (e.g., sender addresses, URLs, or file hashes). For multiple entries, send a comma-separated string per CIPP convention. | |
listMethod |
string | no | null | Action to apply. Sent as the LabelValue object {"label":<listMethod>,"value":<listMethod>}. Common values: 'Allow', 'Block'. |
listType |
string | yes | Type of entry being added. Sent as the LabelValue object {"label":<listType>,"value":<listType>}. Common values: 'Sender', 'Url', 'FileHash'. | |
noExpiration |
boolean | no | null | If true, the entry never expires. If false (or omitted), CIPP applies its default expiration policy. |
notes |
string | no | null | Free-form notes recorded against the entry in Microsoft 365. |
removeAfter |
boolean | no | null | If true, schedule the entry for automatic removal at the end of CIPP's default lifetime window. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Used as the tenantFilter query-string parameter AND emitted in the body as tenantID. Use cipp_list_tenants to discover available tenants. |
cipp_add_transport_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Rule configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): PSObject (PascalCase string — full serialized rule object), PowerShellCommand (PascalCase string — the New-TransportRule command to execute, e.g., 'New-TransportRule -Name "Block External" -FromScope NotInOrganization -PrependSubject "[EXT]"'), TemplateList (PascalCase object — saved template reference, LabelValue {label, value} shape), selectedTenants (camelCase string — comma-separated tenant domains to target; defaults to the single tenantFilter tenant). Tool injects name and tenantFilter from the typed parameters — do NOT duplicate those keys. | |
name |
string | yes | Name for the new transport rule. Sent in the body as name (camelCase). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_add_transport_rule_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
name |
string | yes | Template name shown in CIPP. Sent in the body as 'name' (camelCase per spec). | |
powerShellCommand |
string | yes | Full PowerShell command that creates the transport rule when this template is later deployed (e.g., 'New-TransportRule -Name "Block External" -FromScope NotInOrganization -PrependSubject "[EXT]"'). Sent in the body as 'PowerShellCommand' (PascalCase per spec). |
cipp_edit_anti_phishing_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter settings as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): RuleName (PascalCase string — the anti-phishing rule policy name to update), State (PascalCase string — target rule state, common values 'Enabled' or 'Disabled'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_edit_exchange_connector parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Connector settings as JSON object (e.g., {"connectorId": "...", "smartHosts": ["mail.contoso.com"]}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_edit_malware_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter settings as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): RuleName (PascalCase string — the malware filter rule policy name to update), State (PascalCase string — target rule state, common values 'Enabled' or 'Disabled'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_edit_quarantine_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Quarantine policy settings as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY, note these are mostly TYPE STRING per the spec, not boolean): Identity (PascalCase string — the quarantine policy GUID/Identity to edit; required), Name (PascalCase string), Action (PascalCase string), AllowSender (PascalCase string — 'true' or 'false'), BlockSender (PascalCase string — 'true' or 'false'), Delete (PascalCase string — 'true' or 'false'), Preview (PascalCase string — 'true' or 'false'), QuarantineNotification (PascalCase string), IncludeMessagesFromBlockedSenderAddress (PascalCase string), OrganizationBrandingEnabled (PascalCase string), EndUserSpamNotificationFrequency (PascalCase string — frequency per Exchange Online spec, e.g., '04:00:00'), EndUserSpamNotificationCustomFromAddress (PascalCase string), ReleaseActionPreference (PascalCase string), TenantFilter (PascalCase string — the tenant key on this endpoint is PascalCase, NOT camelCase). Tool injects camelCase tenantFilter; pass TenantFilter explicitly here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter. The body's tenant field is TenantFilter (PascalCase) — pass it explicitly via fieldsJson if camelCase tenantFilter (which the tool injects) is silently dropped on this endpoint. Use cipp_list_tenants to discover available tenants. |
cipp_edit_safe_attachments_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter settings as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): RuleName (PascalCase string — the Safe Attachments rule policy name to update), State (PascalCase string — target rule state, common values 'Enabled' or 'Disabled'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_edit_spam_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
name |
string | no | null | Optional: spam filter policy name in the body. CIPP uses this to update the policy display name. |
state |
string | no | null | Optional: target state of the policy (e.g., 'Enabled' or 'Disabled'). Sent in the body as state. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter (required). Use cipp_list_tenants to discover available tenants. |
cipp_edit_transport_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
guid |
string | yes | GUID of the transport rule to edit. Use cipp_list_transport_rules to find valid GUIDs. | |
state |
string | no | null | Optional: target state of the rule (e.g., 'Enabled', 'Disabled'). Sent in the body as state. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body. Use cipp_list_tenants to discover available tenants. |
cipp_list_connection_filters parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_exchange_connectors parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_quarantine parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_quarantine_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional filter configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): TenantFilter (PascalCase string — note PascalCase here, NOT camelCase; pass explicitly when camelCase tenantFilter from the tool is silently dropped). Pass null or empty object if no body customization is needed. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter. The body's tenant field is TenantFilter (PascalCase) — pass it explicitly via fieldsJson if camelCase tenantFilter (which the tool injects) is silently dropped on this endpoint. Use cipp_list_tenants to discover available tenants. |
cipp_list_spam_filters parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_transport_rules parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_manage_quarantine parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
allowSender |
string | no | null | Optional: when set, the sender is added to the user's allowlist as part of a Release operation. Sent in the body as AllowSender (PascalCase). |
identity |
string | yes | Quarantine message Identity. Use cipp_list_quarantine to find valid identities. Sent in the body as Identity (PascalCase). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body. Use cipp_list_tenants to discover available tenants. | |
type |
string | yes | Action verb for the quarantined message (e.g., 'Release', 'Deny', 'Delete'). Sent in the body as Type (PascalCase). |
cipp_remove_connection_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | yes | Template identifier to remove. Sent in the body as 'ID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_connection_filter_templates to find valid IDs. |
cipp_remove_ex_connector_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | yes | Template identifier to remove. Sent in the body as 'ID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_ex_connector_templates to find valid IDs. |
cipp_remove_exchange_connector parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Connector removal configuration as JSON object (e.g., {"connectorId": "..."}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_quarantine_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): Identity (PascalCase string — the quarantine policy Identity to remove), Name (PascalCase string — the quarantine policy display name), TenantFilter (PascalCase string — note PascalCase here, NOT camelCase). Tool injects camelCase tenantFilter; pass TenantFilter explicitly here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter. The body's tenant field is TenantFilter (PascalCase) — pass it explicitly via fieldsJson if camelCase tenantFilter (which the tool injects) is silently dropped on this endpoint. Use cipp_list_tenants to discover available tenants. |
cipp_remove_spam_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Spam filter removal configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): name (camelCase string — the spam filter policy name to remove). NOTE: do NOT include 'tenantFilter' in the body for this endpoint; the spec body has no tenantFilter field. The tenant must travel via the query string. |
cipp_remove_spam_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | yes | Template identifier to remove. Sent in the body as 'ID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_spam_filter_templates to find valid IDs. |
cipp_remove_tenant_allow_block parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Entry removal configuration as JSON object (e.g., {"id": "...", "listType": "Sender"}). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_transport_rule parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
guid |
string | yes | GUID of the transport rule to remove. Use cipp_list_transport_rules to find valid GUIDs. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body. Use cipp_list_tenants to discover available tenants. |
cipp_remove_transport_rule_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
id |
string | yes | Template identifier to remove. Sent in the body as 'ID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_transport_rules_templates to find valid IDs. |
Devices
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_get_device_details |
Free | Read-only | [CIPP] Get detailed information for a specific Intune device including hardware, OS version, compliance, and encryption status. Use cipp_list_devices first to find the device ID. |
cipp_list_app_protection |
Free | Read-only | [CIPP] List Intune app protection policies (MAM) for a tenant. Returns policy names, platform, settings, and targeted apps. |
cipp_list_app_status |
Free | Read-only | [CIPP] List Intune application install status across devices via GET /api/ListAppStatus. Returns per-device install state for managed applications. Spec query parameters: AppFilter (PascalCase, optional — narrows to a single app or app type) and tenantFilter (camelCase, required in spec); the underlying client method does not currently forward any query args, so this tool returns the unfiltered list scoped by the connector's default tenant context. Use cipp_list_apps to enumerate the catalog and cipp_list_detected_apps for devices' detected (not necessarily managed) applications. |
cipp_list_apps |
Free | Read-only | [CIPP] List Intune-managed applications for a tenant. Returns app names, types, assignment status, and install counts. |
cipp_list_assignment_filter_templates |
Free | Read-only | [CIPP] List saved Intune assignment-filter TEMPLATES (the reusable definitions, not tenant-deployed filters) via GET /api/ListAssignmentFilterTemplates. Templates are MSP-scoped — there is NO tenantFilter on this endpoint. Spec query supports an optional ID parameter to fetch a single template; the underlying client method does not currently forward any query arg, so this tool returns the full list. Use cipp_list_assignment_filters to inspect filters that have been deployed to a specific tenant. |
cipp_list_assignment_filters |
Free | Read-only | [CIPP] List Intune assignment filters. Returns filter names, rules, and platforms used for refining policy assignments. |
cipp_list_autopilot_configs |
Free | Read-only | [CIPP] List Windows Autopilot deployment profiles and configuration settings for a tenant. |
cipp_list_autopilot_devices |
Free | Read-only | [CIPP] List all Windows Autopilot registered devices for a tenant. Returns serial number, model, group tag, and enrollment profile. |
cipp_list_compliance_policies |
Free | Read-only | [CIPP] List Intune device compliance policies for a tenant. Returns policy names, settings, and assignment targets. |
cipp_list_defender_state |
Free | Read-only | [CIPP] List Microsoft Defender for Endpoint device status for a tenant. Returns protection state, engine version, and last scan time. |
cipp_list_defender_tvm |
Free | Read-only | [CIPP] List Microsoft Defender Threat & Vulnerability Management data for a tenant. Returns vulnerability scores, recommendations, and exposed devices. |
cipp_list_detected_app_devices |
Free | Read-only | [CIPP] List devices where a specific detected application is installed. Returns device names, OS versions, and user associations. |
cipp_list_detected_apps |
Free | Read-only | [CIPP] List applications detected on Intune-managed devices for a tenant. Returns app names, versions, and device counts. |
cipp_list_devices |
Free | Read-only | [CIPP] List all Intune-managed devices for a tenant. Returns device ID, name, OS, compliance state, and last check-in time. |
cipp_list_intune_intents |
Free | Read-only | [CIPP] List Intune security baseline intents (e.g., Endpoint Security policies). Returns intent names, categories, and assigned settings. |
cipp_list_intune_policies |
Free | Read-only | [CIPP] List Intune device configuration policies for a tenant. Returns policy types, settings, and assignments. |
cipp_list_intune_reusable_setting_templates |
Free | Read-only | [CIPP] List saved Intune reusable-setting TEMPLATES (the reusable definitions, not tenant-deployed reusable settings) via GET /api/ListIntuneReusableSettingTemplates. Templates are MSP-scoped — there is NO tenantFilter on this endpoint. Spec query supports an optional ID parameter to fetch a single template; the underlying client method does not currently forward any query arg, so this tool returns the full list. Use cipp_list_intune_reusable_settings to inspect reusable settings deployed in a specific tenant. |
cipp_list_intune_reusable_settings |
Free | Read-only | [CIPP] List reusable settings defined in Intune. Returns setting names, values, and which policies reference them. |
cipp_list_intune_scripts |
Free | Read-only | [CIPP] List Intune PowerShell and remediation scripts deployed to a tenant. |
cipp_list_intune_templates |
Free | Read-only | [CIPP] List saved Intune policy TEMPLATES (the reusable definitions, not tenant-deployed policies) via GET /api/ListIntuneTemplates. Templates are MSP-scoped — there is NO tenantFilter on this endpoint. Spec query supports optional id (lowercase, single template), mode (string), and View (PascalCase) parameters; the underlying client method does not currently forward any query args, so this tool returns the full list. Use cipp_list_intune_policies to inspect device-configuration policies deployed in a specific tenant. |
cipp_get_device_details parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
deviceId |
string | yes | The Intune device ID. Use cipp_list_devices to find valid IDs. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_app_protection parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_apps parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_autopilot_configs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_autopilot_devices parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_compliance_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_defender_state parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_defender_tvm parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_detected_apps parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_devices parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_intune_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_intune_scripts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
Device Management
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_assignment_filter |
Pro | Write | [CIPP] Create a new Intune assignment filter via POST /api/AddAssignmentFilter. Filters refine policy and app assignments based on device properties. Tool injects tenantFilter (camelCase) into the body — caller supplies the rest in fieldsJson. |
cipp_add_assignment_filter_template |
Pro | Write | [CIPP] Create a saved Intune assignment-filter TEMPLATE (the reusable definition, not a tenant-deployed filter) via POST /api/AddAssignmentFilterTemplate. Spec body keys (case-sensitive — preserve EXACTLY): GUID (PascalCase string — template identifier), assignmentFilterManagementType (camelCase string — enum: 'devices' | 'apps'), platform (camelCase string — Intune platform name, e.g. 'windows10AndLater', 'iOS', 'android'), rule (camelCase string — the filter rule expression), displayname (lowercase 'n' — NOT 'displayName' or 'DisplayName'), Description (PascalCase). NOTE: this endpoint does NOT take tenantFilter — templates are MSP-scoped, not tenant-scoped. |
cipp_add_autopilot_config |
Pro | Write | [CIPP] Create a new Windows Autopilot deployment profile via POST /api/AddAutopilotConfig. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). Body mixes PascalCase OOBE flags with camelCase deployment toggles — preserve exactly. |
cipp_add_autopilot_device |
Pro | Write | [CIPP] Register one or more devices in Windows Autopilot via POST /api/AddAPDevice. autopilotData is a CSV/JSON string of the hardware hash payload as exported from Get-WindowsAutoPilotInfo (one or many devices in a single call). Groupname is an optional Azure AD group to add the registered devices to. The body uses PascalCase TenantFilter and Groupname (preserve casing). |
cipp_add_defender_deployment |
Pro | Write | [CIPP] Deploy Microsoft Defender for Endpoint baseline to a list of tenants via POST /api/AddDefenderDeployment. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). Includes ASR rule deployment, EDR/compliance/exclusion blocks, platform connectors, and toggles for the Defender setup wizard sections. |
cipp_add_enrollment |
Pro | Write | [CIPP] Create a new Enrollment Status Page (ESP) / device enrollment configuration via POST /api/AddEnrollment. Endpoint operates on a multi-tenant payload: target tenants are passed in selectedTenants (NOT tenantFilter — there is no tenantFilter field on this body). Body mixes PascalCase ESP toggles with camelCase blockDevice flag. |
cipp_add_intune_reusable_setting |
Pro | Write | [CIPP] Create a reusable setting for Intune policies via POST /api/AddIntuneReusableSetting. Spec body keys (case-sensitive): displayName (camelCase string), description (camelCase string), rawJSON (camelCase 'rawJSON' string — the serialized Intune reusable-setting graph payload), TemplateId (PascalCase string), TemplateList (PascalCase string), ID (uppercase string), tenantFilter (camelCase, required). Query also accepts tenantFilter and TemplateId. Reusable settings can be referenced across multiple policies. |
cipp_add_intune_reusable_setting_template |
Pro | Write | [CIPP] Create a saved Intune reusable-setting TEMPLATE via POST /api/AddIntuneReusableSettingTemplate. The body schema is wide and contains both PascalCase and camelCase variants of the same conceptual fields (e.g. both 'displayName' and 'DisplayName' are listed) — preserve whichever variant the CIPP backend selects from. tenantFilter is REQUIRED in the body (camelCase). Spec body keys (case-sensitive — preserve EXACTLY): tenantFilter (camelCase, required), GUID (PascalCase string — template identifier), displayName (camelCase), DisplayName (PascalCase variant), displayname (lowercase 'n' variant), description (camelCase), Description (PascalCase variant), rawJSON (camelCase 'rawJSON' — the serialized reusable-setting graph payload), RawJSON (PascalCase variant), json (camelCase 'json' alias), package (camelCase string). |
cipp_add_intune_template |
Pro | Write | [CIPP] Create a saved Intune policy TEMPLATE via POST /api/AddIntuneTemplate. The query string accepts ID, ODataType, tenantFilter, URLName; the body accepts the same plus body-only fields. tenantFilter is REQUIRED in the body (camelCase). Spec body keys (case-sensitive — preserve EXACTLY): tenantFilter (camelCase, required), description (camelCase), displayName (camelCase), ID (uppercase string — the source policy GUID being templatized), ODataType (PascalCase string — Microsoft Graph @odata.type of the source resource), policySource (LabelValue object — typically wrapped {label, value}), RawJSON (PascalCase string — the serialized policy graph payload), TemplateType (PascalCase string — high-level template category), URLName (PascalCase string — Microsoft Graph URL segment for the resource type, e.g. 'deviceConfigurations'). |
cipp_add_policy |
Pro | Write | [CIPP] Create a new Intune device configuration or compliance policy via POST /api/AddPolicy. Body keys (preserve EXACT casing): TemplateType, TemplateID, TemplateGUID, displayName, Description, RAWJson (note ALL-CAPS), AssignTo, AssignmentFilterName, assignmentFilter, assignmentFilterType, customGroup, excludeGroup, replacemap, reusableSettings, Count. tenantFilter (camelCase) is required and goes in the body. The policy payload itself is passed verbatim as RAWJson — usually exported from another tenant or built from a template. |
cipp_assign_autopilot_device |
Pro | Write | [CIPP] Assign an Autopilot device to a deployment profile and optionally a user via POST /api/ExecAssignAPDevice. Spec body: {device (camelCase string — Autopilot device GUID), serialNumber (camelCase string — alternative identifier when device GUID is unknown), user (camelCase string — UPN of the user to associate), tenantFilter (camelCase, required)}. All keys are camelCase on this endpoint. |
cipp_assign_policy |
