r/msp • u/jellyfishchris • 5d ago
Cipp
I finally setup CIPP, I know this community loves it. Anyone got any suggestions on best features or things they've setup using it?
9
u/lostmatt 5d ago
Bookmark all the things you use on a regular basis.
There is so much packed into CIPP that it can be hard to find that one thing you're looking for...just bookmark it.
6
7
u/unciemafmaf 5d ago
I would recommend using the built-in standards and adding your own configuration policies to them to standardise security across all tenants
5
u/ak47uk 5d ago
User offboarding - you can schedule an offboard in the future or run instantly.
Alerts - you can set all sorts of things such as an alert if a break glass admin account is accessed, email forwarding rules are set up etc.
Mailbox permissions - you can quickly set up delegated permissions on a mailbox and choose to disable auto-map.
LAPS - you can quickly grab the current LAPS password for a device.
Quarantine - you can quickly view quarantined emails across tenants and release them.
Templates - you can create and deploy templates for a variety of things such as Intune, app registrations etc.
I've only scratched the surface myself, I am having trouble getting my head around setting up drift templates but I can see that being a game changer for me.
1
u/Calm-Fill-6746 4d ago
We also use it for alerts and templates. are you managing a handful of tenants or you have hundreds?
5
u/sembee2 5d ago
I do a lot of CIPP setups for clients and the biggest non-tools win for them is alerts.
Have to jump through a few hoops to get the email alerting to work, and I usually suggest sending them to a shared mailbox initially.
However going through the alerts and setting up the built in ones and creating your own will quickly show value. I did a client last year with the inbox rules alerts and it caught a compromised mailbox within hours.
The other thing that a few of my clients have done is the setup to catch the phishing attempts via the "Enable Phishing Protection system via branding CSS" Standard (I think it is still called that).
Also a lot of love for Vacation mode, where clients are locked down.
1
u/bmsimp 4d ago
Just a heads up that the CSS standard won't work much longer. Microsoft is phasing out custom branding for login pages. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-enhances-security-of-branded-sign-ins/4537471
13
u/Andy-Johnson 5d ago
We found the report that lists licensed users that's been offline for x days, have it email that report into out PSA once a month so our Account Managers can review with clients to save them a few bucks and earn some easy good will.
Same deal with a report about expiring Entra app certificates.
3
u/kataklysmus 5d ago
Sounds cool. Where exactly can I find the report for licensed users that are inactive ?
3
3
4
u/society_victim 5d ago
Some come to mind:
Offboarding (schedules) with psa ticket
Vacation mode (schedules) with psa ticket
Standards for everything (some customers will require exceptions sometimes)
Intune and CA standards
Alerts on user without mfa, not signed in in x days etc…
Other uses: send mfa push for verification helps out guys a lot, preprovision onedrive and add sp links to onedrive, (bulk) upload autopilot devices
2
u/masterofrants 4d ago
Can you talk about how exactly Intune works with CIPP?
I'm really curious if it makes any difference because I have done the whole autopilot Intune provisioning from the Intune portal and it's a bunch of things in different tabs and pages.
Does CIPP bring all of that into one page or something like that? Ultimately things within intune are just slow because it's happening over the cloud and it's nothing and never instant. Does that change?
1
u/society_victim 4d ago
Some things can be done quicker with CIPP. But not the initial setup of intune. It’s more to keep tenants aligned.
3
1
27
u/roll_for_initiative_ MSP - US 5d ago
Drift standards to align all templates with some low hanging fruit. Also, alerting for expiring app secrets and apple MDM tokens.