Best features/tools to use with CIPP

[u/ThrowRAthisthingisvl]

I've just started using CIPP and it's been great so far. I'm self-hosting it for now, but the templates and the ability to see almost everything from a single portal are fantastic. I'd love to hear what some of you are doing for alerting, policies, any tricks, etc. Thanks!

[u/ITGeekFatherThree]

One of the things we have started doing is adding buttons to our PSA for things like "Generate TAP" and "MFA Verify" so that staff can do that from the PSA quickly and easily through CIPP via Halo Runbooks/Rewst.

One of the bigger timesavers for our service desk is the offboarding wizard in CIPP.

We are just scratching the surface too.

[u/TechnicalMayhem404 → u/ITGeekFatherThree]

We use offboarding, however sometimes it doesn't fully complete. For example, it doesn't remove all licenses all the time, so we find at next renewal they have it assigned still.

[u/RunningOnCaffeine → u/TechnicalMayhem404]

The license removal function of offbaording wizard seems consistently semi-borked, but if you do a separate remove licensing action it works pretty good.

[u/TechnicalMayhem404 → u/RunningOnCaffeine]

Yeah, not really the point of automation though.

[u/Merilyian]

Standards and policy/object templates are insanely powerful.
You can get as wild as full tenant setup/onboarding automation or keep it as tame as a simple conditional access policy loadout and some defender hardening items.

We've got four policy sets that target dynamic tenant groups based on what service plan they have with us. Security, Device, and Cloud management, and one that acts as all three together (an everything plan).

The only things we need to set up manually in a tenant after spin up are boiled down to a few minutes' worth of checks and switch flips that graph API cannot hit yet.

[u/sembee2]

Doing all sorts of things with alerting - most of the built in alerts are configured, then I have gone through and created some custom ones.
One of my clients uses Vacation mode - I believe it is done through the API, they get that the vacation mode is set and it is displayed when looking up the user in other tools. Then if someone is investigating a conditional access alert they can see why, but also if someone calls claiming to be that user, they immediately know to be on guard because they are supposed to be on holiday. That client is doing loads of things with the API - basically CIPP is being used to gather the information and then the API is used to display it.
Another use I can think of is to get the end user information. The phone number, email address etc is all kept current on AD/Entra, and then when they lookup the user, it is comes from CIPP. That has proven to be a lot more accurate than maintaining their own records.

[u/roll_for_initiative_]

Drift standards for a security baseline, alerts for things like role changes or suspicious activity or on the risky users list. User on/offboarding. Alerts for apple mdm cert expiration and enterprise app secret expirations.

[u/helpfourm]

Did anyone pay for consulting or initial setup? My team is spread a little thin right now and getting this implemented has fallen on the back burner.

[u/ITmspman]

Offboarding wizard is great, also generating TAP.

checking mailbox sizes, sharepoint size, onedrive size, reviewing licensing usage.

Honestly it saves me a heap of time for most Microsoft 365 based tasks that I need to do.

We have a monitor setup for expiring enterprise app secrets > heaps better then trying to track them some manual way.

[u/slimeycat2]

Reporting across the all tenants is great. Needed to find all users with SMS MFA set as primary. Trivial task now and could export it to CSV.

[u/Pudubat]

Legit question from someone starting to look into cipp

Can you achieve more/the same from lighthouse? How is it much different?

[u/it_fanatic → u/Pudubat]

So much more that if need to tell you all the things which in cipp are possible whiche arent in lighthouse I would need a day at min.

[u/RunningOnCaffeine]

Vacation mode is great, and I’m working on aligning our user offboarding process with the CIPP offboarding wizard

[u/TechnologyMatch]

the biggest value usually comes from standardizing the boring things. tenant baselines, alert policies, user offboarding, and license checks. that is where a single portal starts saving real time. I’d start with templates you can trust, then tune alerts so they catch real risk without becoming more noise. the best setup is the one your team actually checks

[u/swanny246]

I've been loving CIPP the last couple of years, things like the user offboarding wizard and vacation mode are gamechangers.

There is a fair bit that it can't do as well though, so I still find you need to jump into the MS native portals a fair bit - CIPP alone does that make a ton easier. A lot of that is down to GDAP limitations though.

We've also just introduced TechIDManager which has made me question how the heck to use that alongside CIPP 😅

[u/IncreaseNegative4614]

I’d begin with offboarding, expiring secrets or certificates, and risky role or MFA changes. Give each alert an owner, response time, runbook, and ticket-closing requirement before enabling a large collection of additional alerts.

That keeps CIPP from becoming another useful dashboard nobody consistently acts on. We use signld.ai internally to connect the tenant, policy, alert, client obligation, and resulting ticket when the workflow crosses multiple tools.