Pro | Write | [CIPP] Assign an Intune policy to groups, users, or all devices via POST /api/ExecAssignPolicy. Body keys (case-sensitive): ID (uppercase — the policy GUID), Type (PascalCase), AssignTo (PascalCase — common values 'AllDevices', 'AllUsers', 'On', 'allLicensedUsers', 'AllDevicesAndUsers', 'customGroup'), assignmentMode (camelCase — 'Include' or 'Exclude'), GroupIds (PascalCase — comma-separated GUIDs), GroupNames (PascalCase), AssignmentFilterName (PascalCase), AssignmentFilterType (PascalCase), customGroup (camelCase), excludeGroup (camelCase), platformType (camelCase), tenantFilter (camelCase, required). |
cipp_delete_assignment_filter |
Pro | Write | [CIPP] Delete an Intune assignment filter via DELETE /api/ExecAssignmentFilter. Spec marks the body required with required camelCase 'tenantFilter'. Optional body keys: 'Action' (PascalCase), 'ID' (uppercase, the assignment filter identifier). Policies using this filter will lose their filter-based targeting. |
cipp_device_action |
Pro | Write | [CIPP] Execute a remote action on an Intune device via POST /api/ExecDeviceAction. The device is identified by GUID (PascalCase — preserve casing) and the verb is sent as Action (PascalCase). Valid actions: syncDevice, rebootNow, wipe, retire, remoteLock, rotateLocalAdminPassword, windowsDefenderScan, windowsDefenderUpdateSignatures, rotateBitLockerKeys. Use cipp_list_devices first to find GUIDs. WARNING: Some actions like 'wipe' and 'retire' are irreversible and will erase device data. Use 'syncDevice' or 'rebootNow' for non-destructive actions. |
cipp_device_passcode_action |
Pro | Write | [CIPP] Execute a passcode-related action on an Intune device via POST /api/ExecDevicePasscodeAction. Spec body: {Action (PascalCase string), GUID (PascalCase string — device GUID), tenantFilter (camelCase string, required)}. WARNING: passcode actions take effect immediately on the device. |
cipp_edit_assignment_filter |
Pro | Write | [CIPP] Edit an existing Intune assignment filter via POST /api/EditAssignmentFilter. Tool injects tenantFilter (camelCase) into the body — caller supplies the rest in fieldsJson. CIPP requires filterId to identify which filter to update. |
cipp_edit_intune_policy |
Pro | Write | [CIPP] Edit an existing Intune device configuration or compliance policy via POST /api/EditIntunePolicy. The spec body is narrow: {ID (string), policyType (string), newDisplayName (string), tenantFilter (string)}. tenantFilter is also accepted on the query string AND in the body — this tool injects it into both. ID, policyType, and newDisplayName are body-only. |
cipp_edit_intune_script |
Pro | Write | [CIPP] Edit an existing Intune PowerShell or remediation script via PATCH /api/EditIntuneScript (note: PATCH verb, not POST). Spec body keys (case-sensitive): IntuneScript (PascalCase — the new script content), ScriptId (PascalCase), ScriptType (PascalCase — Microsoft Graph script resource type), TenantFilter (PascalCase — NOT camelCase). Query also accepts ScriptId and tenantFilter (camelCase on the query side). The body uses TenantFilter PascalCase even though the query uses camelCase tenantFilter. |
cipp_edit_policy |
Pro | Write | [CIPP] Edit a device policy via POST /api/EditPolicy (a thin update endpoint distinct from cipp_edit_intune_policy). Spec body keys (case-sensitive — preserve EXACTLY): Assignto (lowercase 't' — NOT AssignTo), Description, Displayname (lowercase 'n' — NOT DisplayName), groupid (all lowercase), tenantid (all lowercase — NOT tenantFilter). NOTE: this endpoint does NOT take tenantFilter — the target tenant is identified by the lowercase tenantid body key. Casing is highly inconsistent: callers MUST mirror exactly. |
cipp_exec_bitlocker_search |
Pro | Write | [CIPP] Search for BitLocker recovery keys across a tenant via POST /api/ExecBitlockerSearch. This endpoint is in the LIVE CIPP spec but absent from the checked-in CIPP-API.json (live spec drift) — verify the response shape against the live tenant if behavior diverges. Spec query AND body each accept the same four fields: deviceId (camelCase string — Intune device GUID; filter by a single device), keyId (camelCase string — recovery-key GUID; lookup a specific key), limit (camelCase string — STRING-typed numeric cap on results), tenantFilter (camelCase, required in body). The tool sends tenantFilter on both the query string and the body per the live spec; deviceId/keyId/limit are sent only in the body. |
cipp_get_local_admin_password |
Pro | Write | [CIPP] Retrieve the LAPS (Local Administrator Password Solution) password for a specific Intune device via POST /api/ExecGetLocalAdminPassword. The body uses PascalCase TenantFilter and lowercase guid (mixed casing per spec — preserve verbatim). Use cipp_list_devices first to find the device GUID. |
cipp_get_recovery_key |
Pro | Write | [CIPP] Retrieve the BitLocker recovery key for a specific Intune device via POST /api/ExecGetRecoveryKey. The device is identified by GUID (PascalCase). Optionally, RecoveryKeyType selects the kind of recovery key to fetch when multiple are available. Use cipp_list_devices first to find the device GUID. |
cipp_remove_assignment_filter_template |
Pro | Write | [CIPP] Delete a saved Intune assignment-filter TEMPLATE via POST /api/RemoveAssignmentFilterTemplate. Spec body: {ID (uppercase string — the template GUID)}. Query also accepts ID. Use cipp_list_assignment_filter_templates first to find the template ID. NOTE: this endpoint does NOT take tenantFilter — templates are MSP-scoped, not tenant-scoped. WARNING: removes the template definition. Tenants currently using a filter cloned from this template are unaffected. |
cipp_remove_autopilot_config |
Pro | Write | [CIPP] Remove a Windows Autopilot deployment profile via POST /api/RemoveAutopilotConfig. Spec body: {ID (uppercase string — the deployment profile GUID), displayName (camelCase string — display name of the profile), assignments (camelCase string — assignment identifiers to remove alongside the profile), tenantFilter (camelCase, required)}. Devices assigned to this profile will need reassignment. WARNING: Deletes an Autopilot deployment profile. Devices using this profile will lose their configuration. |
cipp_remove_autopilot_device |
Pro | Write | [CIPP] Remove a device from Windows Autopilot via POST /api/RemoveAPDevice. Spec body: {ID (uppercase string — the Autopilot device GUID), tenantFilter (camelCase, required)}. Query also accepts ID and tenantFilter. Use cipp_list_autopilot_devices first to find the device GUID. WARNING: Removes the device from Autopilot. The device will need to be re-registered for future deployments. |
cipp_remove_intune_reusable_setting |
Pro | Write | [CIPP] Remove a reusable setting from Intune via POST /api/RemoveIntuneReusableSetting. Spec body: {DisplayName (PascalCase string), ID (uppercase string — the reusable setting GUID), tenantFilter (camelCase, required)}. Query also accepts DisplayName, ID, and tenantFilter. Policies referencing the setting may be affected. |
cipp_remove_intune_reusable_setting_template |
Pro | Write | [CIPP] Delete a saved Intune reusable-setting TEMPLATE via POST /api/RemoveIntuneReusableSettingTemplate. Spec body: {ID (uppercase string — the template GUID)}. Query also accepts ID. Use cipp_list_intune_reusable_setting_templates first to find the template ID. NOTE: this endpoint does NOT take tenantFilter — templates are MSP-scoped. WARNING: removes the template definition. Existing tenant deployments cloned from this template are unaffected. |
cipp_remove_intune_script |
Pro | Write | [CIPP] Remove an Intune PowerShell or remediation script via POST /api/RemoveIntuneScript. Spec body: {DisplayName (PascalCase string), ID (uppercase string — the script GUID), ScriptType (PascalCase string — the Microsoft Graph script resource type), TenantFilter (PascalCase string — NOT camelCase here despite tool injecting from camelCase parameter)}. Use cipp_list_intune_scripts first to find ID. WARNING: Deletes an Intune script. Devices will no longer execute this script. |
cipp_remove_intune_template |
Pro | Write | [CIPP] Delete a saved Intune policy TEMPLATE via POST /api/RemoveIntuneTemplate. Spec body: {ID (uppercase string — the template GUID)}. Query also accepts ID. Use cipp_list_intune_templates first to find the template ID. NOTE: this endpoint does NOT take tenantFilter — templates are MSP-scoped. WARNING: removes the template definition. Tenants with policies cloned from this template are unaffected. |
cipp_remove_policy |
Pro | Write | [CIPP] Remove an Intune device configuration or compliance policy via POST /api/RemovePolicy. Spec body: {ID (uppercase string — the policy GUID), URLName (PascalCase string — the Microsoft Graph URL segment for the resource type, e.g., 'deviceConfigurations', 'deviceCompliancePolicies'), tenantFilter (camelCase, required)}. Query also accepts ID, URLName, and tenantFilter. Use cipp_list_intune_policies first to find ID and URLName. WARNING: Deletes an Intune policy. Devices assigned to this policy will lose the configuration. |
cipp_rename_autopilot_device |
Pro | Write | [CIPP] Rename an Autopilot device via POST /api/ExecRenameAPDevice. Spec body: {deviceId (camelCase string — the Autopilot device GUID), serialNumber (camelCase string — alternative identifier), displayName (camelCase string — the new device name), tenantFilter (camelCase, required)}. All keys are camelCase. The new name will be applied on the next device sync or reset. |
cipp_set_autopilot_group_tag |
Pro | Write | [CIPP] Set the group tag on an Autopilot device via POST /api/ExecSetAPDeviceGroupTag. Spec body: {deviceId (camelCase string — the Autopilot device GUID), serialNumber (camelCase string — alternative identifier), groupTag (camelCase string — the new tag value), tenantFilter (camelCase, required)}. All keys are camelCase. Group tags are used for dynamic group membership and profile assignment. |
cipp_sync_autopilot |
Pro | Write | [CIPP] Trigger a sync of all Windows Autopilot devices for a tenant via POST /api/ExecSyncAPDevices. Refreshes the Intune Autopilot device list from the hardware vendor. Spec body required: { tenantFilter (camelCase, required) }. |
cipp_sync_dep |
Pro | Write | [CIPP] Synchronize Apple Device Enrollment Program (DEP) devices for a tenant via POST /api/ExecSyncDEP. Spec body is minimal: only {tenantFilter (camelCase, required)}. No additional payload is required to trigger the sync. |
cipp_add_assignment_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Assignment filter configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): displayName (camelCase string), description (camelCase string), rule (camelCase string — KQL-style device-property expression), platform (camelCase string — e.g., 'Windows10AndLater', 'iOS', 'macOS', 'android'), assignmentFilterManagementType (camelCase string enum: 'devices' or 'apps'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the body key 'tenantFilter' (camelCase, required per spec). Use cipp_list_tenants to discover available tenants. |
cipp_add_assignment_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template definition as a JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): GUID (string — PascalCase template identifier), assignmentFilterManagementType (string — camelCase enum: 'devices' | 'apps'), platform (string — camelCase, Intune platform name, e.g. 'windows10AndLater'), rule (string — camelCase, the filter rule expression), displayname (string — note lowercase 'n', NOT 'displayName' or 'DisplayName'), Description (string — PascalCase). NOTE: this endpoint does NOT take tenantFilter. |
cipp_add_autopilot_config parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Autopilot profile configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): DisplayName (PascalCase string), Description (PascalCase string), DeviceNameTemplate (PascalCase string — Autopilot computer-name template), DeploymentMode (PascalCase boolean — true = self-deploying, false = user-driven), Assignto (PascalCase boolean — note lowercase 't' — flag for whether to assign), Autokeyboard (PascalCase boolean — auto keyboard layout), CollectHash (PascalCase boolean — collect hardware hash from existing devices), HideChangeAccount (PascalCase boolean — hide change account in OOBE), HidePrivacy (PascalCase boolean), HideTerms (PascalCase boolean), NotLocalAdmin (PascalCase boolean — skip local admin step), allowWhiteGlove (camelCase boolean — note camelCase here), languages (object — locale settings), selectedTenants (string — comma-separated tenant domains, identifies target tenants in lieu of tenantFilter). NOTE: this endpoint does NOT take tenantFilter. |
cipp_add_autopilot_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
autopilotData |
string | yes | The Autopilot hardware hash payload (CSV or JSON), typically the output of Get-WindowsAutoPilotInfo. May contain one or many device records in a single call. | |
groupName |
string | no | null | Optional: Azure AD group name to add the registered devices to after upload. Sent in the body as Groupname (mixed casing — preserve verbatim). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body as TenantFilter (PascalCase). Use cipp_list_tenants to discover available tenants. |
cipp_add_defender_deployment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Deployment configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): selectedTenants (string — comma-separated tenant domains), Mode (string), AssignTo (string), Policy (object), EDR (object), ASR (object), Compliance (object), Exclusion (object), excludedExtensions (string), excludedPaths (string), excludedProcesses (string), appSync (string), Connectwindows (string), ConnectIos (string), ConnectIosCompliance (string), ConnectAndroid (string), ConnectAndroidCompliance (string), ConnectMac (string), BlockunsupportedOS (string), showASR (boolean), showDefenderDefaults (boolean), showDefenderSetup (boolean), showExclusionPolicy (boolean). NOTE: this endpoint does NOT take tenantFilter — use selectedTenants instead. |
cipp_add_enrollment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Enrollment configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): AllowFail (PascalCase boolean — allow user to skip ESP errors), AllowReset (PascalCase boolean — allow reset on failure), EnableLog (PascalCase boolean — collect ESP logs), ErrorMessage (PascalCase string — custom message shown on ESP failure), InstallWindowsUpdates (PascalCase boolean — install updates during ESP), OBEEOnly (PascalCase boolean — restrict ESP to first-boot OOBE; note 'OBEE' three-E spelling), ShowProgress (PascalCase boolean — show installation progress), TimeOutInMinutes (PascalCase string), blockDevice (camelCase boolean — block device on ESP failure; note camelCase here), selectedTenants (string — comma-separated tenant domains, identifies target tenants in lieu of tenantFilter). NOTE: this endpoint does NOT take tenantFilter. |
cipp_add_intune_reusable_setting parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Reusable setting configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): displayName (string), description (string), rawJSON (string — note camelCase with uppercase JSON suffix, the serialized policy graph payload), TemplateId (PascalCase string — used when the body is sourced from a template), TemplateList (PascalCase string), ID (uppercase string). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_add_intune_reusable_setting_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template definition as a JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY; the spec lists multiple casings of similar fields, pick whichever the CIPP backend reads): GUID (PascalCase string — template identifier), displayName (camelCase string), DisplayName (PascalCase variant), displayname (lowercase 'n' variant), description (camelCase string), Description (PascalCase variant), rawJSON (camelCase 'rawJSON' — the serialized reusable-setting graph payload), RawJSON (PascalCase variant), json (camelCase 'json' alias for the same payload), package (camelCase string). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_add_intune_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template definition as a JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): description (camelCase string), displayName (camelCase string), ID (uppercase string — the source policy GUID being templatized), ODataType (PascalCase string — Microsoft Graph @odata.type of the source resource), policySource (LabelValue object — typically wrapped {label, value}), RawJSON (PascalCase string — serialized policy graph payload), TemplateType (PascalCase string — high-level template category), URLName (PascalCase string — Microsoft Graph URL segment for the resource type, e.g. 'deviceConfigurations'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_add_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy definition as a JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): TemplateType (string), TemplateID (string), TemplateGUID (string), displayName (string), Description (string), RAWJson (string — the serialized Intune policy graph payload), AssignTo (string), AssignmentFilterName (string), assignmentFilter (string), assignmentFilterType (string), customGroup (string), excludeGroup (string), replacemap (string), reusableSettings (string), Count (string). Do NOT add a 'tenantFilter' key here — the tool injects it. Keys merged here override the injected tenantFilter only by exact-name collision. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_assign_autopilot_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Assignment configuration as JSON object merged into the request body. Spec body keys (camelCase, case-sensitive — preserve EXACTLY): device (string — the Autopilot device GUID; preferred identifier), serialNumber (string — hardware serial number, used when device GUID is not yet known), user (string — UPN of the user to associate with the device, e.g., 'user@contoso.com'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_assign_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Assignment configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (string — policy GUID), Type (string — Microsoft Graph policy resource type), AssignTo (string — 'AllDevices'|'AllUsers'|'On'|'allLicensedUsers'|'AllDevicesAndUsers'|'customGroup'), assignmentMode (string — 'Include' or 'Exclude'), GroupIds (string — comma-separated group GUIDs), GroupNames (string — comma-separated group names), AssignmentFilterName (string), AssignmentFilterType (string — 'include' or 'exclude'), customGroup (string), excludeGroup (string), platformType (string). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_delete_assignment_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Action verb passed verbatim by CIPP. Sent as body key 'Action' (PascalCase). |
id |
string | no | null | Assignment filter ID to delete. Sent as body key 'ID' (uppercase). Use cipp_list_assignment_filters to find valid IDs. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as 'tenantFilter' (camelCase) on both the query string and in the body per the live spec. |
cipp_device_action parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | yes | Action to perform. Sent in the body as Action (PascalCase). Valid values: 'syncDevice', 'rebootNow', 'wipe', 'retire', 'remoteLock', 'rotateLocalAdminPassword', 'windowsDefenderScan', 'windowsDefenderUpdateSignatures', 'rotateBitLockerKeys'. | |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
guid |
string | yes | The Intune device GUID. Use cipp_list_devices to find valid GUIDs. Sent in the body as GUID (PascalCase). | |
input |
string | no | null | Optional: free-form input string consumed by some actions (e.g., the new password for rotateLocalAdminPassword). Sent in the body as input (lowercase — preserve casing). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body. Use cipp_list_tenants to discover available tenants. | |
user |
string | no | null | Optional: target user UPN scoped to the action (e.g., for user-scoped wipe). Sent in the body as user (lowercase — preserve casing). |
cipp_device_passcode_action parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Action configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): Action (PascalCase string — the passcode verb, common values include 'resetPasscode', 'clearPasscode'), GUID (PascalCase string — the Intune device GUID; use cipp_list_devices to discover). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_edit_assignment_filter parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter update fields as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): filterId (camelCase string — required, the assignment filter GUID to edit; use cipp_list_assignment_filters to find it), displayName (camelCase string), description (camelCase string), rule (camelCase string — KQL-style device-property expression), platform (camelCase string — e.g., 'Windows10AndLater', 'iOS', 'macOS', 'android'), assignmentFilterManagementType (camelCase string enum: 'devices' or 'apps'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the body key 'tenantFilter' (camelCase, required per spec). Use cipp_list_tenants to discover available tenants. |
cipp_edit_intune_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy update fields as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (string — the Intune policy GUID being edited), policyType (string — the Microsoft Graph policy resource type, e.g., 'deviceConfigurations', 'deviceCompliancePolicies'), newDisplayName (string — replacement display name). All keys are camelCase except ID which is uppercase. Do NOT add 'tenantFilter' here — the tool injects it. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_edit_intune_script parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Script update fields as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): IntuneScript (string — the new script content, typically base64 or raw PowerShell), ScriptId (string — the Intune script GUID), ScriptType (string — Microsoft Graph script resource type, e.g., 'deviceManagementScripts', 'deviceHealthScripts'), TenantFilter (PascalCase string — note PascalCase here despite camelCase tenantFilter on the query side). Tool injects tenantFilter from the typed parameter — do NOT add 'tenantFilter' here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (the underlying client overrides). Use cipp_list_tenants to discover available tenants. |
