Skip to main content
This guide walks you through connecting CIPP (the CyberDrain Improved Partner Portal) to MSPortal.ai. The setup wizard has five steps: Connect, Choose data, Map companies, Review, and Data. On the CIPP connection page, the Setup guide lists the same work as tasks: Connect, Choose data, Import or match companies, Configure compliance group (optional) and Review. Configure compliance group is the same Compliance group import described in Part 7. Once connected, MSPortal synchronizes security, identity, email, Intune, and tenant configuration data from CIPP and presents it to your clients as the Microsoft 365 Posture page. For every mapped tenant, CIPP also supplies Intune managed devices, Windows Autopilot devices and SharePoint storage quota. Intune details appear on matching device records, and Intune devices without an RMM agent are listed in Devices > Not in RMM (see Find Intune devices missing from your RMM).
CIPP is currently a Pilot integration available to selected tenants. If you don’t see the CIPP card in Settings > Integrations, contact support@msportal.ai. The pilot secures and validates the API connection; data sync features build on this connection.

​
Prerequisites

  • A CIPP instance with the CIPP-API integration enabled
  • MSPortal.ai integration management permission

​
Part 1: Create CIPP API Credentials

1

Open CIPP API Settings

In CIPP, go to Integrations > CIPP-API.
2

Create or Select an API Client

Create or select an enabled API client.
3

Assign a Read-Only Role

Give the API client a CIPP role with AllTenants read access to every reporting area. The built-in readonly role is recommended. A restricted custom role makes individual datasets fail with authorization errors, and a role limited to one tenant returns only that tenant.
4

Copy the Credentials

Copy the API URL, Tenant ID, Application ID, Application Secret, and API Scope. Copy the API scope exactly as shown for this client; do not build one from a tenant name.

​
Part 2: Connect in MSPortal

1

Open the Setup Page

Go to Settings > Integrations, find the CIPP card, and click Configure.
2

Enter Your Credentials

Fill in the fields:
CIPP connection form with blank credential fields and test and save buttons

The CIPP Connect step before credentials are entered.

3

Test the Connection

Click Test Connection. On success you’ll see Connection Verified: Microsoft issued an access token for this CIPP API client.
4

Create the Integration

Click Create Integration to save. The button stays disabled until the test passes. Credentials are stored only in Vault.A token proves the credentials are valid. It does not prove that every CIPP dataset is reachable, because the API client’s CIPP role controls which tenants and reports it can read.

​
Part 3: Choose Data

Choose data holds the optional Document Intune policies setting. Intune policy documentation is opt-in: the setting is off by default, including for existing connections.
1

Open Choose data

After saving credentials, open Choose data, before matching companies. The older wizard shows the same Choose data step before Map companies.
2

Choose whether to document Intune policies

Check Document Intune policies to turn it on, or leave it unchecked to keep it off. The choice saves immediately. Leaving it unchecked is valid.
3

Continue

Continue to company matching once the choice has saved.
With the setting on, the nightly CIPP sync saves each Intune policy’s versions and looks up readable setting names. The policies appear in Documentation > Intune, where staff can export one company’s Intune documentation as a PDF after selecting that company. Clear the checkbox to stop documenting policies on later syncs. A sync that is already running finishes with its saved choice, and versions documented earlier stay available. Sharing Intune documentation with company users is a separate switch, Show Intune documentation to company users in Settings > Documentation > Intune. It is off by default.
CIPP Choose data step with Intune documentation unchecked

Choose data between Connect and company matching.

CIPP wizard Choose data step with Document Intune policies unchecked

Choose data in the older wizard.

​
Part 4: Map Companies

After connecting, MSPortal discovers the Microsoft 365 tenants managed in CIPP. Map each tenant to the matching MSPortal company so security, Intune, and Microsoft 365 data appears in the correct customer context.
1

Wait for Tenant Discovery

Tenant discovery can take a few minutes after the connection is created. The page checks automatically while the initial sync runs.
2

Map Tenants to Companies

The table lists each tenant with its Default domain and CIPP status. Tenants whose Microsoft tenant ID matches an existing Microsoft 365 connection are mapped automatically. For the rest:
  1. Click Quick Match to pair tenants and companies by name, or pick a company from the Select company… dropdown in the Mapped column
  2. If the company does not exist yet, use Create new company to add it and link it in one step. Check for an existing company first to avoid duplicates
  3. Review the pending links, then click Import Selected to save them
A company you create here is saved immediately. Removing a saved link also takes effect immediately. Clearing a pending link only discards that draft.
3

Continue

Click Next. Next saves any pending links and starts a full data sync for the mapped tenants.
Data is only stored and shown for tenants that are mapped to a company. Unmapped tenants are listed for mapping but their data stays out of every page and report.

