servosity/msp-skills/cipp

CIPP - Claude Code Skill

Version note. The MCP write preview, CIPP_MCP_READ_ONLY, token-protected HTTP mode, local-data purge and CIPP_NO_LOCAL_DATA ship in cipp 0.1.13 and later. Check with cipp-cli --version.

Prerequisites: Install the CLI

This skill drives the cipp-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cipp/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cipp/install.ps1 | iex ``

1. Verify: cipp-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the cipp-cli and cipp-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

CIPP (CyberDrain Improved Partner Portal) is how MSPs manage many Microsoft 365 tenants from one place. This CLI brings its full endpoint surface to the terminal as typed commands and adds a local-first layer: fanout drives any tenant-scoped endpoint across every tenant into a local SQLite store, so posture, scorecard, ca diff, licenses waste, users stale and users offboard-check answer cross-endpoint questions offline (gdap expiring reads the relationship list live against the stored tenants), and standards drift and changes compare your own stored snapshots over time. CIPP can report a failed write as text inside an HTTP 200 Results envelope: bulk and the MCP server's cipp_execute turn that into an error, while the typed write commands print the Results text and exit 0, so read it before reporting success.

Read this first: some CIPP GET calls change things

43 CIPP endpoints are called with GET but named as actions (Exec..., Remove...). Some change your tenants or your CIPP instance, for example RemoveStandard, ExecSendOrgMessage and ExecRunBackup. From cipp 0.1.13 (check cipp-cli --version), the MCP server treats them as state-changing: cipp_read refuses them and cipp_execute only previews them until confirm is boolean true; earlier builds run them with no confirmation step. Their CLI commands run as soon as they are invoked, so treat each one as a change and confirm with the user before running it:

exec-add-spn, exec-alerts-list, exec-apipermission-list, exec-app-approval, exec-app-insights-query, exec-app-upload, exec-backend-urls, exec-beccheck, exec-bulk-license, exec-cippdbcache, exec-cpvrefresh, exec-create-default-groups, exec-csplicense list, exec-device-code-logon, exec-durable-functions, exec-extension-clear-hibpkey, exec-extension-mapping, exec-extension-ninja-one-queue, exec-extension-sync, exec-extension-test, exec-gdapinvite-approved, exec-gdaptrace, exec-graph-request-profile, exec-incidents-list, exec-list-app-id list, exec-list-backup, exec-mail-test, exec-mailbox-mobile-devices, exec-maintenance-scripts, exec-mdo-alerts-list, exec-permission-repair, exec-run-backup, exec-scheduler-billing-run, exec-send-org-message, exec-service-principals, exec-standard-convert, exec-standards-run, exec-universal-search, exec-universal-search-v2, remove-cipp-queue, remove-standard, remove-tenant-capabilities-cache, remove-webhook-alert.

fanout, export and tail refuse all of them: they only drive List*/Get* reads.

fanout --save refuses a tenant's response when anything in the response reads as a failure: failure wording or a failed state anywhere under a status-like field (state, status, result, message, text, detail, reason and the like, at any depth: "status":{"code":"error"}) or in a bare message, a populated field named like error, exception or fault ("error":"HTTP 403", whatever the wording), a field named like success or ok that is false, or a failed state, in the rows or beside them, and keeps the rows already stored. It stores only a list whose every entry carries the endpoint's id; JSON null, an empty answer, a single object or a message is shown, not stored. In the tenant list, and only there, tenant records keep their own Graph token fields (LastGraphError, GraphErrorCount), so one tenant with a failed Graph token does not stop the fleet. A response with a duplicate key is refused. A row whose own name holds a failure word (a user named "Error Reporting", a group named "Denied Access") is still a row. The trade-off: a list whose rows report their own failed status is refused too; run the same fanout with --json to see what CIPP returned.

Before a successful response is shown, cached or saved, it is checked for your configured credentials (the API key, the client secret, the minted token) in every encoding the CLI can decode, with spaces and invisible characters removed first. A response holding a single value over 64 KiB once spaces are removed, or a response that is not JSON and is over 64 KiB, is withheld instead, because it cannot be decoded whole; read that value in CIPP itself.

When to Use This CLI

Reach for this CLI when a question spans more than one Microsoft 365 tenant, or when a CIPP action needs to be scripted rather than clicked. It suits fleet posture rollups (MFA, Conditional Access, Standards, DLP), license reclaim totals, comparing stored snapshots over time, GDAP relationship health, offboarding end-state checks, and CSV-driven batches that must survive HTTP 429 rate limiting. The rollup commands read only the local store: they return empty until the endpoints they need were saved with fanout --save (presets: core, posture, offboarding, compliance, gdap). Commands support --json, --select and typed exit codes for agents; mutations support --dry-run.