cipp_edit_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy update fields as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): Assignto (string — note lowercase 't'), Description (string), Displayname (string — note lowercase 'n'), groupid (string — all lowercase), tenantid (string — all lowercase, identifies the target tenant in lieu of tenantFilter). Do NOT use 'tenantFilter', 'AssignTo', 'DisplayName', or 'GroupId' — those will be silently ignored by CIPP. |
cipp_exec_bitlocker_search parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
deviceId |
string | no | null | Optional: Intune device GUID to limit the search to a single device's recovery keys. Sent in the body as deviceId (camelCase). Use cipp_list_devices to discover device GUIDs. |
keyId |
string | no | null | Optional: BitLocker recovery-key GUID to look up a specific key directly. Sent in the body as keyId (camelCase). |
limit |
string | no | null | Optional: STRING-typed numeric cap on the number of recovery keys returned. Sent in the body as limit (camelCase). Pass as a string (per spec), e.g. '50'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required by the live spec). Use cipp_list_tenants to discover available tenants. |
cipp_get_local_admin_password parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
guid |
string | yes | The Intune device GUID. Use cipp_list_devices to find valid GUIDs. Sent in the body as guid (lowercase). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND in the body as TenantFilter (PascalCase). Use cipp_list_tenants to discover available tenants. |
cipp_get_recovery_key parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
guid |
string | yes | The Intune device GUID. Use cipp_list_devices to find valid GUIDs. Sent in the body as GUID (PascalCase). | |
recoveryKeyType |
string | no | null | Optional: type of recovery key to retrieve when the device has multiple. Sent in the body as RecoveryKeyType (PascalCase). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter (required) AND in the body as tenantFilter (lowercase). Use cipp_list_tenants to discover available tenants. |
cipp_remove_assignment_filter_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the assignment filter template GUID; required). NOTE: this endpoint does NOT take tenantFilter. |
cipp_remove_autopilot_config parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the Autopilot deployment profile GUID; required), displayName (camelCase string — the profile display name), assignments (camelCase string — assignment identifiers to remove alongside the profile, comma-separated). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_remove_autopilot_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the Autopilot device GUID; required). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_remove_intune_reusable_setting parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): DisplayName (PascalCase string — the reusable setting display name), ID (uppercase string — the reusable setting GUID). At least one identifier is required. Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_remove_intune_reusable_setting_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the reusable setting template GUID; required). NOTE: this endpoint does NOT take tenantFilter. |
cipp_remove_intune_script parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): DisplayName (PascalCase string — the script display name), ID (uppercase string — the script GUID), ScriptType (PascalCase string — Microsoft Graph script resource type, e.g., 'deviceManagementScripts', 'deviceShellScripts', 'deviceHealthScripts'), TenantFilter (PascalCase string — note PascalCase on this endpoint). Tool also injects camelCase tenantFilter; pass TenantFilter explicitly here if the camelCase form is silently dropped. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Tool injects this into the body as tenantFilter (camelCase) — note that the spec actually defines TenantFilter (PascalCase) on this endpoint; for full compliance, callers may also pass TenantFilter explicitly via fieldsJson. Use cipp_list_tenants to discover available tenants. |
cipp_remove_intune_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object — the entire request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the Intune template GUID; required). NOTE: this endpoint does NOT take tenantFilter. |
cipp_remove_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Removal configuration as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): ID (uppercase string — the policy GUID; required), URLName (PascalCase string — Microsoft Graph URL segment for the resource type, e.g., 'deviceConfigurations', 'deviceCompliancePolicies', 'configurationPolicies'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter AND injected into the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_rename_autopilot_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Rename configuration as JSON object merged into the request body. Spec body keys (camelCase, case-sensitive — preserve EXACTLY): deviceId (string — the Autopilot device GUID; preferred identifier), serialNumber (string — hardware serial number, used when device GUID is not yet known), displayName (string — the new device computer name, e.g., 'DESKTOP-NEW01'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_set_autopilot_group_tag parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Group tag configuration as JSON object merged into the request body. Spec body keys (camelCase, case-sensitive — preserve EXACTLY): deviceId (string — the Autopilot device GUID; preferred identifier), serialNumber (string — hardware serial number, used when device GUID is not yet known), groupTag (string — the new group-tag value, e.g., 'Finance', 'Sales-Laptop'). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
cipp_sync_autopilot parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the camelCase 'tenantFilter' body field per spec. Use cipp_list_tenants to discover available tenants. |
cipp_sync_dep parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Optional sync configuration as JSON object merged into the request body. The CIPP spec defines ONLY {tenantFilter (camelCase)} in this body; the tool already injects tenantFilter. This parameter exists only as a forward-compat escape hatch for future fields. Pass an empty object unless instructed otherwise. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent in the body as tenantFilter (camelCase, required). Use cipp_list_tenants to discover available tenants. |
Security
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_ca_policy |
Pro | Write | [CIPP] Create a new Conditional Access policy for a tenant via POST /api/AddCAPolicy. CIPP accepts EITHER a CIPP-stored CA template (TemplateList) OR a raw Graph CA policy JSON body (RawJSON). Tool injects tenantFilter (camelCase) into the body — caller supplies the rest in fieldsJson. |
cipp_edit_ca_policy |
Pro | Write | [CIPP] Modify an existing Conditional Access policy for a tenant via POST /api/EditCAPolicy. The CIPP edit endpoint is intentionally narrow: only the policy state and display name can be updated this way — to change conditions/grant-controls, delete and re-create the policy with cipp_add_ca_policy. Use cipp_list_ca_policies first to find the policy GUID. tenantFilter is sent on BOTH the query string AND inside the body. |
cipp_list_anti_phishing |
Free | Read-only | [CIPP] List anti-phishing filter policies for a tenant. Returns impersonation protection, spoof settings, and action configurations. |
cipp_list_ca_changes |
Free | Read-only | [CIPP] List recent changes to Conditional Access policies for a tenant. Returns modification history with timestamps and actors. |
cipp_list_ca_policies |
Free | Read-only | [CIPP] List all Conditional Access policies for a tenant. Returns policy names, state, conditions, and grant controls. |
cipp_list_malware_filters |
Free | Read-only | [CIPP] List malware filter policies for a tenant. Returns file type blocking, zero-hour purge, and notification settings. |
cipp_list_mdo_alerts |
Free | Read-only | [CIPP] List Microsoft Defender for Office 365 alerts for a tenant. Returns threat detection alerts for email and collaboration workloads. |
cipp_list_named_locations |
Free | Read-only | [CIPP] List named locations (IP ranges and countries) used in Conditional Access policies for a tenant. |
cipp_list_safe_attachments |
Free | Read-only | [CIPP] List Safe Attachments policies for a tenant. Returns detonation settings, action on detection, and redirect configuration. |
cipp_list_safe_links |
Free | Read-only | [CIPP] List Safe Links policies for a tenant. Returns policy names, URL scanning settings, and protection scope. |
cipp_list_security_alerts |
Free | Read-only | [CIPP] List Microsoft 365 security alerts for a tenant. Returns alert severity, status, category, and affected resources. |
cipp_list_security_incidents |
Free | Read-only | [CIPP] List Microsoft 365 security incidents for a tenant. Returns incident severity, status, classification, and linked alerts. |
cipp_set_mdo_alert |
Pro | Write | [CIPP] Update a Microsoft Defender for Office 365 alert via POST /api/ExecSetMdoAlert. Use cipp_list_mdo_alerts first to find the alert. CIPP body keys per spec: 'Assigned' (PascalCase string), 'Classification' (PascalCase string), 'Determination' (PascalCase string), 'GUID' (PascalCase, all-caps — alert ID), 'Status' (PascalCase string), 'tenantFilter' (camelCase string, required). All six fields are also accepted as query parameters; the client places tenantFilter on the query string in addition to the body. Status / Classification / Determination follow Microsoft Graph values; CIPP forwards verbatim and does not validate. |
cipp_set_security_alert |
Pro | Write | [CIPP] Update a Microsoft 365 security alert via POST /api/ExecSetSecurityAlert. Use cipp_list_security_alerts first to find the alert. The CIPP body uses PascalCase keys throughout: 'GUID' (alert ID), 'Provider', 'Status', 'Vendor', plus 'tenantFilter' (camelCase). The same fields are also accepted as query-string parameters; the client places tenantFilter on the query string in addition to the body. Status accepted values are vendor- and provider-specific (e.g., for Microsoft Graph alerts: 'newAlert', 'inProgress', 'resolved', 'dismissed'); CIPP forwards the value verbatim to Microsoft Graph and does not validate. |
cipp_set_security_incident |
Pro | Write | [CIPP] Update a Microsoft 365 security incident via POST /api/ExecSetSecurityIncident. Use cipp_list_security_incidents first to find the incident. The CIPP body uses PascalCase keys throughout: 'Assigned', 'Classification', 'Determination', 'GUID' (incident ID), 'Redirected', 'Status', plus 'tenantFilter' (camelCase). The same fields are also accepted as query-string parameters; the client places tenantFilter on the query string in addition to the body. Status accepted values follow Microsoft Graph (e.g., 'active', 'inProgress', 'resolved', 'redirected'); CIPP forwards verbatim and does not validate. |
cipp_add_ca_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy definition as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): RawJSON (PascalCase string — JSON-stringified Graph conditionalAccessPolicy resource; use this OR TemplateList), TemplateList (object — LabelValue {label, value} reference to a CIPP CA template), NewState (PascalCase string enum — 'donotchange', 'Enabled', 'Disabled', 'enabledForReportingButNotEnforced'; controls policy state at creation), CreateGroups (PascalCase boolean — auto-create assignment include/exclude groups referenced in the policy), DisableSD (PascalCase boolean — disable Security Defaults so this CA can take effect), overwrite (camelCase boolean — overwrite existing policy with the same display name), replacename (camelCase string enum — 'leave', 'displayName', 'AllUsers'; controls how CIPP rewrites display name placeholders during deploy). Tool injects tenantFilter — do NOT add it here. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the body key 'tenantFilter' (camelCase, required per spec). Use cipp_list_tenants to discover available tenants. |
cipp_edit_ca_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Updated fields as JSON object merged into the request body. Spec body keys (case-sensitive — preserve EXACTLY): GUID (PascalCase, all-caps string — already provided via the policyId typed parameter; pass here only to override), State (PascalCase string — target policy state, common values 'enabled', 'disabled', 'enabledForReportingButNotEnforced'), newDisplayName (camelCase string — rename the policy). Same fields are also accepted as query-string parameters (GUID, State, newDisplayName, tenantFilter). Tool injects tenantFilter — do NOT add it here. |
policyId |
string | yes | The Conditional Access policy GUID. The CIPP spec body field is named 'GUID' (PascalCase, all-caps) — this typed parameter is exposed as 'policyId' for clarity but the tool maps it correctly. Use cipp_list_ca_policies to find valid GUIDs. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the body key 'tenantFilter' (camelCase, required per spec) and as a query parameter. Use cipp_list_tenants to discover available tenants. |
cipp_list_anti_phishing parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_ca_changes parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_ca_policies parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_malware_filters parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_mdo_alerts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_named_locations parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_safe_attachments parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_safe_links parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_security_alerts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_security_incidents parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_set_mdo_alert parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
alertId |
string | no | null | MDO alert identifier. Sent as 'GUID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_mdo_alerts to find valid IDs. |
assigned |
string | no | null | UPN to assign the alert to. Sent as 'Assigned' (PascalCase) per CIPP spec. |
classification |
string | no | null | Alert classification (e.g., 'truePositive', 'falsePositive', 'informationalExpectedActivity'). Sent as 'Classification' (PascalCase) per CIPP spec; forwarded verbatim to Microsoft Graph. |
determination |
string | no | null | Alert determination (e.g., 'malware', 'phishing', 'compromisedUser', 'maliciousUserActivity', 'notMalicious', 'lineOfBusinessApplication'). Sent as 'Determination' (PascalCase) per CIPP spec; forwarded verbatim to Microsoft Graph. |
status |
string | no | null | New alert status. Sent as 'Status' (PascalCase) per CIPP spec. Microsoft Graph accepts values like 'newAlert', 'inProgress', 'resolved', 'dismissed'; CIPP forwards verbatim. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_set_security_alert parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
alertId |
string | no | null | Security alert identifier. Sent as 'GUID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_security_alerts to find valid IDs. |
provider |
string | no | null | Alert provider name (the security product that raised the alert). Sent as 'Provider' (PascalCase) per CIPP spec. |
status |
string | no | null | New alert status. Sent as 'Status' (PascalCase) per CIPP spec. Vendor-/provider-specific values; CIPP forwards verbatim — common Graph values are 'newAlert', 'inProgress', 'resolved', 'dismissed'. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. | |
vendor |
string | no | null | Alert vendor name. Sent as 'Vendor' (PascalCase) per CIPP spec. |
cipp_set_security_incident parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
assigned |
string | no | null | UPN to assign the incident to. Sent as 'Assigned' (PascalCase) per CIPP spec. |
classification |
string | no | null | Incident classification (e.g., 'truePositive', 'falsePositive', 'informationalExpectedActivity'). Sent as 'Classification' (PascalCase) per CIPP spec; forwarded verbatim to Microsoft Graph. |
determination |
string | no | null | Incident determination (e.g., 'malware', 'securityPersonnel', 'securityTesting', 'unwantedSoftware', 'other', 'multiStagedAttack', 'compromisedUser', 'phishing', 'maliciousUserActivity', 'notMalicious', 'notEnoughDataToValidate', 'confirmedActivity', 'lineOfBusinessApplication'). Sent as 'Determination' (PascalCase) per CIPP spec; forwarded verbatim to Microsoft Graph. |
incidentId |
string | no | null | Security incident identifier. Sent as 'GUID' (PascalCase, all-caps) per CIPP spec. Use cipp_list_security_incidents to find valid IDs. |
redirected |
string | no | null | ID of the incident this one was redirected to (when reclassified as a duplicate). Sent as 'Redirected' (PascalCase) per CIPP spec. |
status |
string | no | null | New incident status. Sent as 'Status' (PascalCase) per CIPP spec. Microsoft Graph accepts values like 'active', 'inProgress', 'resolved', 'redirected'; CIPP forwards verbatim. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
Conditional Access
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_ca_template |
Pro | Write | [CIPP] Save a Conditional Access policy as a CIPP template via POST /api/AddCATemplate. Required body keys (exact spec casing): 'tenantFilter' (camelCase) and 'name' (lowercase, the template display name). Optional body key: 'policySource' — a LabelValue-shaped object {"label":<value>,"value":<value>} pointing at the source policy (e.g., {"label":"<policyName>","value":"<policyId>"}). tenantFilter is sent on the body only (no query string). |
cipp_add_named_location |
Pro | Write | [CIPP] Create a new Conditional Access named location via POST /api/AddNamedLocation. The CIPP body uses MIXED casing. Required: 'Type' (PascalCase, enum 'Countries' or 'IPLocation') determines which other fields are used. Body keys (exact spec casing): PascalCase 'Countries' (array of LabelValue objects {"label":"<countryName>","value":"<isoCode>"}, used when Type='Countries'), 'Ips' (string, used when Type='IPLocation'), 'Trusted' (boolean); camelCase 'includeUnknownCountriesAndRegions' (boolean), 'policyName' (string, location display name), 'selectedTenants' (string). This endpoint has NO 'tenantFilter' field — the location is created against the tenants identified by 'selectedTenants'. |
cipp_exec_ca_check |
Free | Read-only | [CIPP] Simulate a Conditional Access policy evaluation for a tenant via POST /api/ExecCACheck. Returns which CA policies apply to a hypothetical sign-in. The CIPP body uses MIXED casing — required: 'tenantFilter' (camelCase). Optional body keys: 'userID' (camelCase, all-caps 'ID'), 'IpAddress' (PascalCase), and seven LabelValue-shaped objects 'ClientAppType', 'Country', 'DevicePlatform', 'IncludeApplications', 'SignInRiskLevel', 'UserRiskLevel', 'authenticationFlow' — each shaped as {"label":<value>,"value":<value>} per CIPP convention. tenantFilter is sent on the body only (no query string). |
cipp_exec_ca_exclusion |
Pro | Write | [CIPP] Manage Conditional Access policy user exclusions for a tenant via POST /api/ExecCAExclusion — this is a WRITE operation that adds or removes user exclusions on CA policies. The CIPP body uses MIXED casing — required: 'tenantFilter' (camelCase). Optional body keys (exact spec casing): PascalCase 'PolicyId', 'ExclusionType', 'StartDate' (integer epoch), 'EndDate' (integer epoch), 'UserID', 'Username', 'Users' (array<string>); camelCase 'addedFields', 'excludeLocationAuditAlerts', 'reference', 'value', 'vacation' (boolean), and 'postExecution' (array<string>). tenantFilter is sent on the body only (no query string). |
cipp_exec_ca_service_exclusion |
Pro | Write | [CIPP] Manage Conditional Access service-principal exclusions for a tenant via POST /api/ExecCAServiceExclusion — this is a WRITE operation that adds or removes service-principal exclusions on CA policies. Required body: 'tenantFilter' (camelCase) and 'GUID' (PascalCase, all-caps — the policy ID). The same 'GUID' and 'tenantFilter' values are also placed on the query string by the client. |
cipp_exec_named_location |
Pro | Write | [CIPP] Update an existing Conditional Access named location via POST /api/ExecNamedLocation. All four body keys are camelCase (exact spec casing): required 'tenantFilter', plus 'change' (string, the action to perform), 'input' (string, payload such as new IP ranges or countries), 'namedLocationId' (string, the location GUID). The same four values are also placed on the query string by the client. |
cipp_list_ca_templates |
Free | Read-only | [CIPP] List all Conditional Access policy templates available in CIPP. Returns template names, descriptions, and policy definitions. |
cipp_remove_ca_policy |
Pro | Write | [CIPP] Delete a Conditional Access policy from a tenant via POST /api/RemoveCAPolicy. WARNING: removing a CA policy may immediately change the tenant's security posture. Required body keys (exact spec casing): 'tenantFilter' (camelCase) and 'GUID' (PascalCase, all-caps — the policy GUID). The same 'GUID' and 'tenantFilter' values are also placed on the query string by the client. Use cipp_list_ca_policies to find the policy GUID. |
cipp_remove_ca_template |
Pro | Write | [CIPP] Delete a Conditional Access policy template via POST /api/RemoveCATemplate. Required body key (exact spec casing): 'ID' (PascalCase, all-caps — the template GUID). The same 'ID' value is also placed on the query string by the client. Use cipp_list_ca_templates to find the template ID. |