​
Part 5: Review

The Review step confirms your data coverage before you finish setup:
  • Tenants discovered, Tenants mapped and Synced records counters
  • Healthy datasets, Datasets running, Security coverage, Intune coverage and Dataset issues indicators
  • Last data received time
  • Start full sync to run a synchronization on demand
  • View Microsoft 365 posture to open the client-facing view, and Manage company mappings to return to the Map step
Synchronization continues automatically in the background after setup, with a full refresh every day. A “sync started” message means the sync was requested, not that it finished. Wait for the counters to settle before you judge coverage.

​
Which dataset issues count

A failed or missing dataset is never treated as a passing security result.

​
Only one tenant appears

If the Review step shows Only one CIPP tenant was returned and you expected more, the API client’s CIPP role does not cover all tenants.
  1. In CIPP, open Integrations > CIPP-API and assign the API client a role with AllTenants access, such as the built-in readonly role
  2. Return to the Review step and click Start full sync

​
Part 6: Data

The Data step is your admin console for everything CIPP is syncing:
  • Summary cards for mapped tenants, synced records, and security, Intune, and critical item counts
  • Dataset coverage showing every dataset by category, with any sync issues flagged
  • Record explorer to search and filter every synced record, including the full source payload from the CIPP API
Use this view to confirm data is flowing, investigate a specific record, or check why a dataset has no data. Filter to the right company and dataset before you open a record, because some records show the full provider payload. This console is for your team; clients see the curated Microsoft 365 Posture page instead.

​
Part 7: Import CIPP Standards into Compliance

The Data step can turn your CIPP standards into a reusable company-level Compliance group. MSPortal creates one check per standard. You then assign the group to runs through your normal Compliance workflow. This is a tenant-wide MSP task, so a user limited to specific companies cannot run it.

​
Create the Group

1

Open the Data Step

Open the CIPP connection and select Data.
2

Expand the Panel

Select CIPP Compliance group to expand the panel.
3

Review the Standards

Check the count line, for example 12 standards available · 0 imported, and the list of standard names. The list includes standards synced from mapped companies in the last 48 hours.If the panel shows Map companies and sync CIPP standards to see available checks., map companies and let a sync finish first. Create group stays unavailable until at least one standard is available.
4

Choose Automatic Updates

Keep Automatically update these checks in active runs from CIPP results. selected if you want CIPP results to set check statuses. It is selected by default.
5

Create the Group

Select Create group. A Compliance group saved. message confirms the import.The import also creates a CIPP Standards status list with Unknown, Compliant and Noncompliant. Unknown is the default status.
6

Review the Group

Select Open Compliance groups to review the new CIPP Microsoft 365 Standards group in Settings > Compliance > Groups.

​
Assign the Group to Runs

The import does not add checks to any run.
1

Add the Group to a Run Template

In Compliance settings, open the Runs tab and add CIPP Microsoft 365 Standards to a run template.
2

Start Assessments

Create an assessment from that template, or schedule assessments.

​
Import Again

After the group exists, the button reads Update group. Select it to add checks for standards CIPP has reported since your last import. Existing standards keep their current checks, so repeat imports do not create duplicates. Use the same button to save a change to the automatic updates setting.

​
How Automatic Updates Set Results

With automatic updates on, MSPortal sets each imported check in active runs after every CIPP sync. It also evaluates results right after you create or update the group. When one company maps to more than one CIPP tenant, the check uses the worst result: Automatic updates change only the status. They never touch completed runs or notes. They apply to company-level assignments in runs that are still in progress, and they run only while the CIPP connection is active.

​
Delete or Restore the Group

Deleting CIPP Microsoft 365 Standards in Settings > Compliance > Groups pauses automatic updates. The imported checks stay in your library. To restore the group, return to the Data step and select Create group again. MSPortal rebuilds the group from the same checks and resumes automatic updates if that setting is selected.

​
Managing the Connection

  • To update credentials later, re-open the setup page, enter the new values, click Test Connection, then Save connection. Saved secrets stay masked.
  • To disconnect, click the remove button and confirm Disconnect CIPP?. This removes the connection, synced CIPP data and its stored Vault credentials, and cannot be undone. It does not disable or revoke the API client in CIPP.
  • Users without integration management permission see the connection read-only.

​
Troubleshooting

Integrations Overview

Explore all available integrations

Microsoft 365

Manage Microsoft 365 across your clients

Microsoft 365 Posture

See what clients see from CIPP data

Compliance Settings

Assign the CIPP standards group to runs