Anti-triggers

Do not use this CLI for:

• Do not use this CLI to stand up or configure CIPP itself - it manages tenants through an existing CIPP instance and cannot deploy one.
• Do not use this CLI to call Microsoft Graph directly; it speaks only to your CIPP instance, which brokers Graph access via GDAP.
• Do not use this CLI for single-tenant one-off clicks where the CIPP web UI is faster, unless you need a machine-readable receipt.
• Do not use sync: this CLI has none. Populate the local store with cipp-cli fanout --endpoint <path> --all-tenants --save (or a --preset).

Unique Capabilities

Cross-tenant reach

• `fanout` - Run any CIPP read endpoint across every client tenant at once and save the results locally.

_Reach for this first: every offline rollup command reads the store this populates._

``bash cipp-cli fanout --endpoint /ListUsers --all-tenants --save --agent ``

• `bulk` - Drive CIPP deploy, user and mailbox actions from a CSV across tenants: plan-only unless --execute, with Retry-After backoff, per-row resume and HTTP-200 failure detection.

_A failed write becomes a non-zero exit instead of a silent success. CLI only: it is not exposed as an MCP tool._

``bash cipp-cli bulk --from offboards.csv --dry-run --agent ``

• `gdap expiring` - List delegated-admin relationships expiring inside a window, plus stored tenants with no active relationship (reads the partner-wide relationship list live; needs credentials).

_Catches a lapsing delegation before a technician hits a permission error._

``bash cipp-cli gdap expiring --days 30 --agent ``

Offline joins over the local store

• `posture` - A per-tenant table for one chosen posture dimension (MFA, Conditional Access, Standards, BPA, DLP, retention or sensitivity labels) from the local store.

_Use this for QBR and cyber-insurance rollups: one table per dimension across tenants; scorecard gives every dimension for one tenant._

``bash cipp-cli posture --dimension mfa --agent ``

• `licenses waste` - Total reclaimable licenses by SKU or by user from stored user license assignments and sign-in activity, with SKU names from stored license rows.

_A scriptable seat-reclaim total from stored data._

``bash cipp-cli licenses waste --by sku --stale-days 90 --all-tenants --agent ``

• `ca diff` - Find which tenants deviate from the Conditional Access baseline the rest of the fleet shares.

_Shows the policy one tenant lacks that most of the fleet has, in one scriptable result._

``bash cipp-cli ca diff --agent ``

• `users stale` - List enabled, licensed accounts with no sign-in in N days from the stored users rows.

_Feeds a disable queue or a QBR from stored data without another round of API calls._

``bash cipp-cli users stale --days 90 --agent ``

• `users offboard-check` - Find disabled accounts that still hold mail forwarding, inbox rules, directory roles or licenses.

_Run it after a Friday offboarding batch to catch the step that silently did not happen._

``bash cipp-cli users offboard-check --agent ``

• `scorecard` - Every stored signal about one tenant in a single record, each with the time its data was saved.

_One machine-readable record per client for a QBR packet or an insurance questionnaire._

``bash cipp-cli scorecard --tenant 7d3c9f2e-1b4a-4c8e-9f6d-2a5b8c1e4f70 --agent ``

Change over time

• `standards drift` - Show every tenant whose Standards settings changed between two stored snapshots; --since picks the base snapshot.

_Answers 'what changed since my last look' from your own stored history, offline._

``bash cipp-cli standards drift --since 7d --agent ``

• `changes` - Show rows of any stored resource added, removed or modified between two fanout snapshots.

_Answers 'what changed in admin roles or app consents since last week' across the fleet in one call._

``bash cipp-cli changes --resource roles --since 7d --agent ``

Command Reference

add-alert - Manage add alert

• cipp-cli add-alert - Add alert

add-apdevice - Manage add apdevice

• cipp-cli add-apdevice - Adds Autopilot devices to a tenant via Partner Center API

add-app-template - Manage add app template

• cipp-cli add-app-template - Add app template

add-assignment-filter - Manage add assignment filter

• cipp-cli add-assignment-filter - Add assignment filter

add-assignment-filter-template - Manage add assignment filter template

• cipp-cli add-assignment-filter-template - Add assignment filter template

add-autopilot-config - Manage add autopilot config

• cipp-cli add-autopilot-config - Add autopilot config

add-bpatemplate - Manage add bpatemplate

• cipp-cli add-bpatemplate - Add bpatemplate

add-capolicy - Manage add capolicy

• cipp-cli add-capolicy - Add capolicy

add-catemplate - Manage add catemplate

• cipp-cli add-catemplate - Add catemplate

add-choco-app - Manage add choco app

• cipp-cli add-choco-app - Add choco app

add-connection-filter - Manage add connection filter

• cipp-cli add-connection-filter - Add connection filter

add-connection-filter-template - Manage add connection filter template

• cipp-cli add-connection-filter-template - Add connection filter template

add-contact - Manage add contact

• cipp-cli add-contact - Add contact

add-contact-templates - Manage add contact templates

• cipp-cli add-contact-templates - Add contact templates

add-custom-script - Manage add custom script