cipp_add_ca_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template fields as JSON object merged into the request body verbatim. Spec-listed body keys (exact casing): 'name' (string, template name) and 'policySource' (LabelValue object {"label":"<value>","value":"<value>"} identifying the source CA policy). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_add_named_location parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'Type' (string enum: 'Countries' | 'IPLocation'), 'Countries' (array of LabelValue {"label":"<name>","value":"<isoCode>"}, for Type=Countries), 'Ips' (string of IP ranges, for Type=IPLocation), 'Trusted' (boolean), 'includeUnknownCountriesAndRegions' (boolean), 'policyName' (string), 'selectedTenants' (string). NOTE: NO 'tenantFilter' — uses 'selectedTenants' instead. Caller is responsible for exact spec casing. |
cipp_exec_ca_check parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | CA evaluation parameters as JSON object merged into the request body verbatim. Spec-listed body keys (exact casing): 'userID' (string, user object ID/UPN), 'IpAddress' (string, source IP), and the LabelValue-shaped objects 'ClientAppType', 'Country', 'DevicePlatform', 'IncludeApplications', 'SignInRiskLevel', 'UserRiskLevel', 'authenticationFlow' — each shaped as {"label":"<value>","value":"<value>"}. Caller is responsible for exact spec casing. tenantFilter is set automatically from the parameter above. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_exec_ca_exclusion parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Exclusion parameters as JSON object merged into the request body verbatim. Spec-listed body keys (exact casing): 'PolicyId', 'ExclusionType', 'StartDate' (integer), 'EndDate' (integer), 'UserID', 'Username', 'Users' (array<string>), 'addedFields', 'excludeLocationAuditAlerts', 'reference', 'value', 'vacation' (boolean), 'postExecution' (array<string>). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_exec_ca_service_exclusion parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GUID' (string, all-caps — the CA policy GUID). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_exec_named_location parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing, all camelCase): 'change' (string, action name), 'input' (string, payload), 'namedLocationId' (string, location GUID). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_remove_ca_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GUID' (string, all-caps — the CA policy GUID). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the body field 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_remove_ca_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'ID' (string, all-caps — the CA template GUID). Caller is responsible for exact spec casing. |
Safe Links
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_safe_links_from_template |
Pro | Write | [CIPP] Deploy one or more Safe Links policy templates to one or more tenants in bulk via POST /api/AddSafeLinksPolicyFromTemplate. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). Use cipp_list_safe_links_templates to find available templates. |
cipp_add_safe_links_template |
Pro | Write | [CIPP] Save a Safe Links policy configuration as a reusable CIPP template via POST /api/AddSafeLinksPolicyTemplate. This is a CIPP-internal template store, not a tenant action — no tenantFilter is required. The spec body is intentionally minimal (just naming + display fields); the full Safe Links settings are typically captured by cipp_create_safe_links_template from a live tenant. |
cipp_create_safe_links_policy |
Pro | Write | [CIPP] Create a new Defender for Office Safe Links policy + rule pair in a tenant via POST /api/ExecNewSafeLinksPolicy. Safe Links rewrites and time-of-click scans URLs in Outlook, Teams, and Office. tenantFilter is sent on BOTH the query string AND inside the body. CIPP creates both the policy and its associated rule from a single body. |
cipp_create_safe_links_template |
Pro | Write | [CIPP] Capture an existing Safe Links policy + rule pair from a live tenant and persist it as a reusable CIPP template via POST /api/CreateSafeLinksPolicyTemplate. The full policy/rule settings are sent in-line so CIPP can replay them later via cipp_add_safe_links_from_template. |
cipp_delete_safe_links_policy |
Pro | Write | [CIPP] Permanently delete a Safe Links policy + rule pair from a tenant via POST /api/ExecDeleteSafeLinksPolicy. Destructive: removes both the rule and the underlying policy. Use cipp_list_safe_links to confirm the names before running. The same fields ('PolicyName', 'RuleName', 'tenantFilter') are accepted as BOTH query parameters and body fields. |
cipp_edit_safe_links_policy |
Pro | Write | [CIPP] Modify an existing Safe Links policy + rule pair via POST /api/EditSafeLinksPolicy. Use cipp_list_safe_links to find the existing policy name. tenantFilter, PolicyName, and RuleName are sent on BOTH the query string AND inside the body. |
cipp_edit_safe_links_template |
Pro | Write | [CIPP] Modify an existing Safe Links policy template stored in CIPP via POST /api/EditSafeLinksPolicyTemplate. Use cipp_list_safe_links_templates to find the template id. Note: this edits a CIPP-stored template, not a tenant policy — use cipp_edit_safe_links_policy for live tenant policies. The tool still adds tenantFilter for compatibility with the CIPP client wrapper. |
cipp_list_safe_links_details |
Free | Read-only | [CIPP] Get the full configuration of a specific Safe Links policy in a tenant via POST /api/ListSafeLinksPolicyDetails. Despite being a list/read endpoint, this is a POST that takes a body filter. The same fields ('PolicyName', 'RuleName', 'tenantFilter') are accepted as BOTH query parameters and body fields. |
cipp_list_safe_links_template_details |
Free | Read-only | [CIPP] Get the full configuration of a specific Safe Links policy template stored in CIPP via POST /api/ListSafeLinksPolicyTemplateDetails. Despite being a list/read endpoint, this is a POST that takes a body. Use cipp_list_safe_links_templates to discover template IDs. Not tenant-scoped. |
cipp_list_safe_links_templates |
Free | Read-only | [CIPP] List all Safe Links policy templates available in CIPP. Returns template names, descriptions, and policy definitions. |
cipp_remove_safe_links_template |
Pro | Write | [CIPP] Permanently delete a Safe Links policy template from the CIPP template store via POST /api/RemoveSafeLinksPolicyTemplate. Destructive: removes the template only — tenant policies created from it remain intact. Use cipp_list_safe_links_templates to find the template id. Not tenant-scoped. |
cipp_add_safe_links_from_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Deployment parameters as a JSON object. CIPP body keys (exact spec casing): 'TemplateList' (array of strings, REQUIRED — CIPP template IDs to deploy), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_add_safe_links_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template definition as a JSON object. CIPP body keys (all PascalCase, exact spec casing): 'TemplateName' (string — name shown in CIPP template list), 'TemplateDescription' (string — description shown in CIPP), 'Name' (string — internal name), 'PolicyName' (string — referenced Safe Links policy name), 'AdminDisplayName' (string), 'Description' (string). |
cipp_create_safe_links_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy + rule definition as a JSON object. CIPP body keys (mostly PascalCase, exact spec casing): 'PolicyName' (string — required Safe Links policy name), 'RuleName' (string — required corresponding rule name; usually matches PolicyName). Boolean toggles (real JSON booleans, not strings): 'EnableSafeLinksForEmail', 'EnableSafeLinksForTeams', 'EnableSafeLinksForOffice', 'EnableForInternalSenders', 'ScanUrls', 'DeliverMessageAfterScan', 'AllowClickThrough', 'TrackClicks', 'DisableUrlRewrite', 'EnableOrganizationBranding', 'State' (boolean — enabled/disabled). Strings: 'AdminDisplayName', 'Comments', 'Count', 'CustomNotificationText'. Arrays of strings: 'DoNotRewriteUrls' (URL/domain allow-list), 'RecipientDomainIs' (rule targets), 'SentTo' (rule targets), 'SentToMemberOf' (rule targets), 'ExceptIfRecipientDomainIs', 'ExceptIfSentTo', 'ExceptIfSentToMemberOf'. Integer: 'Priority' (rule priority — lower = higher precedence). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as tenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_create_safe_links_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template definition as a JSON object. CIPP body keys (mostly PascalCase, exact spec casing): 'TemplateName' (string — required name for the new CIPP template), 'TemplateDescription' (string), 'PolicyName' (string — required Safe Links policy to capture), 'RuleName' (string — required Safe Links rule name; usually matches PolicyName). Boolean toggles (real JSON booleans, not strings): 'EnableSafeLinksForEmail', 'EnableSafeLinksForTeams', 'EnableSafeLinksForOffice', 'EnableForInternalSenders', 'ScanUrls', 'DeliverMessageAfterScan', 'AllowClickThrough', 'TrackClicks', 'DisableUrlRewrite', 'EnableOrganizationBranding', 'State'. Strings: 'AdminDisplayName', 'Comments', 'CustomNotificationText'. Arrays of strings: 'DoNotRewriteUrls', 'RecipientDomainIs', 'SentTo', 'SentToMemberOf', 'ExceptIfRecipientDomainIs', 'ExceptIfSentTo', 'ExceptIfSentToMemberOf'. Integer: 'Priority'. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_delete_safe_links_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Policy identification as a JSON object. CIPP body keys (exact spec casing — both PascalCase): 'PolicyName' (string, REQUIRED — Safe Links policy display name), 'RuleName' (string, REQUIRED — corresponding rule name; usually matches PolicyName). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_edit_safe_links_policy parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Updated policy + rule definition as a JSON object. CIPP body keys (mostly PascalCase, exact spec casing): 'PolicyName' (string — required existing policy name), 'RuleName' (string — required existing rule name). Boolean toggles (real JSON booleans, not strings): 'EnableSafeLinksForEmail', 'EnableSafeLinksForTeams', 'EnableSafeLinksForOffice', 'EnableForInternalSenders', 'ScanUrls', 'DeliverMessageAfterScan', 'AllowClickThrough', 'TrackClicks', 'DisableUrlRewrite', 'EnableOrganizationBranding', 'State' (boolean). Strings: 'AdminDisplayName', 'Comments', 'CustomNotificationText'. Arrays of strings: 'DoNotRewriteUrls', 'RecipientDomainIs', 'SentTo', 'SentToMemberOf', 'ExceptIfRecipientDomainIs', 'ExceptIfSentTo', 'ExceptIfSentToMemberOf'. Integer: 'Priority'. Only include the fields you want to change. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as tenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_edit_safe_links_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Updated template fields as a JSON object. CIPP body keys (mostly PascalCase, exact spec casing): 'ID' (string, REQUIRED — CIPP template id from cipp_list_safe_links_templates), 'TemplateName' (string), 'TemplateDescription' (string), 'PolicyName' (string), 'RuleName' (string). Boolean toggles (real JSON booleans, not strings): 'EnableSafeLinksForEmail', 'EnableSafeLinksForTeams', 'EnableSafeLinksForOffice', 'EnableForInternalSenders', 'ScanUrls', 'DeliverMessageAfterScan', 'AllowClickThrough', 'TrackClicks', 'DisableUrlRewrite', 'EnableOrganizationBranding'. NOTE: 'State' is a STRING here (unlike the create endpoints which use boolean). Strings: 'AdminDisplayName', 'Comments', 'CustomNotificationText'. Arrays of strings: 'DoNotRewriteUrls', 'RecipientDomainIs', 'SentTo', 'SentToMemberOf', 'ExceptIfRecipientDomainIs', 'ExceptIfSentTo', 'ExceptIfSentToMemberOf'. Integer: 'Priority'. Only include fields you want to change. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string. The endpoint itself is template-scoped, not tenant-scoped — tenantFilter is included for client-wrapper compatibility. |
cipp_list_safe_links_details parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Filter as a JSON object. CIPP body keys (all optional, exact spec casing): 'PolicyName' (string — Safe Links policy display name), 'RuleName' (string — corresponding Safe Links rule name; usually matches PolicyName). Both are PascalCase. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_list_safe_links_template_details parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template lookup as a JSON object. CIPP body keys (exact spec casing): 'ID' (string, REQUIRED — CIPP template id, all-caps). The same field is also accepted as a query parameter. |
cipp_remove_safe_links_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template identification as a JSON object. CIPP body keys (exact spec casing): 'ID' (string, REQUIRED — CIPP template id, all-caps PascalCase). The same field is also accepted as a query parameter. |
Teams & SharePoint
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_site |
Pro | Write | [CIPP] Create a new SharePoint site via POST /api/AddSite. The CIPP body uses camelCase keys: 'sensitivityLabel', 'siteDescription', 'siteName', 'tenantFilter', plus three LabelValue objects — 'siteDesign', 'siteOwner', and 'templateName' — each shaped as {"label":<label>,"value":<value>}. There is NO 'siteUrl' field in this endpoint's body — the URL is derived by SharePoint from the site name and template. The tenantFilter parameter is also placed on the query string by the client. |
cipp_add_site_bulk |
Pro | Write | [CIPP] Create multiple SharePoint sites in bulk via POST /api/AddSiteBulk. Required body key: 'tenantFilter' (camelCase). All other body keys are camelCase strings — UNLIKE cipp_add_site, the bulk variant has NO LabelValue objects: 'siteDesign', 'siteOwner', and 'templateName' are flat strings here. Spec body keys (exact casing): 'bulkSites' (string, the bulk payload — typically a delimited or CSV-style site list), 'sensitivityLabel' (string), 'siteDescription' (string), 'siteDesign' (string), 'siteName' (string), 'siteOwner' (string), 'templateName' (string). NOTE: there is NO 'siteUrl' field — URLs are derived by SharePoint. |
cipp_add_team |
Pro | Write | [CIPP] Create a new Microsoft Team for a tenant via POST /api/AddTeam. CRITICAL CASING: the body uses lowercase 'tenantid' (NOT camelCase 'tenantFilter') for the target tenant — the tool emits 'tenantFilter' for the query-string compatibility but callers should pass 'tenantid' through fieldsJson if the live backend rejects the camelCase variant. All other body keys are camelCase: 'displayName' (string, required), 'description' (string), 'owner' (string, owner UPN), 'visibility' (string, e.g., 'Private' or 'Public'). |
cipp_assign_teams_voice_number |
Pro | Write | [CIPP] Assign a phone number to a Teams user for voice calling via POST /api/ExecTeamsVoicePhoneNumberAssignment. CRITICAL CASING: the body field is 'TenantFilter' (PascalCase), NOT camelCase 'tenantFilter' — the tool emits 'tenantFilter' for compatibility but pass 'TenantFilter' through fieldsJson if the live backend rejects camelCase. Body keys (exact spec casing): PascalCase 'TenantFilter' (required), 'PhoneNumber' (string, e.g., '+15551234567'), 'PhoneNumberType' (string); lowercase 'input' (string, target user UPN or ID), 'locationOnly' (string boolean — 'true'/'false'). |
cipp_delete_sharepoint_site |
Pro | Write | [CIPP] Delete a SharePoint site via POST /api/DeleteSharepointSite. The site moves to the recycle bin and can be recovered within 93 days. WARNING: this strips all site content including documents, lists, and any associated Teams files. Required body keys (exact spec casing): 'tenantFilter' (camelCase) and 'SiteId' (PascalCase — the SharePoint site ID, NOT a 'siteUrl'). |
cipp_get_sharepoint_quota |
Free | Read-only | [CIPP] Get SharePoint Online storage quota and usage for a tenant. Returns total storage, used storage, and per-site breakdown. |
cipp_get_sharepoint_settings |
Free | Read-only | [CIPP] Get SharePoint Online tenant-level settings. Returns sharing defaults, external sharing policy, and site creation settings. |
cipp_list_sharepoint_admin_url |
Free | Read-only | [CIPP] Get the SharePoint admin center URL for a tenant. |
cipp_list_site_members |
Free | Read-only | [CIPP] List members of a SharePoint site via GET /api/ListSiteMembers. Returns the user / group membership for the site identified by SiteId. CIPP query keys per spec: 'tenantFilter' (camelCase, required) and 'SiteId' (PascalCase). NOTE: this endpoint is in the live CIPP spec but missing from the checked-in CIPP-API.json — verify behavior against the live backend if responses look unexpected. |
cipp_list_sites |
Free | Read-only | [CIPP] List SharePoint sites (or OneDrive usage accounts) for a tenant via GET /api/ListSites. Returns site URL, display name, owner, storage used/allocated, and last-activity data. REQUIRED CIPP query parameter 'Type': CIPP returns HTTP 400 'Type is required' if it is omitted. Valid values are 'SharePointSiteUsage' (SharePoint team sites — isPersonalSite eq false) and 'OneDriveUsageAccount' (personal OneDrive sites — isPersonalSite eq true). Defaults to 'SharePointSiteUsage', which is the value that lists SharePoint team sites. |
cipp_list_teams |
Free | Read-only | [CIPP] List all Microsoft Teams for a tenant. Returns team display name, visibility, member count, and archive status. |
cipp_list_teams_activity |
Free | Read-only | [CIPP] List Microsoft Teams activity reports for a tenant. Returns usage metrics including messages, calls, and meetings per team. |
cipp_list_teams_lis_location |
Free | Read-only | [CIPP] List Teams Location Information Service (LIS) locations. Returns network subnets, addresses, and emergency calling locations. |
cipp_list_teams_voice |
Free | Read-only | [CIPP] List Microsoft Teams voice and telephony configuration for a tenant. Returns calling plans, phone numbers, and voice policies. |
cipp_remove_teams_voice_number |
Pro | Write | [CIPP] Remove a phone number assignment from a Teams user via POST /api/ExecRemoveTeamsVoicePhoneNumberAssignment. UNLIKE cipp_assign_teams_voice_number, this endpoint uses camelCase 'tenantFilter' in the body. Body keys (exact spec casing): 'tenantFilter' (camelCase, required), 'AssignedTo' (PascalCase, string — the user UPN/ID currently holding the number), 'PhoneNumber' (PascalCase string), 'PhoneNumberType' (PascalCase string). |
cipp_set_sharepoint_member |
Pro | Write | [CIPP] Add or remove a member on a SharePoint site / Microsoft 365 group via POST /api/ExecSetSharePointMember. The CIPP body uses MIXED casing: 'Add' (PascalCase, string boolean — 'true' to add, 'false' to remove), 'GroupID' (PascalCase, all-caps), 'SharePointType' (PascalCase), 'tenantFilter' (camelCase), and 'user' (lowercase). There is NO 'siteUrl' field — membership is keyed by GroupID, not site URL. The tenantFilter parameter is also placed on the query string by the client. |
cipp_set_sharepoint_permissions |
Pro | Write | [CIPP] Grant, revoke, or modify a user's permissions on a SharePoint or OneDrive site via POST /api/ExecSharePointPerms. The CIPP body uses MIXED casing: 'RemovePermission' (PascalCase, string boolean), 'UPN' (all-caps), 'URL' (all-caps), 'onedriveAccessUser' (camelCase), 'tenantFilter' (camelCase), and 'user' (lowercase). There is NO 'siteUrl' field — the site URL is sent as 'URL' (all-caps). The tenantFilter parameter is also placed on the query string by the client. |
cipp_add_site parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
sensitivityLabel |
string | no | null | Sensitivity label ID (Microsoft Information Protection label) to apply to the site. Sent as 'sensitivityLabel' (camelCase). |
siteDescription |
string | no | null | Description shown on the site. Sent as 'siteDescription' (camelCase). |
siteDesign |
string | no | null | Site design template value (e.g., 'Showcase', 'Blank', or a custom design GUID). Sent as the LabelValue object 'siteDesign': {"label":<value>,"value":<value>}. |
siteName |
string | yes | Display name for the new SharePoint site. Sent as 'siteName' (camelCase). | |
siteOwner |
string | no | null | Site owner UPN (e.g., 'admin@contoso.com'). Sent as the LabelValue object 'siteOwner': {"label":<upn>,"value":<upn>}. |
templateName |
string | no | null | Site template name (e.g., 'CommunicationSite' or 'TeamSite' for SharePoint, or a Microsoft 365 group template). Sent as the LabelValue object 'templateName': {"label":<value>,"value":<value>}. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_add_site_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing, all camelCase, all strings — no LabelValue objects): 'bulkSites' (the bulk payload), 'sensitivityLabel', 'siteDescription', 'siteDesign', 'siteName', 'siteOwner', 'templateName'. NO 'siteUrl' field. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_add_team parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
displayName |
string | yes | Display name for the new team. Sent as 'displayName' (camelCase) per CIPP spec. | |
fieldsJson |
string | no | null | Additional fields as JSON object merged into the request body verbatim. Spec-listed body keys (exact casing): 'description' (string), 'owner' (string, UPN), 'visibility' (string), 'tenantid' (lowercase, the target tenant ID — distinct from 'tenantFilter'). Caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. NOTE: the spec body field is 'tenantid' (lowercase), not 'tenantFilter' — pass 'tenantid' via fieldsJson if needed. |
cipp_assign_teams_voice_number parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'PhoneNumber' (string), 'PhoneNumberType' (string), 'TenantFilter' (PascalCase, required), 'input' (string, the target user), 'locationOnly' (string boolean — 'true'/'false'). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. NOTE: the spec body field is PascalCase 'TenantFilter' — pass it through fieldsJson if needed. |
cipp_delete_sharepoint_site parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'SiteId' (string, PascalCase — the SharePoint site ID). NOTE: the spec uses 'SiteId', NOT 'siteUrl'. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_get_sharepoint_quota parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_get_sharepoint_settings parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_site_members parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
siteId |
string | no | null | SharePoint site ID whose members to list. Sent as the 'SiteId' query parameter (PascalCase) per CIPP spec. Use cipp_list_sites to discover site IDs. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' query parameter (camelCase, required) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_list_sites parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. | |
type |
string | no | "SharePointSiteUsage" | SharePoint report scope, sent as the CIPP 'Type' query parameter (required by CIPP). Valid values: 'SharePointSiteUsage' (SharePoint team sites, the default) or 'OneDriveUsageAccount' (personal OneDrive sites). Case-insensitive; normalized to the canonical CIPP casing before the call. |
cipp_list_teams parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_teams_activity parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_teams_voice parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_teams_voice_number parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'AssignedTo' (PascalCase, the current owner UPN/ID), 'PhoneNumber' (PascalCase), 'PhoneNumberType' (PascalCase). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_set_sharepoint_member parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
add |
string | no | null | Whether to add the user. CIPP expects this as a STRING boolean ('true' or 'false'), not a JSON boolean. 'true' adds the user; 'false' removes them. Sent as 'Add' (PascalCase) per CIPP spec. |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
groupId |
string | no | null | ID of the Microsoft 365 group / SharePoint site backing the membership. Sent as 'GroupID' (PascalCase, all-caps) per CIPP spec. |
sharePointType |
string | no | null | SharePoint membership type (e.g., 'Owner', 'Member', 'Visitor'). Sent as 'SharePointType' (PascalCase) per CIPP spec. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. | |
user |
string | no | null | UPN or login of the user being added or removed. Sent as 'user' (lowercase) per CIPP spec. |
cipp_set_sharepoint_permissions parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields not yet exposed as typed parameters. Keys are passed verbatim — caller is responsible for exact spec casing. |
onedriveAccessUser |
string | no | null | UPN of the user being granted access to someone else's OneDrive. Sent as 'onedriveAccessUser' (camelCase) per CIPP spec. |
removePermission |
string | no | null | Whether to remove the permission instead of granting it. CIPP expects this as a STRING boolean ('true' or 'false'), not a JSON boolean. 'true' revokes; 'false' (or omitted) grants. Sent as 'RemovePermission' (PascalCase) per CIPP spec. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as TenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. | |
upn |
string | no | null | UPN of the OneDrive owner whose access is being modified. Sent as 'UPN' (all-caps) per CIPP spec. |
url |
string | no | null | URL of the SharePoint site or OneDrive being modified. Sent as 'URL' (all-caps) per CIPP spec — distinct from the OneDrive owner UPN. |
user |
string | no | null | UPN of the user whose access is being granted or revoked on a SharePoint site. Sent as 'user' (lowercase) per CIPP spec. |
Standards
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_bpa_template |
Pro | Write | [CIPP] Save a new Best Practice Analyzer template via POST /api/AddBPATemplate. Required body keys (exact spec casing, both lowercase): 'name' (string, the template name) and 'style' (string enum 'Tenant' | 'Table' — controls report layout). This endpoint has NO 'tenantFilter' field — templates are tenant-agnostic. |
cipp_add_standards_template |
Pro | Write | [CIPP] Save a new CIPP standards template for reuse via POST /api/AddStandardsTemplate. The CIPP body uses MIXED casing. Required: 'tenantFilter' (camelCase). Optional body keys (exact spec casing): 'GUID' (PascalCase, all-caps — template GUID for updates), 'createdAt' (camelCase string), 'templateName' (camelCase string). |
cipp_cipp_standards_run |
Pro | Write | [CIPP] Trigger a full CIPP standards processing run across all tenants with configured standards. Triggers standards enforcement which may take several minutes to complete. |
cipp_deploy_standards |
Pro | Write | [CIPP] Deploy CIPP standards to a tenant via POST /api/AddStandardsDeploy. CRITICAL CASING: the spec body has only ONE field — 'tenant' (lowercase, NOT 'tenantFilter') — the target tenant domain. The tool emits 'tenantFilter' for query-string compatibility but callers should pass 'tenant' through fieldsJson to match the spec exactly. |
cipp_drift_clone |
Pro | Write | [CIPP] Clone a drift template into a new standards baseline via POST /api/ExecDriftClone. Required body key (exact spec casing): 'id' (lowercase string — the source drift template/snapshot ID). This is the ONLY field in the spec body — no 'tenantFilter', no 'templateName'. |
cipp_list_bpa |
Free | Read-only | [CIPP] List Best Practice Analyzer results for a tenant. Returns pass/fail status for security, identity, and configuration checks. |
cipp_list_bpa_templates |
Free | Read-only | [CIPP] List saved Best Practice Analyzer templates. Returns template names and configured checks. |
cipp_list_domain_analyser |
Free | Read-only | [CIPP] Run detailed domain analysis for a tenant. Returns comprehensive DNS configuration, email authentication, and security posture. |
cipp_list_domain_health |
Free | Read-only | [CIPP] Check DNS and email security health for a tenant's domains. Returns SPF, DKIM, DMARC, and MX record analysis. |
cipp_list_standard_templates |
Free | Read-only | [CIPP] List saved CIPP standard templates. Returns template names and configured security/configuration baselines for reuse across tenants. |
cipp_list_standards |
Free | Read-only | [CIPP] List deployed CIPP standards for a tenant. Returns standard names, applied settings, and compliance state. |
cipp_list_standards_compare |
Free | Read-only | [CIPP] Compare a tenant's current configuration against the CIPP standards template. Returns differences and compliance gaps. |
cipp_list_tenant_drift |
Free | Read-only | [CIPP] Detect configuration drift for a tenant. Returns settings that have changed from the deployed standard baseline. |
cipp_remove_bpa_template |
Pro | Write | [CIPP] Remove a saved Best Practice Analyzer template via POST /api/RemoveBPATemplate. Required body key (exact spec casing): 'TemplateName' (PascalCase string). The same 'TemplateName' value is also placed on the query string by the client. NOTE: this endpoint identifies templates by NAME, not ID. Use cipp_list_bpa_templates to find the template name. |
cipp_remove_standard |
Pro | Write | [CIPP] Remove a deployed standard from a tenant. The tenant will no longer be enforced against this standard. |
cipp_remove_standard_template |
Pro | Write | [CIPP] Remove a saved CIPP standards template via POST /api/RemoveStandardTemplate. Required body key (exact spec casing): 'ID' (PascalCase, all-caps — the template ID). The same 'ID' value is also placed on the query string by the client. Use cipp_list_standard_templates to find the template ID. |
cipp_run_bpa |
Pro | Write | [CIPP] Trigger a Best Practice Analyzer run for a tenant via POST /api/ExecBPA. May take several minutes — use cipp_list_bpa to read cached results first. CRITICAL CASING: the body field is all-lowercase 'tenantfilter' (NOT camelCase 'tenantFilter'), even though the SAME value is sent on the query string as camelCase 'tenantFilter'. The tool emits 'tenantFilter' in the body for compatibility but callers should pass 'tenantfilter' through fieldsJson to match the spec exactly. |
cipp_standard_convert |
Pro | Write | [CIPP] Convert a legacy standard format to the current CIPP standards format. |
cipp_standards_run |
Pro | Write | [CIPP] Trigger a standards enforcement run. Applies configured standards to target tenants immediately. Triggers standards enforcement which may take several minutes to complete. |
cipp_update_drift_deviation |
Pro | Write | [CIPP] Update or acknowledge a configuration drift deviation via POST /api/ExecUpdateDriftDeviation. CRITICAL CASING: the body field is 'TenantFilter' (PascalCase, required), NOT camelCase 'tenantFilter' — the tool emits 'tenantFilter' for query-string compatibility but callers should pass 'TenantFilter' through fieldsJson. Body keys (exact spec casing): PascalCase 'TenantFilter' (required) and 'RemoveDriftCustomization' (string boolean — 'true'/'false'); lowercase 'deviations' (string, the deviation ID or payload), 'reason' (string, audit reason). |
cipp_add_bpa_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing, all lowercase): 'name' (string), 'style' (string enum: 'Tenant' | 'Table'). NO 'tenantFilter' field. Caller is responsible for exact spec casing. |
cipp_add_standards_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GUID' (string, all-caps — template ID), 'createdAt' (string), 'templateName' (string). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase) per CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_deploy_standards parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'tenant' (lowercase string, the target tenant domain — this is the ONLY field in the spec body). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. NOTE: the spec body field is lowercase 'tenant', NOT 'tenantFilter' — pass 'tenant' through fieldsJson if needed. |
cipp_drift_clone parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'id' (LOWERCASE string — the source drift template ID). This is the ONLY field. Caller is responsible for exact spec casing. |
cipp_list_bpa parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_domain_analyser parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_domain_health parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_standards parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_standards_compare parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_tenant_drift parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_bpa_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'TemplateName' (PascalCase string — distinct from 'templateId'). Caller is responsible for exact spec casing. |
cipp_remove_standard_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'ID' (string, all-caps — the template ID). Caller is responsible for exact spec casing. |
cipp_run_bpa parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'tenantfilter' (ALL LOWERCASE — distinct from the query-string camelCase 'tenantFilter'). This is the ONLY field in the spec body. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as camelCase 'tenantFilter' AND in the body as lowercase 'tenantfilter' per CIPP spec. Use cipp_list_tenants to discover available tenants. NOTE: pass 'tenantfilter' (lowercase) through fieldsJson if the live backend requires the exact spec casing. |
cipp_update_drift_deviation parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'RemoveDriftCustomization' (PascalCase string boolean — 'true'/'false'), 'TenantFilter' (PascalCase, required), 'deviations' (lowercase string), 'reason' (lowercase string). Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. NOTE: the spec body field is PascalCase 'TenantFilter' — pass it through fieldsJson if the live backend rejects camelCase. |
Audit
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_alert |
Pro | Write | [CIPP] Create a new alert rule in the CIPP alerts queue via POST /api/AddAlert. CIPP body keys are mixed: 'AlertComment' (PascalCase, string), 'RowKey' (PascalCase, string), 'actions' (camelCase, array of strings), 'command' (camelCase, object), 'conditions' (camelCase, string), 'count' (camelCase, string), 'excludedTenants' (camelCase, string), 'logbook' (camelCase, object), 'postExecution' (camelCase, array of strings — common channel values include 'webhook', 'email', 'psa'), 'preset' (camelCase, object), 'recurrence' (camelCase, object), 'startDateTime' (camelCase, ISO 8601 date-time string), 'tenantFilter' (camelCase, required). Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_exec_add_alert |
Pro | Write | [CIPP] Create a CIPP Core alert via POST /api/ExecAddAlert. CIPP body keys are mixed: 'Severity' (PascalCase, string) is the only PascalCase key; the rest are camelCase: 'email', 'logsToInclude', 'onePerTenant', 'sendEmailNow', 'sendPsaNow', 'sendWebhookNow', 'text', 'webhook', 'writeLog'. NOTE: per spec all values (including the boolean-flavored 'onePerTenant', 'sendEmailNow', 'sendPsaNow', 'sendWebhookNow', 'writeLog') are typed as STRINGS. NOT tenant-scoped (no tenantFilter). Supports webhook, email, and PSA notification channels. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_list_alerts |
Free | Read-only | [CIPP] List the CIPP alerts queue for a tenant via GET /api/ListAlertsQueue. Spec marks the body required even on this GET endpoint — the request must carry a JSON object. Spec body keys (mixed casing): 'Actions' (PascalCase), 'AlertComment' (PascalCase), 'command' (lowercase), 'logbook' (lowercase), 'postExecution' (camelCase), 'preset' (lowercase), 'recurrence' (lowercase), 'startDateTime' (camelCase). Returns alert messages, severity, timestamps, and resolution status. |
cipp_list_audit_log_searches |
Free | Read-only | [CIPP] List previously executed audit log search jobs. Returns search name, status, date range, and result count. |
cipp_list_audit_log_test |
Free | Read-only | [CIPP] Test audit log availability and configuration. Returns whether unified audit logging is enabled and accessible. |
cipp_list_audit_logs |
Free | Read-only | [CIPP] List Microsoft 365 unified audit log entries for a tenant. Returns user activity, admin actions, and service events. May return large datasets for active tenants. Consider using cipp_search_audit_logs with date filters for targeted results. |
cipp_list_logs |
Free | Read-only | [CIPP] List CIPP application logs for a tenant. Returns internal CIPP operation logs, errors, and status messages. |
cipp_list_pending_webhooks |
Free | Read-only | [CIPP] List webhook subscriptions that are pending validation or delivery via GET /api/ListPendingWebhooks. Returns webhook URLs, statuses, retry counts, and queued events. No request parameters per spec. |
cipp_list_signin_logs |
Free | Read-only | [CIPP] List Azure AD sign-in logs for a tenant. Returns user sign-in events, IP addresses, locations, and authentication details. May return large datasets for active tenants. Consider using cipp_search_audit_logs with date filters for targeted results. |
cipp_list_webhook_alerts |
Free | Read-only | [CIPP] List configured webhook alert subscriptions. Returns webhook URLs, event types, and enabled status. |
cipp_remove_queued_alert |
Pro | Write | [CIPP] Remove a queued alert via POST /api/RemoveQueuedAlert. CIPP body keys per spec: 'EventType' (PascalCase, string identifying the queued alert's event type/category) and 'ID' (PascalCase, all-caps, the alert row ID). Both fields are also accepted as query parameters. NOT tenant-scoped (no tenantFilter). Use cipp_list_alerts to find the ID. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_search_audit_logs |
Pro | Write | [CIPP] Submit or fetch a Microsoft 365 unified audit log search against POST /api/ExecAuditLogSearch. CIPP key casing is mixed and case-sensitive: StartTime, EndTime, SearchId, Action, PSObject are PascalCase; tenantFilter is camelCase. There is no 'operations' field on this endpoint — operation filtering is encoded inside PSObject (a serialized PowerShell parameter blob) when supplied. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_add_alert parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Alert configuration as JSON object. Body keys per spec: 'AlertComment' (PascalCase, string), 'RowKey' (PascalCase, string identifying the alert row when editing), 'actions' (camelCase, array of strings), 'command' (camelCase, object — typically a LabelValue {label,value} naming the alert command), 'conditions' (camelCase, string), 'count' (camelCase, string), 'excludedTenants' (camelCase, string), 'logbook' (camelCase, object), 'postExecution' (camelCase, array of strings — channels to fire after evaluation, common values 'webhook'/'email'/'psa'), 'preset' (camelCase, object), 'recurrence' (camelCase, object describing the alert schedule), 'startDateTime' (camelCase, ISO 8601 date-time). Example: {"command":{"label":"...","value":"..."},"recurrence":,"actions":["..."],"postExecution":["webhook"],"startDateTime":"2026-05-01T00:00:00Z"}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_exec_add_alert parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Alert configuration as JSON object. Body keys per spec (all values are string-typed per spec, even the boolean-flavored ones): 'Severity' (PascalCase, alert severity label), 'email' (camelCase, recipient email), 'logsToInclude' (camelCase, string of log categories to include), 'onePerTenant' (camelCase, string boolean — restricts to one alert per tenant), 'sendEmailNow' (camelCase, string boolean — fire email immediately), 'sendPsaNow' (camelCase, string boolean — fire PSA ticket immediately), 'sendWebhookNow' (camelCase, string boolean — fire webhook immediately), 'text' (camelCase, alert body text), 'webhook' (camelCase, webhook URL), 'writeLog' (camelCase, string boolean — also write to the CIPP log). Example: {"Severity":"High","text":"...","email":"alerts@msp.com","sendEmailNow":"true","writeLog":"true"}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_list_alerts parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'Actions' (PascalCase), 'AlertComment' (PascalCase), 'command' (lowercase), 'logbook' (lowercase), 'postExecution' (camelCase, object/array), 'preset' (lowercase), 'recurrence' (lowercase), 'startDateTime' (camelCase). Pass null for an empty body that satisfies the spec's required-body marker. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_audit_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_signin_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_remove_queued_alert parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Alert removal payload as JSON object. Body keys per spec: 'EventType' (PascalCase, the alert event type/category — also forwardable as query parameter), 'ID' (PascalCase, all-caps, the queued alert row ID — also forwardable as query parameter). Example: {"EventType":"<event-type>","ID":"<alert-row-id>"}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_search_audit_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Search action verb. Maps to body field 'Action' (PascalCase). Typical values: 'Submit' to start a new search, 'GetSearchResults' to retrieve results for an existing SearchId. Verify supported values against the live CIPP backend. |
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
endTime |
string | no | null | End of the search window. ISO 8601 (e.g., '2025-01-31T23:59:59Z'). Maps to body field 'EndTime' (PascalCase). |
psObject |
string | no | null | Serialized PowerShell parameter object passed verbatim to CIPP. Maps to body field 'PSObject' (PascalCase). Only set if you know the exact PowerShell parameter shape CIPP expects. |
searchId |
string | no | null | Existing audit log search ID to fetch results for. Maps to body field 'SearchId' (PascalCase). Pair with action='GetSearchResults' to retrieve a previously submitted search. |
startTime |
string | no | null | Start of the search window. ISO 8601 (e.g., '2025-01-01T00:00:00Z'). Maps to body field 'StartTime' (PascalCase). |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' query string AND as the 'tenantFilter' body field per the CIPP spec. Use cipp_list_tenants to discover available tenants. |
GDAP
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_gdap_role |
Pro | Write | [CIPP] Create a GDAP role mapping or invite via POST /api/ExecAddGDAPRole. CIPP key casing is mixed: 'Action', 'Reference' are PascalCase; 'customSuffix', 'gdapRoles', 'gdapTemplate', 'inviteCount', 'mappings', 'replace', 'templateId' are camelCase. NOT tenant-scoped (no tenantFilter). 'Action' is also accepted as a query parameter. 'gdapTemplate' is a LabelValue object {label,value}; 'gdapRoles' is an array of strings. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_approve_gdap_invite |
Pro | Write | [CIPP] Approve a pending GDAP invitation that has been accepted by the customer tenant. Finalizes the GDAP relationship. |
cipp_auto_extend_gdap |
Pro | Write | [CIPP] Auto-extend an expiring GDAP relationship via POST /api/ExecAutoExtendGDAP. The CIPP spec defines exactly one body field — 'ID' (PascalCase, all-caps, the GDAP relationship ID) — and accepts the same value as the 'ID' query parameter. NOT tenant-scoped (no tenantFilter). Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_invite |
Pro | Write | [CIPP] Delete a pending GDAP invitation via DELETE /api/ExecGDAPInvite. Spec marks the body required even though no individual property is required — the request must carry a JSON object. Spec body keys (mixed casing): 'Action' (PascalCase), 'InviteId' (PascalCase 'I'/'I'd), 'Reference' (PascalCase), 'gdapTemplate' (camelCase, LabelValue object), 'inviteCount' (camelCase, number), 'roleDefinitionId' (camelCase), 'roleMappings' (camelCase, LabelValue array). Use cipp_list_gdap_invites to find the invite ID. WARNING: This revokes a pending GDAP invite. |
cipp_delete_gdap_relationship |
Pro | Write | [CIPP] Delete a GDAP relationship via POST /api/ExecDeleteGDAPRelationship. The CIPP spec defines exactly one body field — 'GDAPId' (PascalCase, mixed-case 'GDAP' + 'Id' — case-sensitive) — accepted as the matching 'GDAPId' query parameter. NOT tenant-scoped (no tenantFilter). WARNING: This permanently terminates the GDAP relationship with the tenant. You will lose delegated access. Use cipp_list_gdap_access to find the GDAPId. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_role_mapping |
Pro | Write | [CIPP] Delete a GDAP role mapping via POST /api/ExecDeleteGDAPRoleMapping. The CIPP spec defines exactly one body field — 'GroupId' (PascalCase) — accepted as the matching 'GroupId' query parameter. NOT tenant-scoped (no tenantFilter). Removes the association between an Azure AD group and the delegated role mapping. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_role_template |
Pro | Write | [CIPP] Delete a GDAP role template via DELETE /api/ExecGDAPRoleTemplate. CIPP body keys per spec are mixed: 'GroupId', 'OriginalTemplateId', 'Reference', 'TemplateId' (all PascalCase strings); 'RoleMappings' (PascalCase, object); 'gdapTemplate' (camelCase, object); 'inviteCount' (camelCase, number). Query parameters per spec: 'Action' (string), 'TemplateId' (string). The same 'TemplateId' is accepted in BOTH query and body. NOT tenant-scoped (no tenantFilter). WARNING: removes the saved role template definition from CIPP. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_list_gdap_access |
Free | Read-only | [CIPP] List all GDAP access assignments across your partner tenant. Returns relationship IDs, customer tenants, roles, and expiration dates. |
cipp_list_gdap_invites |
Free | Read-only | [CIPP] List pending GDAP relationship invitations across your partner tenant. Returns invite status, customer details, and requested roles. |
cipp_list_gdap_roles |
Free | Read-only | [CIPP] List all GDAP (Granular Delegated Admin Privileges) roles available in your partner tenant. Returns role names, IDs, and descriptions. |
cipp_list_partner_relationships |
Free | Read-only | [CIPP] List partner relationships (DAP/GDAP) for a specific tenant. Returns relationship type, status, and delegated permissions. |
cipp_patch_gdap_access_assignment |
Pro | Write | [CIPP] Update a GDAP access assignment via PATCH /api/ExecGDAPAccessAssignment. CIPP body keys are mixed: 'Action' (PascalCase), 'Id' (PascalCase, mixed 'I'+'d'), 'RoleTemplateId' (PascalCase). NOT tenant-scoped (no tenantFilter). 'Action' and 'Id' are also accepted as query parameters. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_remove_gdap_ga_role |
Pro | Write | [CIPP] Remove the Global Administrator role from a GDAP relationship via POST /api/ExecGDAPRemoveGArole. The CIPP spec defines exactly one body field — 'GDAPId' (PascalCase, mixed-case 'GDAP' + 'Id') — accepted as the matching 'GDAPId' query parameter. NOT tenant-scoped (no tenantFilter). Reduces delegated privileges by removing the GA role assignment from this relationship. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_add_gdap_role parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | GDAP role mapping payload as JSON object. Body keys per spec: 'Action' (PascalCase, the operation verb — also forwardable as query parameter), 'Reference' (PascalCase, audit reference string), 'customSuffix' (camelCase, suffix appended to created group names), 'gdapRoles' (camelCase, array of role definition GUIDs), 'gdapTemplate' (camelCase, LabelValue object {label,value} identifying a GDAP template), 'inviteCount' (camelCase, number of invites to create), 'mappings' (camelCase), 'replace' (camelCase), 'templateId' (camelCase). Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_auto_extend_gdap parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Extension configuration as JSON object. Required body keys per spec: 'ID' (PascalCase, all-caps) — the GDAP relationship ID. Example: {"ID":"<gdap-relationship-guid>"}. Same field is accepted as a query parameter; CIPP forwards either form. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_invite parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Action verb passed verbatim by CIPP. Sent as body key 'Action' (PascalCase). |
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'gdapTemplate' (camelCase, LabelValue object), 'inviteCount' (camelCase number), 'roleDefinitionId' (camelCase), 'roleMappings' (camelCase, LabelValue array). |
inviteId |
string | no | null | Invite ID to revoke. Sent as body key 'InviteId' (PascalCase). Use cipp_list_gdap_invites to find valid invite IDs. |
reference |
string | no | null | Optional reference/audit string. Sent as body key 'Reference' (PascalCase). |
cipp_delete_gdap_relationship parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Relationship identification as JSON object. Required body key per spec: 'GDAPId' (PascalCase, mixed-case 'GDAP' + 'Id', case-sensitive). Example: {"GDAPId":"<gdap-relationship-guid>"}. Same field is accepted as a query parameter. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_role_mapping parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Role mapping identification as JSON object. Required body key per spec: 'GroupId' (PascalCase) — the Azure AD group ID whose mapping is being removed. Example: {"GroupId":"<group-guid>"}. Same field is accepted as a query parameter. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_delete_gdap_role_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GroupId' (PascalCase string), 'OriginalTemplateId' (PascalCase string), 'Reference' (PascalCase string), 'RoleMappings' (PascalCase object), 'TemplateId' (PascalCase string — the template GUID; also accepted as query parameter), 'gdapTemplate' (camelCase object), 'inviteCount' (camelCase number). Example: {"TemplateId":"<template-guid>"}. Caller is responsible for exact spec casing. |
cipp_list_partner_relationships parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_patch_gdap_access_assignment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Updated assignment fields as JSON object. Body keys per spec: 'Action' (PascalCase, the operation verb — also forwardable as query parameter), 'Id' (PascalCase, the access assignment ID — also forwardable as query parameter), 'RoleTemplateId' (PascalCase, the directory role template ID). Example: {"Action":"<verb>","Id":"<assignment-guid>","RoleTemplateId":"<role-template-guid>"}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_remove_gdap_ga_role parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | GDAP GA role removal parameters as JSON object. Required body key per spec: 'GDAPId' (PascalCase, mixed-case 'GDAP' + 'Id', case-sensitive) — the GDAP relationship ID. Example: {"GDAPId":"<gdap-relationship-guid>"}. Same field is accepted as a query parameter. Keys are passed verbatim — caller is responsible for exact spec casing. |
Scheduler
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_scheduled_item |
Pro | Write | [CIPP] Create a new scheduled task in CIPP via POST /api/AddScheduledItem. CIPP key casing is mixed and case-sensitive: 'Name', 'RawJsonParameters', 'RowKey', 'RunNow', 'ScheduledTime', 'DesiredStartTime', 'DisallowDuplicateName', 'CippCustomVariables', 'CippScriptedAlerts', 'CippWebhookAlerts', 'Recurrence', 'Trigger' are PascalCase; 'command', 'tenantFilter', 'taskType', 'parameters', 'reference', 'overwrite', 'advancedParameters', 'antiphishing', 'antispam', 'backup', 'ca', 'email', 'groups', 'intunecompliance', 'intuneconfig', 'intuneprotection', 'psa', 'users', 'webhook', 'postExecution' are lowercase/camelCase. 'tenantFilter' is required by the spec and is an object — the LabelValue {label, value} shape is used here for compatibility. The 'hidden' query parameter from the live spec is NOT supported by this tool because the underlying client method has no query-string overload; pass it through additionalFieldsJson only if CIPP also accepts it in the body. Use additionalFieldsJson for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_list_scheduled_item_details |
Free | Read-only | [CIPP] Get details for a single scheduled item via POST /api/ListScheduledItemDetails. Required body key (exact spec casing): 'RowKey' (PascalCase — the scheduled item's row key). Same value also accepted as a query parameter. Use cipp_list_scheduled_items first to find the row key. |
cipp_list_scheduled_items |
Free | Read-only | [CIPP] List all scheduled tasks and jobs in CIPP. Returns task name, command, schedule, and last execution status. These are CIPP-level scheduled items, not tenant-specific. |
cipp_remove_scheduled_item |
Pro | Write | [CIPP] Remove a scheduled task from CIPP. Use cipp_list_scheduled_items first to find the task ID. These are CIPP-level scheduled items, not tenant-specific. |
cipp_run_scheduler_billing |
Pro | Write | [CIPP] Trigger an immediate scheduler billing run via GET /api/ExecSchedulerBillingRun. Forces CIPP to evaluate billing-related scheduled jobs out-of-cycle. No request parameters per spec. NOT tenant-scoped. |
cipp_add_scheduled_item parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
advancedParameters |
boolean | no | null | If true, expose advanced parameter editing for this schedule. Maps to body field 'advancedParameters' (camelCase). |
antiphishing |
boolean | no | null | Toggle anti-phishing tasks. Maps to body field 'antiphishing' (camelCase, all lowercase). |
antispam |
boolean | no | null | Toggle anti-spam tasks. Maps to body field 'antispam' (camelCase, all lowercase). |
backupValue |
string | no | null | Backup target as a LabelValue. Maps to body field 'backup' (camelCase). Pass the value (e.g., the backup destination identifier); the tool wraps it as {label: <value>, value: <value>}. |
ca |
boolean | no | null | Toggle conditional access tasks. Maps to body field 'ca' (camelCase). |
cippCustomVariables |
boolean | no | null | Enable/disable use of CIPP custom variables in the schedule. Maps to body field 'CippCustomVariables' (PascalCase). |
cippScriptedAlerts |
boolean | no | null | Enable scripted alerts integration. Maps to body field 'CippScriptedAlerts' (PascalCase). |
cippWebhookAlerts |
boolean | no | null | Enable webhook alerts integration. Maps to body field 'CippWebhookAlerts' (PascalCase). |
commandJson |
string | no | null | Command/endpoint object to execute on schedule. Maps to body field 'command' (camelCase). Pass a JSON object string (e.g., '{"label":"Standards","value":"ExecStandardsRun"}'); the tool parses it and embeds it as an object. Leave null to omit. |
desiredStartTime |
string | no | null | Desired start time as a string. Maps to body field 'DesiredStartTime' (PascalCase). Verify the expected format (likely ISO 8601 or Unix epoch as string) against the live CIPP backend. |
disallowDuplicateName |
boolean | no | null | If true, CIPP rejects the create when an item with the same Name already exists. Maps to body field 'DisallowDuplicateName' (PascalCase). |
email |
boolean | no | null | Toggle email tasks. Maps to body field 'email' (camelCase). |
groups |
boolean | no | null | Toggle groups tasks. Maps to body field 'groups' (camelCase). |
intunecompliance |
boolean | no | null | Toggle Intune compliance tasks. Maps to body field 'intunecompliance' (camelCase, all lowercase). |
intuneconfig |
boolean | no | null | Toggle Intune configuration tasks. Maps to body field 'intuneconfig' (camelCase, all lowercase). |
intuneprotection |
boolean | no | null | Toggle Intune protection tasks. Maps to body field 'intuneprotection' (camelCase, all lowercase). |
name |
string | yes | Display name for the scheduled task. Maps to body field 'Name' (PascalCase). | |
overwrite |
boolean | no | null | If true, allow overwriting an existing scheduled item with the same key. Maps to body field 'overwrite' (camelCase). |
parametersJson |
string | no | null | Free-form parameters object passed to the scheduled command. Maps to body field 'parameters' (camelCase). Pass a JSON object string; the tool parses it and embeds it as an object. |
postExecutionChannels |
string | no | null | Comma-separated post-execution channels to fire after task completion. Maps to body field 'postExecution' (array of strings, camelCase). Common values: 'webhook', 'email', 'psa'. Leave null to omit. |
psa |
boolean | no | null | Top-level psa toggle (separate from postExecution). Maps to body field 'psa' (camelCase). |
rawJsonParameters |
string | no | null | Pre-serialized JSON parameters string (alternative to parametersJson). Maps to body field 'RawJsonParameters' (PascalCase) — sent as a string, not an object. |
recurrenceJson |
string | no | null | Recurrence configuration. Maps to body field 'Recurrence' (PascalCase). Pass a JSON object string describing CIPP's recurrence schema (cadence, interval, days, etc.). |
reference |
string | no | null | Free-form audit reference string written into the schedule history. Maps to body field 'reference' (camelCase). |
rowKey |
string | no | null | Existing row key when editing an entry; usually null when creating new. Maps to body field 'RowKey' (PascalCase). |
runNow |
boolean | no | null | If true, run the task immediately rather than waiting for the next scheduled fire. Maps to body field 'RunNow' (PascalCase). |
scheduledTime |
integer | no | null | Unix epoch (integer seconds) representing the scheduled execution time. Maps to body field 'ScheduledTime' (PascalCase). |
taskTypeJson |
string | no | null | Task type object. Maps to body field 'taskType' (camelCase). Pass a JSON object string (commonly the LabelValue shape {label, value}); the tool parses it and embeds it as an object. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com) the scheduled task runs against. Maps to body field 'tenantFilter' (camelCase) and is wrapped as the LabelValue object {label, value} for cross-version compatibility. Use cipp_list_tenants to discover available tenants. | |
triggerJson |
string | no | null | Trigger configuration. Maps to body field 'Trigger' (PascalCase). Pass a JSON object string describing CIPP's trigger schema. |
users |
boolean | no | null | Toggle users-related tasks. Maps to body field 'users' (camelCase). |
webhook |
boolean | no | null | Top-level webhook toggle (separate from postExecution). Maps to body field 'webhook' (camelCase). |
cipp_list_scheduled_item_details parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'RowKey' (PascalCase string — the scheduled item row key). Example: {"RowKey":"<row-key>"}. Caller is responsible for exact spec casing. |
cipp_remove_scheduled_item parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
id |
string | yes | Scheduled item ID to remove. Use cipp_list_scheduled_items to find valid IDs. |
Utility
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_breach_search |
Pro | Write | [CIPP] Trigger a tenant-wide breach search via POST /api/ExecBreachSearch. The CIPP spec for this endpoint defines only one body field — 'tenantFilter' (camelCase, required) — so this tool does not expose per-email targeting. Returns breach sources, dates, and exposed data types for the tenant. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_geoip_lookup |
Free | Read-only | [CIPP] Look up geographic location information for an IP address via POST /api/ExecGeoIPLookup. Returns country, city, ISP, and threat intelligence data. CIPP body field is 'IP' (uppercase) per spec — case-sensitive. This endpoint is NOT tenant-scoped. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_get_alerts |
Free | Read-only | [CIPP] Get current CIPP system alerts and notifications. Returns alert messages, severity, and recommended actions. |
cipp_get_csp_license |
Free | Read-only | [CIPP] Get detailed CSP license information for a specific tenant via GET /api/ExecCSPLicense. Spec marks the body required (unusual for GET) with required camelCase 'tenantFilter'. Optional body keys: 'Action' (PascalCase), 'Add' (PascalCase), 'iagree' (lowercase boolean), 'Quantity' (PascalCase number), 'Remove' (PascalCase), 'SKU' (PascalCase LabelValue), 'SubscriptionIds' (PascalCase). For modifying licenses use cipp_manage_csp_license (POST verb). |
cipp_get_version |
Free | Read-only | [CIPP] Get the current CIPP instance version and build information. |
cipp_graph_request |
Pro | Write | [CIPP] Execute a single custom Microsoft Graph API request against a tenant via GET /api/ListGraphRequest. Use this for read-only Graph queries that don't have a dedicated CIPP MCP tool. Spec query parameters (case-sensitive — preserve EXACTLY): tenantFilter (camelCase string, REQUIRED — target tenant domain), Endpoint (PascalCase string — Graph endpoint path, e.g., '/users', '/groups'), AsApp (PascalCase string — boolean-as-string, when 'true' uses application permissions), Version (PascalCase string — Graph API version, e.g., 'v1.0' or 'beta'), graphFilter (camelCase string — OData $filter expression), Sort (PascalCase string — OData $orderby expression), expand (camelCase string — OData $expand expression), ListProperties (PascalCase string — properties to return), CountOnly (PascalCase string — boolean-as-string, return only the result count), NoPagination (PascalCase string — boolean-as-string, disable auto-pagination), manualPagination (camelCase string — boolean-as-string), IgnoreErrors (PascalCase string — boolean-as-string), ReverseTenantLookup (PascalCase string — boolean-as-string), ReverseTenantLookupProperty (PascalCase string), SkipCache (PascalCase string — boolean-as-string), QueueId (PascalCase string — CIPP queue id for batched calls), QueueNameOverride (PascalCase string), nextLink (camelCase string — Graph @odata.nextLink for resuming pagination). The current tool signature only exposes tenantFilter and endpoint (mapped to the Endpoint query parameter); other query parameters are not yet exposed. For multi-request bulk Graph operations use cipp_bulk_graph_request instead. Returns raw Graph JSON. Use with caution — broad access bypasses CIPP's domain-specific safety prompts. |
cipp_list_breaches_account |
Free | Read-only | [CIPP] List known data breaches associated with email accounts. Returns breach sources, dates, and types of exposed data. |
cipp_list_breaches_tenant |
Free | Read-only | [CIPP] List known data breaches associated with a tenant's domain. Returns breach sources, dates, and affected accounts. |
cipp_list_csp_sku |
Free | Read-only | [CIPP] List available CSP (Cloud Solution Provider) SKUs and license offerings. Returns SKU names, IDs, and pricing tiers. |
cipp_list_users_and_groups |
Free | Read-only | [CIPP] List all users and groups together for quick directory browsing. Returns combined results with type indicators. |
cipp_manage_csp_license |
Pro | Write | [CIPP] Add, change, or remove CSP license subscriptions via POST /api/ExecCSPLicense. CIPP body keys are mixed: 'Action' (PascalCase, string — the operation verb), 'Add' (PascalCase, string), 'Quantity' (PascalCase, number — the only numeric field), 'Remove' (PascalCase, string), 'SKU' (PascalCase, LabelValue object {label,value} identifying the CSP SKU/offer), 'SubscriptionIds' (PascalCase, string), 'iagree' (lowercase, boolean — caller agreement to the CSP terms; CIPP requires this true to commit), 'tenantFilter' (camelCase, required). 'Quantity' is the only number; 'iagree' is the only native boolean. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_universal_search |
Free | Read-only | [CIPP] Search across all CIPP data for a tenant including users, devices, groups, and policies. Returns matching results from all categories. This is a broad search across all data types. For targeted lookups, use specific list tools (cipp_list_users, cipp_list_devices) which are faster. |
cipp_universal_search_v2 |
Free | Read-only | [CIPP] Search across all CIPP data using the V2 search engine. Returns matching results from users, devices, groups, and policies across all tenants. This is a broad search across all data types. For targeted lookups, use specific list tools (cipp_list_users, cipp_list_devices) which are faster. |
cipp_breach_search parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' query string AND as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. Use cipp_list_tenants to discover available tenants. |
cipp_geoip_lookup parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
ip |
string | yes | The IP address to look up (IPv4 or IPv6). Maps to body field 'IP' (uppercase) per the CIPP spec. |
cipp_get_csp_license parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase 'tenantFilter' on the query string AND in the required body per the live spec. |
cipp_graph_request parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
endpoint |
string | yes | Microsoft Graph API endpoint path (e.g., '/users', '/groups', '/devices', '/directoryRoles', '/policies/identityProtection/...'). Sent as the Endpoint query-string parameter (PascalCase). The leading slash is conventional but CIPP accepts either form. | |
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. The live spec marks the body required even on this GET endpoint, but lists no required properties — the request must carry an empty (or caller-supplied) JSON object to satisfy the spec. The published optional body keys appear inherited and are typically left empty. Pass null to send an empty body. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the tenantFilter query-string parameter (camelCase, required per spec). Use cipp_list_tenants to discover available tenants. |
cipp_manage_csp_license parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | License management configuration as JSON object. Body keys per spec: 'Action' (PascalCase, string — operation verb), 'Add' (PascalCase, string), 'Quantity' (PascalCase, number — the new total or delta units), 'Remove' (PascalCase, string), 'SKU' (PascalCase, LabelValue object {label,value} identifying the CSP SKU/product offer — use cipp_list_csp_sku to discover available SKUs), 'SubscriptionIds' (PascalCase, string of subscription IDs to act on), 'iagree' (lowercase, BOOLEAN — must be true for CIPP to commit the CSP order). Example: {"Action":"add","SKU":{"label":"Microsoft 365 Business Premium","value":"<sku-id>"},"Quantity":10,"iagree":true}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_universal_search parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
Diagnostics
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_app_insights_query |
Business | Read-only | [CIPP] Query Application Insights telemetry for the CIPP backend via GET /api/ExecAppInsightsQuery. Used for diagnostics and performance review. No request parameters per spec. |
cipp_cipp_db_cache |
Free | Read-only | [CIPP] Read CIPP database cache control values via GET /api/ExecCIPPDBCache. Used to inspect the DB cache state. Spec query: 'Name' (string), 'tenantFilter' (camelCase, required), 'Types' (string). The current client method takes no parameters. |
cipp_clone_template |
Pro | Write | [CIPP] Clone a CIPP template (CA, standards, alert, etc.) via POST /api/ExecCloneTemplate. CIPP body keys per spec (both PascalCase): 'GUID' (string — the source template GUID) and 'Type' (string — the template kind). Both fields also accepted as query parameters. NOT tenant-scoped. |
cipp_cpv_refresh |
Pro | Write | [CIPP] Refresh CSP Vendor (CPV) consent and permissions across managed tenants via GET /api/ExecCPVRefresh. Re-applies CPV permissions to tenants that have drifted. No request parameters per spec. |
cipp_delete_graph_explorer_preset |
Pro | Write | [CIPP] Delete a saved Graph Explorer preset via DELETE /api/ExecGraphExplorerPreset. Spec marks the body required even though no individual property is required. Spec body keys (mixed casing): 'AsApp' (PascalCase), 'IsShared' (PascalCase), 'NoPagination' (PascalCase), 'ReverseTenantLookup' (PascalCase), 'ReverseTenantLookupProperty' (PascalCase), 'action' (lowercase), 'endpoint' (lowercase), 'name' (lowercase), 'preset' (lowercase), 'reportTemplate' (camelCase LabelValue), 'version' (camelCase LabelValue). Use cipp_list_graph_explorer_presets first to find preset names. |
cipp_download_cipp_logs |
Business | Write | [CIPP] Generate SAS-signed URLs to download CIPP application logs via POST /api/ExecCippLogsSas. Spec body required: (PascalCase 'Days', the lookback window). Role CIPP.AppSettings.ReadWrite — operator-class diagnostics for the CIPP instance itself, NOT tenant-scoped. |
cipp_durable_functions |
Business | Read-only | [CIPP] Read CIPP Durable Functions state via GET /api/ExecDurableFunctions. Useful for diagnosing background job state. Spec query: 'Action' (string), 'PartitionKey' (string). The current client method takes no parameters. |
cipp_edit_template |
Pro | Write | [CIPP] Edit a CIPP template (CA, standards, alert, etc.) via POST /api/ExecEditTemplate. CIPP body keys per spec (mixed casing): 'GUID' (PascalCase, all-caps — the template GUID), 'Type' (PascalCase string — the template kind), 'description' (lowercase string), 'displayName' (camelCase string), 'id' (lowercase string), 'name' (lowercase string), 'parsedRAWJson' (camelCase string — note 'RAW' all-caps). Spec query: 'Type' (string). NOT tenant-scoped. |
cipp_extension_ninja_one_queue |
Free | Read-only | [CIPP] List the NinjaOne extension processing queue via GET /api/ExecExtensionNinjaOneQueue. Useful for diagnosing CIPP NinjaOne sync state. No request parameters per spec. |
cipp_list_admin_portal_licenses |
Free | Read-only | [CIPP] List the low-friction trial license allotments visible from the M365 admin portal for a tenant via GET /api/ListAdminPortalLicenses (camelCase 'tenantFilter' query, required). Returns only admin-portal trial allotments, so an empty result is normal for a tenant with no active trials. For full assigned-license SKU counts and renewal/term data use cipp_list_licenses. |
cipp_list_api_test |
Free | Read-only | [CIPP] Run the CIPP API self-test via GET /api/ListApiTest. Returns connectivity status, permission summary, and basic configuration health for the CIPP API itself. No request parameters per spec. |
cipp_list_azure_ad_connect_status |
Free | Read-only | [CIPP] List Azure AD Connect (Entra Connect) sync status across all managed tenants via GET /api/ListAzureADConnectStatus. Returns hybrid identity sync state, last successful sync, and any sync errors. No request parameters per spec — MSP-scope report covering every onboarded tenant. |
cipp_list_backup |
Business | Read-only | [CIPP] List CIPP backup snapshots via GET /api/ExecListBackup. Useful for diagnostics and pre-restore verification. Spec query: 'BackupName' (string), 'NameOnly' (string), 'tenantFilter' (camelCase, required), 'Type' (string). The current client method takes no parameters. |
cipp_list_check_ext_alerts |
Free | Read-only | [CIPP] List external system alerts via GET /api/ListCheckExtAlerts. Spec query: 'tenantFilter' (camelCase, required). The current client method takes no parameters; verify tenantFilter routing against the live backend. |
cipp_list_custom_data_mappings |
Free | Read-only | [CIPP] List CIPP custom-data-mapping definitions via GET /api/ListCustomDataMappings. Spec query: 'directoryObject' (string), 'sourceType' (string), 'tenantFilter' (camelCase, required). The current client method takes no parameters. |
cipp_list_db_cache |
Free | Read-only | [CIPP] List CIPP database cache contents via GET /api/ListDBCache. Used for diagnosing data staleness. Spec query: 'tenantFilter' (camelCase, required), 'type' (string). The current client method takes no parameters. |
cipp_list_diagnostics_presets |
Business | Read-only | [CIPP] List saved diagnostic query presets via GET /api/ListDiagnosticsPresets. Useful for diagnosing CIPP-side issues. No request parameters per spec. |
cipp_list_directory_objects |
Free | Read-only | [CIPP] Resolve directory object IDs for a tenant via POST /api/ListDirectoryObjects. CIPP body keys per spec (all camelCase, all string-typed): 'asApp' (string boolean), 'ids' (string — comma-separated object IDs), 'partnerLookup' (string), 'tenantFilter' (string, required). The tool injects 'tenantFilter' from the typed parameter. |
cipp_list_extension_cache_data |
Free | Read-only | [CIPP] Read CIPP extension cache data for a tenant via POST /api/ListExtensionCacheData. CIPP body keys per spec (all camelCase): 'dataTypes' (string — extension category) and 'tenantFilter' (string, required). Both fields also accepted as query parameters. The tool injects 'tenantFilter' from the typed parameter. |
cipp_list_extensions_config |
Free | Read-only | [CIPP] List CIPP extension configurations via GET /api/ListExtensionsConfig. Spec marks a body required (with optional 'Description', 'Private' boolean, 'includeforks' boolean, 'orgName' object, 'repoName' string, 'searchTerm' object); use additionalFieldsJson to pass them. Returns the configured extensions and their settings. |
cipp_list_feature_flags |
Free | Read-only | [CIPP] List CIPP feature flags via GET /api/ListFeatureFlags. Returns each flag's name and enabled state. No request parameters per spec. |
cipp_list_function_parameters |
Free | Read-only | [CIPP] List the parameter schema for a CIPP function via GET /api/ListFunctionParameters. Spec query: 'Compliance' (string), 'Function' (string), 'Module' (string). The current client method takes no parameters. |
cipp_list_function_stats |
Free | Read-only | [CIPP] List CIPP function execution statistics via GET /api/ListFunctionStats. Spec query: 'FunctionType' (string), 'Interval' (string), 'tenantFilter' (camelCase, required), 'Time' (string). The current client method takes no parameters. |
cipp_list_generic_test_function |
Free | Read-only | [CIPP] Run the CIPP generic test function via GET /api/ListGenericTestFunction. Returns CIPP test diagnostic output. No request parameters per spec. |
cipp_list_graph_explorer_presets |
Free | Read-only | [CIPP] List saved Graph Explorer query presets via GET /api/ListGraphExplorerPresets. Spec query: 'Endpoint' (string). The current client method takes no parameters. |
cipp_list_halo_clients |
Free | Read-only | [CIPP] List HaloPSA clients visible to CIPP via GET /api/ListHaloClients. Used by the CIPP HaloPSA extension. No request parameters per spec. |
cipp_list_ip_whitelist |
Free | Read-only | [CIPP] List CIPP's allowed IP ranges via GET /api/ListIPWhitelist. Returns IP ranges configured for trusted access to CIPP. No request parameters per spec. |
cipp_list_known_ip_db |
Free | Read-only | [CIPP] List the CIPP known-IP database for a tenant via GET /api/ListKnownIPDb. Returns previously seen sign-in IPs and the geo/risk metadata CIPP cached for them. Spec query: 'tenantFilter' (camelCase, required). The current client method takes no parameters. |
cipp_list_notification_config |
Business | Read-only | [CIPP] Read the CIPP notification configuration via GET /api/ListNotificationConfig. Returns email recipients, webhook URLs, and severity filters. No request parameters per spec. |
cipp_partner_webhook |
Business | Write | [CIPP] Configure Microsoft Partner Center webhook delivery via POST /api/ExecPartnerWebhook. CIPP body keys per spec: 'EventType' (PascalCase, object — typically a LabelValue {label,value}), 'enabled' (camelCase boolean), 'standardsExcludeAllTenants' (camelCase boolean). Spec query: 'Action' (string), 'CorrelationId' (string). |
cipp_set_cipp_auto_backup |
Business | Write | [CIPP] Enable or disable CIPP automatic backups via POST /api/ExecSetCIPPAutoBackup. Required body key per spec: 'Enabled' (PascalCase boolean — true to enable, false to disable). NOT tenant-scoped. |
cipp_set_package_tag |
Pro | Write | [CIPP] Tag a CIPP package (e.g., for app deployments) via POST /api/ExecSetPackageTag. Required body keys per spec (all PascalCase strings): 'GUID' (the package GUID), 'Package' (package identifier), 'Remove' (string boolean — 'true' to remove the tag, 'false' to add). NOT tenant-scoped. |
cipp_set_user_bookmarks |
Pro | Write | [CIPP] Persist a CIPP UI user's bookmarks/settings blob via POST /api/ExecUserBookmarks. Spec body required: { currentSettings (camelCase, the bookmarks/settings payload), user (lowercase, the CIPP user identifier — typically UPN) }. NOT tenant-scoped — this is per-CIPP-user state stored against the calling identity. |
cipp_user_settings |
Pro | Write | [CIPP] Save the current CIPP user's UI/app settings via POST /api/ExecUserSettings. Body keys per spec: 'currentSettings' (camelCase string — serialized settings blob), 'user' (camelCase object — typically the current user). NOT tenant-scoped. |
cipp_clone_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GUID' (PascalCase string — the source template GUID), 'Type' (PascalCase string — the template kind, e.g., a CIPP template type identifier). Both fields also accepted as query parameters. Example: {"GUID":"<template-guid>","Type":"<template-type>"}. Caller is responsible for exact spec casing. |
cipp_delete_graph_explorer_preset parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Action verb passed verbatim by CIPP (e.g., 'Delete'). Sent as body key 'action' (lowercase). |
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (preserve EXACTLY): 'AsApp' (PascalCase), 'IsShared' (PascalCase), 'NoPagination' (PascalCase), 'ReverseTenantLookup' (PascalCase), 'ReverseTenantLookupProperty' (PascalCase), 'endpoint' (lowercase), 'reportTemplate' (camelCase LabelValue), 'version' (camelCase LabelValue). |
name |
string | no | null | Preset name to delete. Sent as body key 'name' (lowercase). Use cipp_list_graph_explorer_presets to find valid names. |
preset |
string | no | null | Preset identifier (alternative to name). Sent as body key 'preset' (lowercase). |
cipp_download_cipp_logs parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
days |
string | yes | Lookback window in days as a string (e.g., '7'). Sent as body key 'Days' (PascalCase, string-typed per spec). |
cipp_edit_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'GUID' (PascalCase, all-caps), 'Type' (PascalCase string), 'description' (lowercase string), 'displayName' (camelCase string), 'id' (lowercase string), 'name' (lowercase string), 'parsedRAWJson' (camelCase string — 'RAW' all-caps). Example: {"GUID":"<template-guid>","Type":"<template-type>","name":"...","parsedRAWJson":"..."}. Caller is responsible for exact spec casing. |
cipp_list_admin_portal_licenses parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. |
cipp_list_directory_objects parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing, all camelCase, all string-typed): 'asApp' (string boolean — when set, calls Graph as the application), 'ids' (string — comma-separated object IDs to resolve), 'partnerLookup' (string). Example: {"ids":"<guid1>,<guid2>","asApp":"true"}. The tool injects 'tenantFilter' from the typed parameter. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase, required) per CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_list_extension_cache_data parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'dataTypes' (camelCase string — the extension category to read; also accepted as query parameter). Example: {"dataTypes":"<category>"}. The tool injects 'tenantFilter' from the typed parameter. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the 'tenantFilter' body field (camelCase, required) per CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_list_extensions_config parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Optional JSON object merged into the request body. Spec-listed body keys (exact casing): 'Description' (PascalCase string), 'Private' (PascalCase boolean), 'includeforks' (lowercase boolean), 'orgName' (camelCase object), 'repoName' (camelCase string), 'searchTerm' (camelCase object). Caller is responsible for exact spec casing. |
cipp_partner_webhook parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'EventType' (PascalCase object — typically a LabelValue {label,value} naming the webhook event type), 'enabled' (camelCase boolean — turn the webhook on/off), 'standardsExcludeAllTenants' (camelCase boolean). Example: {"EventType":{"label":"...","value":"..."},"enabled":true,"standardsExcludeAllTenants":false}. Caller is responsible for exact spec casing. |
cipp_set_cipp_auto_backup parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'Enabled' (PascalCase boolean). Example: {"Enabled":true}. Caller is responsible for exact spec casing. |
cipp_set_package_tag parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing, all PascalCase strings): 'GUID' (the package GUID), 'Package' (the package identifier), 'Remove' (string boolean — 'true' to remove the tag, 'false' to add). Example: {"GUID":"<pkg-guid>","Package":"<pkg-id>","Remove":"false"}. Caller is responsible for exact spec casing. |
cipp_set_user_bookmarks parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
currentSettingsJson |
string | yes | Bookmarks/settings payload as a JSON-stringified object. Sent verbatim as body key 'currentSettings' (camelCase, structure defined by the CIPP UI). | |
user |
string | yes | CIPP user identifier (typically UPN of the CIPP operator). Sent as body key 'user' (lowercase). |
cipp_user_settings parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'currentSettings' (camelCase string — serialized settings blob), 'user' (camelCase object — typically a representation of the current user). Example: {"user":,"currentSettings":"..."}. Caller is responsible for exact spec casing. |
Analytics
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_test_report |
Pro | Write | [CIPP] Create a new CIPP test report definition via POST /api/AddTestReport. Required body keys per spec (all camelCase, all string-typed): 'DevicesTests' (string — device-test selection blob), 'IdentityTests' (string — identity-test selection blob), 'description' (string), 'name' (string). NOTE: 'DevicesTests' / 'IdentityTests' are PascalCase exceptions in this otherwise-camelCase body. NOT tenant-scoped. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_all_tenant_bpa |
Business | Read-only | [CIPP] Get Best Practice Analyzer results across all managed tenants. Returns per-tenant pass/fail summaries for security and configuration checks. This runs BPA across all tenants and may take several minutes. For a single tenant, use cipp_list_bpa instead. |
cipp_all_tenant_compliance |
Business | Read-only | [CIPP] Get device compliance summary across all managed tenants. Returns per-tenant compliance rates, non-compliant device counts, and policy violations. This queries all managed tenants and may take 30+ seconds. For a single tenant, use cipp_list_compliance_policies instead. |
cipp_all_tenant_secure_score |
Business | Write | [CIPP] Refresh and retrieve the Microsoft Secure Score for a tenant via POST /api/ExecUpdateSecureScore. Spec marks the body required with required PascalCase 'TenantFilter' (NOT camelCase tenantFilter — this endpoint is one of CIPP's PascalCase-body outliers). Optional body fields: 'ControlName', 'reason', 'resolutionType', 'vendorInformation' for acknowledging/resolving specific Secure Score control deviations. |
cipp_bulk_graph_request |
Business | Write | [CIPP] Execute a Microsoft Graph API request across multiple tenants in bulk via POST /api/ListGraphBulkRequest. CIPP body keys per spec are ALL camelCase and ALL STRING-typed (no native arrays/booleans/objects on this endpoint): 'asApp' (string boolean — when set, calls Graph as the application rather than delegated), 'noPaginateIds' (string), 'requests' (string — typically a JSON-encoded blob describing the Graph requests), 'tenantFilter' (string, required). May take significant time depending on the number of tenants. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_test_report |
Pro | Write | [CIPP] Delete a CIPP test report definition via POST /api/DeleteTestReport. Required body key per spec: 'ReportId' (PascalCase string — the report GUID to delete). NOT tenant-scoped. Use cipp_list_test_reports to find the report ID. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_list_available_tests |
Free | Read-only | [CIPP] List all available CIPP tests that can be selected for a report via GET /api/ListAvailableTests. Spec marks a body required (with optional 'description' and 'name' string keys) but the body fields are filters; use additionalFieldsJson to pass them. Returns test catalog entries. |
cipp_list_test_reports |
Free | Read-only | [CIPP] List saved CIPP test report definitions via GET /api/ListTestReports. Returns report names, descriptions, and configured device/identity test selections. No request parameters per spec. |
cipp_list_tests |
Free | Read-only | [CIPP] List the results of a test run for a tenant via POST /api/ListTests. Body keys per spec (all camelCase): 'reportId' (string — the test report ID) and 'tenantFilter' (string, required). Both fields also accepted as query parameters. Use cipp_list_test_reports to find report IDs. |
cipp_offboard_tenant |
Business | Write | [CIPP] Offboard a customer tenant via PATCH /api/ExecOffboardTenant. CIPP body keys per spec are ALL PascalCase: 'RemoveCSPGuestUsers' (boolean), 'RemoveCSPnotificationContacts' (boolean — note 'notification' is lowercase in the middle of the otherwise-PascalCase key), 'RemoveDomainAnalyserData' (boolean), 'RemoveMultitenantCSPApps' (boolean), 'TenantFilter' (PascalCase 'T', LabelValue object {label,value} — this endpoint uses the PascalCase form, NOT the camelCase 'tenantFilter' used by most CIPP endpoints), 'TerminateContract' (boolean), 'TerminateGDAP' (boolean), 'vendorApplications' (camelCase, LabelValue object {label,value}). WARNING: This is destructive and effectively irreversible — terminates GDAP, disables delegated access, removes CSP-side data, and (when TerminateContract is set) ends the CSP contract itself. The tool currently injects 'tenantFilter' (camelCase, string) automatically; if the live backend rejects that, supply 'TenantFilter' (PascalCase, LabelValue object) explicitly via fieldsJson and CIPP will accept the override. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_run_domain_analyser |
Business | Write | [CIPP] Run domain analysis for one tenant via POST /api/ExecDomainAnalyser. Returns DNS health, email authentication status, and domain security posture. Spec body required: { tenantFilter (camelCase, required) }. NOTE: the live spec only exposes a single-tenant POST verb — there is no all-tenant variant. To analyze multiple tenants, enumerate them via cipp_list_tenants and call this tool per tenant. For lighter health snapshots, use cipp_list_domain_health. |
cipp_run_test |
Pro | Write | [CIPP] Trigger a tenant test run via POST /api/ExecTestRun. The CIPP spec for this endpoint defines a single body field — 'tenantFilter' (camelCase, required) — which is also accepted as a query parameter. Returns the test execution status. Use additionalFieldsJson only for forward-compatibility with new CIPP fields not yet exposed as typed parameters. |
cipp_add_test_report parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'DevicesTests' (PascalCase string — device-test selections, typically a serialized list), 'IdentityTests' (PascalCase string — identity-test selections, typically a serialized list), 'description' (lowercase string — report description), 'name' (lowercase string — report name). Example: {"name":"Q1 Compliance Review","description":"...","DevicesTests":"<serialized list>","IdentityTests":"<serialized list>"}. Caller is responsible for exact spec casing. |
cipp_all_tenant_secure_score parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | no | null | Optional fields to merge into the request body as a JSON object. Spec body keys (case-sensitive — preserve EXACTLY): 'ControlName' (string), 'reason' (lowercase string), 'resolutionType' (camelCase string), 'vendorInformation' (camelCase object). Tool injects PascalCase 'TenantFilter' from the typed parameter — do NOT add it here. Pass null for a minimal body. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase 'tenantFilter' query argument AND as the PascalCase 'TenantFilter' body field per the live CIPP spec. |
cipp_bulk_graph_request parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Bulk request definition as JSON object. Body keys per spec (all camelCase and STRING-typed per spec, even boolean-flavored): 'requests' (string — typically a JSON-encoded array of Graph request definitions: endpoint, method, body), 'asApp' (string boolean — when set, executes Graph calls as the CIPP application rather than delegated user), 'noPaginateIds' (string — IDs to exclude from pagination), 'tenantFilter' (string, required — describes the target tenant set). Example: {"requests":"[{"endpoint":"/users"}]","tenantFilter":"AllTenants","asApp":"true"}. Keys are passed verbatim — caller is responsible for exact spec casing. |
cipp_delete_test_report parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'ReportId' (PascalCase string — the report GUID). Example: {"ReportId":"<report-guid>"}. Caller is responsible for exact spec casing. |
cipp_list_available_tests parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Optional JSON object merged into the request body. Spec-listed body keys (exact casing, all camelCase): 'description' (string filter) and 'name' (string filter). Caller is responsible for exact spec casing. |
cipp_list_tests parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Required JSON object merged into the request body. Spec-listed body keys (exact casing): 'reportId' (camelCase string — the test report ID, also accepted as query parameter). Example: {"reportId":"<report-guid>"}. The tool injects 'tenantFilter' from the typed parameter. Caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the body as 'tenantFilter' (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_offboard_tenant parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Offboarding configuration as JSON object. Body keys per spec (all PascalCase except 'vendorApplications'): 'RemoveCSPGuestUsers' (boolean — removes guest users created via CSP), 'RemoveCSPnotificationContacts' (boolean — exact casing 'notification' lowercase, the rest PascalCase), 'RemoveDomainAnalyserData' (boolean — purges CIPP's domain analyser data for the tenant), 'RemoveMultitenantCSPApps' (boolean — removes CSP-deployed multi-tenant apps), 'TerminateContract' (boolean — ends the CSP contract; effectively irreversible), 'TerminateGDAP' (boolean — drops GDAP relationships), 'vendorApplications' (camelCase, LabelValue object {label,value} naming vendor apps to remove). If the spec-correct PascalCase 'TenantFilter' as a LabelValue object {label,value} is required by the live backend, include it in fieldsJson — your value will override the camelCase string the tool injects. Example: {"TerminateGDAP":true,"RemoveCSPGuestUsers":true,"RemoveDomainAnalyserData":true,"TenantFilter":{"label":"contoso.onmicrosoft.com","value":"contoso.onmicrosoft.com"}}. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). The CIPP spec for this endpoint declares the body field as 'TenantFilter' (PascalCase 'T') typed as a LabelValue object {label,value} — distinct from the camelCase string 'tenantFilter' used by most CIPP endpoints. The tool currently injects 'tenantFilter' (camelCase, string) automatically; if the live backend rejects that, supply 'TenantFilter' as a LabelValue object via fieldsJson and CIPP will accept the override. Use cipp_list_tenants to discover available tenants. |
cipp_run_domain_analyser parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Use cipp_list_tenants to discover available tenants. Sent as the camelCase 'tenantFilter' body field per spec. |
cipp_run_test parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
additionalFieldsJson |
string | no | null | Forward-compatibility escape hatch: a JSON object whose properties are merged into the request body LAST, overriding any of the typed parameters above. Use only for new CIPP fields that this tool does not yet expose. Keys are passed verbatim — caller is responsible for exact spec casing. |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string and as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
Application Approvals
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_multi_tenant_app |
Pro | Write | [CIPP] Register a multi-tenant enterprise application via POST /api/ExecAddMultiTenantApp. CIPP body keys are mixed: 'AppId' (PascalCase, the application ID/GUID to register), 'CopyPermissions' (PascalCase, string), 'configMode' (camelCase, string), 'permissions' (camelCase, string of required permissions), 'selectedTemplate' (camelCase, string referencing an app template), 'tenantFilter' (camelCase, required). Configures app permissions and consent. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_create_app_template |
Pro | Write | [CIPP] Create an application registration template via POST /api/ExecCreateAppTemplate. CIPP body keys per spec are ALL PascalCase here, including 'TenantFilter' (NOT 'tenantFilter'): 'AppId' (the source application ID), 'DisplayName' (template display name), 'Overwrite' (string flag to overwrite an existing template), 'TenantFilter' (PascalCase 'T', the source tenant), 'Type' (template type). Captures app settings as a reusable template. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_delete_app_approval_template |
Pro | Write | [CIPP] Delete an application approval template via DELETE /api/ExecAppApprovalTemplate. Spec marks the body required even though no individual property is required — the request must carry a JSON object. Spec body keys (PascalCase): 'Action', 'TemplateId', 'TemplateName'. Use cipp_list_app_approval_templates to find the template ID. |
cipp_delete_app_permission_template |
Pro | Write | [CIPP] Delete an application permission template via DELETE /api/ExecAppPermissionTemplate. Spec marks the body required even though no individual property is required — the request must carry a JSON object. Spec body keys (PascalCase): 'Action', 'Permissions', 'TemplateId', 'TemplateName'. |
cipp_exec_app_approval |
Pro | Write | [CIPP] Process an application approval request. Approves or denies pending enterprise application consent requests. |
cipp_exec_application |
Pro | Write | [CIPP] Execute an action on an enterprise application via PATCH /api/ExecApplication. CIPP body keys are mixed: 'Action' (PascalCase, the operation verb), 'AppId' (PascalCase), 'Id' (PascalCase, mixed 'I'+'d', application/service-principal ID), 'KeyIds' (PascalCase, string), 'Payload' (PascalCase, string), 'Type' (PascalCase, application type), 'tenantFilter' (camelCase, required). The fields 'Action', 'AppId', 'Id', 'tenantFilter' (camelCase), and 'Type' are also accepted as query parameters. Common uses: granting consent, updating credentials, modifying permissions. Pass keys verbatim — caller is responsible for exact spec casing. |
cipp_exec_service_principals |
Pro | Write | [CIPP] List or modify service principals via GET /api/ExecServicePrincipals. Query parameters per spec: 'Action' (string — the operation verb), 'AppId' (string), 'Id' (string), 'Select' (string — Graph $select projection). The current client method overload takes no parameters, so query parameters cannot be supplied through this tool — verify against runtime behavior. |
cipp_list_app_approval_templates |
Free | Read-only | [CIPP] List all application approval templates in CIPP. Returns template names, app permissions, and approval configurations. |
cipp_add_multi_tenant_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Multi-tenant app configuration as JSON object. Body keys per spec: 'AppId' (PascalCase, the application object ID or app GUID), 'CopyPermissions' (PascalCase, string), 'configMode' (camelCase, string), 'permissions' (camelCase, string describing required permissions), 'selectedTemplate' (camelCase, optional template name to base the registration on). Example: {"AppId":"<app-guid>","permissions":"...","configMode":"...","CopyPermissions":"...","selectedTemplate":"..."}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
cipp_create_app_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Template creation parameters as JSON object. Body keys per spec (all PascalCase): 'AppId' (the source application ID/GUID), 'DisplayName' (template display name), 'Overwrite' (string flag, set to enable overwriting an existing template with the same name), 'Type' (template type identifier). Example: {"AppId":"<app-guid>","DisplayName":"My App Template","Type":"...","Overwrite":"..."}. If the spec-correct PascalCase 'TenantFilter' is required by the live backend, include it in fieldsJson — your value will override the camelCase one the tool injects. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). The CIPP spec for this endpoint declares the body field as 'TenantFilter' (PascalCase 'T') — distinct from the camelCase 'tenantFilter' used by most CIPP endpoints. The tool currently injects 'tenantFilter' (camelCase) automatically; if the live backend rejects that, supply 'TenantFilter' (PascalCase) explicitly via fieldsJson and CIPP will accept the override. Use cipp_list_tenants to discover available tenants. |
cipp_delete_app_approval_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Action verb passed verbatim by CIPP (e.g., 'Delete'). Sent as body key 'Action' (PascalCase). Defaults to omitted, in which case the spec-required body is sent as an empty object. |
templateId |
string | no | null | Template ID to delete. Sent as body key 'TemplateId' (PascalCase). Use cipp_list_app_approval_templates to find valid template IDs. |
templateName |
string | no | null | Template display name (alternative to templateId). Sent as body key 'TemplateName' (PascalCase). |
cipp_delete_app_permission_template parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
action |
string | no | null | Action verb passed verbatim by CIPP. Sent as body key 'Action' (PascalCase). |
permissionsJson |
string | no | null | Optional permissions payload as a JSON object/array merged verbatim into body key 'Permissions' (PascalCase). |
templateId |
string | no | null | Template ID to delete. Sent as body key 'TemplateId' (PascalCase). |
templateName |
string | no | null | Template display name. Sent as body key 'TemplateName' (PascalCase). |
cipp_exec_application parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Application action parameters as JSON object. Body keys per spec (all PascalCase except tenantFilter): 'Action' (the operation verb — also forwardable as query parameter), 'AppId' (the application/app-registration GUID — also query-forwardable), 'Id' (the service principal or object ID — also query-forwardable), 'KeyIds' (string, comma-separated key credential IDs to act on), 'Payload' (string, request body for the underlying Graph call), 'Type' (the application type identifier — also query-forwardable). Example: {"Action":"<verb>","AppId":"<app-guid>","Id":"<sp-guid>","Type":"...","KeyIds":"...","Payload":"..."}. The tool also injects 'tenantFilter' from the typed parameter. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent as the 'tenantFilter' body field (camelCase, required) per the CIPP spec — and also accepted as a 'tenantFilter' query parameter. The tool injects this for you. Use cipp_list_tenants to discover available tenants. |
Applications
| Tool | Plan | Access | Description |
|---|---|---|---|
cipp_add_choco_app |
Pro | Write | [CIPP] Queue a Chocolatey package for Intune deployment via POST /api/AddChocoApp. This is a CROSS-TENANT deploy: the target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). The body uses mostly PascalCase keys per spec. |
cipp_add_msp_app |
Pro | Write | [CIPP] Queue a custom MSP RMM-style application for Intune deployment via POST /api/AddMSPApp. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). Used for distributing RMM/agent installers to tenant fleets. |
cipp_add_office_app |
Pro | Write | [CIPP] Queue a Microsoft 365 Apps (Office) deployment package for Intune via POST /api/AddOfficeApp. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). Use to push the M365 Apps configuration (channel + included apps + language) to multiple tenants at once. |
cipp_add_store_app |
Pro | Write | [CIPP] Queue a Microsoft Store (new Store / winget-source) application for Intune deployment via POST /api/AddStoreApp. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). |
cipp_add_win32_script_app |
Pro | Write | [CIPP] Queue a Win32 script-based application for Intune deployment via POST /api/AddWin32ScriptApp. This is a CROSS-TENANT deploy: target tenants are specified inside the body via 'selectedTenants' (NOT 'tenantFilter'). Provide PowerShell install/uninstall scripts and a detection rule (file path or registry). |
cipp_assign_app |
Pro | Write | [CIPP] Assign an existing Intune application to users, groups, or devices in a tenant via POST /api/ExecAssignApp. Use cipp_list_intune_apps to find the app's 'ID'. tenantFilter is sent on BOTH the query string AND inside the body; the same fields ('AppType', 'AssignTo', 'GroupIds', 'GroupNames', 'ID', 'Intent') are also accepted as query parameters. |
cipp_exec_app_upload |
Pro | Write | [CIPP] Upload an application package to Intune. Triggers the upload and processing of a queued application. |
cipp_list_application_queue |
Free | Read-only | [CIPP] List queued application deployments across tenants. Returns pending app installations, their status, and target tenants. |
cipp_list_apps_repository |
Free | Read-only | [CIPP] Search the CIPP app repository for deployable application definitions via POST /api/ListAppsRepository. Despite being a list/read endpoint, this is a POST that takes a body filter. The body has no required fields; supply only the keys you want to filter on. Returns the raw CIPP repository response — pass it to cipp_add_choco_app / cipp_add_office_app / cipp_add_win32_script_app etc. to deploy a found app. |
cipp_list_potential_apps |
Free | Read-only | [CIPP] Search for deployable applications across all sources (Chocolatey, winget, Office, Store, Win32) via POST /api/ListPotentialApps. Despite being a list/read endpoint, this is a POST that takes a body filter. Returns the raw CIPP search response. |
cipp_remove_app |
Pro | Write | [CIPP] Permanently remove an Intune-managed application from a tenant via POST /api/RemoveApp. Destructive: also unassigns the app from all users/devices. Use cipp_list_intune_apps to find the 'ID'. The same fields ('ID', 'tenantFilter') are accepted as both query parameters AND body fields. |
cipp_remove_queued_app |
Pro | Write | [CIPP] Cancel a pending deployment in the CIPP application queue via POST /api/RemoveQueuedApp before it processes. Use cipp_list_application_queue to find the queue item id. Note: this is a CIPP-internal queue item, not an Intune app — for already-deployed apps use cipp_remove_app instead. |
cipp_sync_vpp |
Pro | Write | [CIPP] Trigger a sync of Apple Volume Purchase Program (VPP) tokens for a tenant via POST /api/ExecSyncVPP. Refreshes Intune's view of VPP-purchased app licenses and reapplies pending assignments. The body has only ONE field: 'tenantFilter*' (camelCase, required). No other body fields are defined by the spec. |
cipp_add_choco_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Chocolatey deployment configuration as a JSON object. CIPP body keys (exact spec casing): 'PackageName' (string — Chocolatey package id, e.g. '7zip'), 'ApplicationName' (string — display name in Intune), 'AssignTo' (string), 'CustomGroup' (string — when AssignTo selects a custom group), 'CustomRepo' (string — alternate Chocolatey repo URL), 'DisableRestart' (string — boolean-as-string), 'InstallAsSystem' (string — boolean-as-string), 'InstallationIntent' (string), 'customArguments' (string — extra choco install args), 'description' (string), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). All values are STRING-TYPED in the spec — pass 'true'/'false' as strings, not booleans. |
cipp_add_msp_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | MSP deployment configuration as a JSON object. CIPP body keys (exact spec casing): 'DisplayName' (string — name shown in Intune), 'PackageName' (string — package identifier), 'AssignTo' (string), 'CustomGroup' (string — when AssignTo selects a custom group), 'RMMName' (object — RMM identification, often a LabelValue), 'params' (string — RMM-specific parameter blob), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_add_office_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Office deployment configuration as a JSON object. CIPP body keys (exact spec casing — note ALL VALUES ARE STRING-TYPED per spec, including booleans): 'AcceptLicense' (string — boolean-as-string), 'AssignTo' (string), 'CustomGroup' (string — when AssignTo selects a custom group), 'RemoveVersions' (string — boolean-as-string, removes other Office editions), 'SharedComputerActivation' (string — boolean-as-string), 'arch' (string — '32' or '64'), 'customXml' (string — raw Office Configuration XML override), 'excludedApps' (string — comma-separated app IDs to exclude, e.g. 'Lync,Groove'), 'languages' (string — language IDs, e.g. 'en-us'), 'updateChannel' (string — e.g. 'Current', 'MonthlyEnterprise', 'SemiAnnual'), 'useCustomXml' (string — boolean-as-string, when true the customXml overrides other settings), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_add_store_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Store app deployment configuration as a JSON object. CIPP body keys (exact spec casing): 'PackageName' (string — Microsoft Store package id / winget id), 'ApplicationName' (string — display name in Intune), 'AssignTo' (string), 'CustomGroup' (string — when AssignTo selects a custom group), 'InstallationIntent' (string — typically 'available' | 'required' | 'uninstall'), 'description' (string), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_add_win32_script_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Win32 script app configuration as a JSON object. CIPP body keys (exact spec casing — note key 'applicationName' is CAMELCASE here even though similar tools use 'ApplicationName'): 'applicationName' (string — display name in Intune), 'description' (string), 'publisher' (string), 'installScript' (string — PowerShell install script body), 'uninstallScript' (string — PowerShell uninstall script body), 'detectionFile' (string — file path used for presence detection), 'detectionPath' (string — directory path for the detection rule), 'AssignTo' (string), 'CustomGroup' (string — when AssignTo selects a custom group), 'DisableRestart' (string — boolean-as-string), 'InstallAsSystem' (string — boolean-as-string), 'InstallationIntent' (string), 'enforceSignatureCheck' (string — boolean-as-string), 'runAs32Bit' (string — boolean-as-string), 'selectedTenants' (string — target tenants for the cross-tenant deploy; NOT tenantFilter). |
cipp_assign_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Assignment configuration as a JSON object. CIPP body keys (exact spec casing): 'ID' (string — Intune app id), 'AppType' (string — e.g. 'WinGet', 'Win32', 'Office365'), 'AssignTo' (string — assignment target group, e.g. 'AllDevices', 'AllUsers', or a custom group name), 'Intent' (string — typically 'available' | 'required' | 'uninstall'), 'GroupIds' (string — comma-separated AzureAD group object IDs when assigning to specific groups), 'GroupNames' (string — comma-separated AzureAD group display names), 'AssignmentFilterName' (string — Intune assignment filter name), 'AssignmentFilterType' (string — 'include' or 'exclude'), 'assignmentMode' (string — camelCase). All values are STRING-TYPED. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent on the query string as tenantFilter and also in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_list_apps_repository parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Repository filter as a JSON object. CIPP body keys (all optional, exact spec casing): 'Repository' (string — repo source), 'Search' (string — name search), 'AcceptLicense' (boolean), 'AssignTo' (string enum: 'On' | 'allLicensedUsers' | 'AllDevices' | 'AllDevicesAndUsers' | 'customGroup'), 'DisableRestart' (boolean), 'InstallAsSystem' (boolean), 'InstallationIntent' (boolean), 'RemoveVersions' (boolean), 'SharedComputerActivation' (boolean), 'appType' (object), 'applicationName' (string), 'arch' (boolean), 'customArguments' (string), 'customGroup' (string), 'customRepo' (string), 'customXml' (string), 'description' (string), 'detectionFile' (string), 'detectionPath' (string), 'displayName' (string), 'enforceSignatureCheck' (boolean), 'excludedApps' (array of LabelValue {label, value}), 'installScript' (string), 'languages' (object), 'packageSearch' (object), 'packagename' (string), 'params' (object), 'publisher' (string), 'rmmname' (object), 'runAs32Bit' (boolean), 'uninstallScript' (string), 'updateChannel' (object), 'useCustomXml' (boolean). Note the mixed PascalCase/camelCase casing — CIPP is case-sensitive and silently drops mismatched keys. |
cipp_list_potential_apps parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Search filter as a JSON object. CIPP body keys (all optional, exact spec casing): 'SearchString' (string — primary search term), 'searchQuery' (string — alternate search), 'type' (string — restrict by app type), 'AcceptLicense' (boolean), 'AssignTo' (string enum: 'On' | 'allLicensedUsers' | 'AllDevices' | 'AllDevicesAndUsers' | 'customGroup'), 'DisableRestart' (boolean), 'InstallAsSystem' (boolean), 'InstallationIntent' (boolean), 'RemoveVersions' (boolean), 'SharedComputerActivation' (boolean), 'appType' (object), 'applicationName' (string), 'arch' (boolean), 'customArguments' (string), 'customGroup' (string), 'customRepo' (string), 'customXml' (string), 'description' (string), 'detectionFile' (string), 'detectionPath' (string), 'displayName' (string), 'enforceSignatureCheck' (boolean), 'excludedApps' (array of LabelValue {label, value}), 'installScript' (string), 'languages' (object), 'packageSearch' (object), 'packagename' (string), 'params' (object), 'publisher' (string), 'rmmname' (object), 'runAs32Bit' (boolean), 'uninstallScript' (string), 'updateChannel' (object), 'useCustomXml' (boolean). Note the mixed PascalCase/camelCase casing — CIPP is case-sensitive. |
cipp_remove_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | App identification as a JSON object. CIPP body keys (exact spec casing): 'ID' (string, REQUIRED — Intune app id from cipp_list_intune_apps), 'tenantFilter' (string — already added by the tool, but listed here for completeness). | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as tenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |
cipp_remove_queued_app parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Queue item identification as a JSON object. CIPP body keys (exact spec casing): 'ID' (string, REQUIRED — CIPP queue item id from cipp_list_application_queue). The spec defines no other body fields. |
cipp_sync_vpp parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fieldsJson |
string | yes | Reserved for forward compatibility. The spec defines no extra body fields beyond 'tenantFilter'. Pass an empty object '' or use this only if a future CIPP version adds VPP sync options. Keys are passed verbatim — caller is responsible for exact spec casing. | |
tenantFilter |
string | yes | Target tenant domain (e.g., contoso.onmicrosoft.com). Sent both on the query string as tenantFilter and in the body as 'tenantFilter' (camelCase). Use cipp_list_tenants to discover available tenants. |