The CIPP + Microsoft 365 (Entra ID, Intune, Exchange Online, Defender, GDAP) MCP Server - free, local, built for MSPs
Independent, open source, inspectable. Every line of code is on GitHub under Apache-2.0 - built for the MSP community, vendor-neutral by design. Not affiliated with, endorsed by, or sponsored by CyberDrain.
✓ Live-verified by Abhi Saini, Bearium Networks (MSP) against a production tenant · 2026-08-13 · receipt →. The version it verified was not recorded.
Yes - there is an MCP server for CIPP + Microsoft 365. It’s free, open source, and runs on your own machine, so your client data stays local unless you route it somewhere yourself. It connects CIPP + Microsoft 365 to Claude, ChatGPT, Copilot, or any MCP-capable agent, and installs in about 60 seconds.
This is the MCP server for CIPP, and through CIPP for the Microsoft 365 it manages: Entra ID, Intune, Exchange Online, Defender and GDAP, across every client tenant at once. CIPP manages Microsoft 365 across all your client tenants, but its portal and API work one tenant at a time. Ask your AI “which tenants are off our security baseline” or “where are we paying for unused licenses” and get the cross-tenant answer the UI never renders: one fan-out pulls every tenant into a local store, then posture, license-waste, stale-account, and standards-drift rollups run instantly - offline, across the whole fleet.
New to the term? An MCP server is the same thing ChatGPT calls an app or connector, Claude on the web calls a connector, and Claude Code calls a Skill. One thing, many names →
Install in 60s → View on GitHub →
Instead of clicking through CIPP + Microsoft 365, just ask
Instead of Logging into each client’s tenant one at a time to count who still hasn’t registered MFA, then pasting the numbers into a QBR spreadsheet
just ask: “Show me MFA registration across every tenant”
Your agent runs: cipp-cli posture --dimension mfa
Instead of Clicking through every tenant’s license page to find seats you pay for but nobody uses, then reconciling against the CSP bill by hand
just ask: “Which assigned M365 licenses are going unused across all my clients?”
Your agent runs: cipp-cli licenses waste
Instead of Running the same offboarding steps - block sign-in, convert mailbox, set forwarding - separately in each tenant for a batch of departures, and starting over when the API throttles you
just ask: “Offboard this CSV of departures across their tenants without tripping rate limits”
Your agent runs: cipp-cli bulk --from offboards.csv --execute
See it in 30 seconds
Demo data is simulated. Every command shown exists in the real CLI.
What it does
| Question your MSP keeps asking | Command your agent runs |
|---|---|
| Which tenants still have users without MFA registered? | cipp-cli posture --dimension mfa |
| How does Conditional Access coverage compare across all tenants? | cipp-cli posture --dimension ca |
| Where am I paying for M365 licenses nobody uses? | cipp-cli licenses waste |
| Which licensed accounts haven’t signed in for 90 days, across every client? | cipp-cli users stale --days 90 |
| Which tenants drifted off our security baseline since the last check? | cipp-cli standards drift |
| Pull one read across every client tenant at once and keep it locally | cipp-cli fanout --endpoint /ListUsers --all-tenants --save |
| Offboard a batch of departures from a CSV with 429 backoff and resume | cipp-cli bulk --from offboards.csv --execute |
| Are my CIPP credentials and connectivity healthy? | cipp-cli doctor |
Full command reference at github.com/servosity/msp-skills/blob/main/skills/cipp/guide.md.
What makes this one different
Most CIPP integrations proxy each question into a live, single-tenant API call - fine for one record, but every tenant is a separate round trip and Microsoft Graph throttles you at fleet scale. This skill fans one read out across every tenant, persists the results into a local SQLite store, and then answers posture, license-waste, stale-account, and standards-drift questions from that store - instant, offline, and resumable after a 429. The drift report even compares two synced snapshots over time, history a stateless wrapper has nowhere to keep.
CIPP’s portal is where you act deeply on a single tenant; this skill is where you see across all of them. It complements CIPP - it reads and writes through the same CIPP API with your own scoped credentials - and adds the fleet-wide rollups plus the local snapshot history (drift over time) that the one-tenant-at-a-time UI never renders. Microsoft’s own Defender tools in its Sentinel MCP server stop at your home tenant: “You can’t use this collection as a guest in another tenant or with delegated access” (Microsoft Learn, Sentinel MCP triage tool). This connector reaches every client tenant through the GDAP access CIPP already holds.
The pain this closes
- CIPP scopes nearly every endpoint by a single tenantFilter, so the portal forces you through one client tenant at a time. The fleet-wide questions an MSP owner actually asks at QBR time - how many users still lack MFA across all clients, which tenants drifted off baseline, where licenses sit unused - have no single screen; you click each tenant or script the API by hand.
- The CIPP API (per the official CIPP API documentation at docs.cipp.app) authenticates with an Azure AD app registration via OAuth2 client credentials and runs through Microsoft Graph, which throttles at scale. A bulk change across dozens of tenants hits HTTP 429 / Retry-After limits, and a halted batch means re-running everything - there is no resumable, checkpointing bulk runner.
- CIPP added its own MCP server in June 2026, and it is read-only by design: it leaves out every endpoint CIPP labels as a write, so an agent using it cannot offboard a user, reset MFA, change licenses or convert a mailbox. This connector wraps those endpoints too, one tenant per call, each previewable with
--dry-run.
Install
Works in any of these agents - pick yours:
| Agent | Quick install |
|---|---|
| Claude Desktop | Step-by-step → |
| ChatGPT (Plus/Pro+) | Step-by-step → |
| Claude Code | Step-by-step → |
| Codex CLI | Step-by-step → |
| Cursor, Windsurf, Cline, Continue, Zed, Copilot, Gemini, Hermes, OpenClaw | Which agent? → |
Quickest path for everyone else (terminal):
macOS / Linux:
bash <(curl -fsSL https://raw.githubusercontent.com/servosity/msp-skills/main/skills/cipp/install.sh)
Windows (PowerShell):
iwr -useb https://raw.githubusercontent.com/servosity/msp-skills/main/skills/cipp/install.ps1 | iex
After install, authenticate once with your CIPP + Microsoft 365 credentials, then verify with cipp-cli --version.
Safety model
| Tier | Examples | Recommended agent policy |
|---|---|---|
| Read (rollups and lists) | cipp-cli posture –dimension mfa; cipp-cli licenses waste; cipp-cli users stale –days 90; cipp-cli standards drift; cipp-cli fanout –endpoint /ListUsers –all-tenants; cipp-cli list-tenants; cipp-cli doctor | Allow |
| Write (routine) | cipp-cli add-user; cipp-cli edit-user; cipp-cli bulk –from changes.csv –execute (plans by default; writes only with –execute) | Preview with –dry-run, then a reviewed write |
| Credential / security | cipp-cli exec-reset-mfa; cipp-cli exec-per-user-mfa; cipp-cli exec-get-local-admin-password; cipp-cli exec-token-exchange | Human-in-the-loop only |
| Destructive | cipp-cli exec-offboard-user; cipp-cli remove-user; cipp-cli exec-device-delete; cipp-cli delete-sharepoint-site | Human-in-the-loop only, explicit confirmation |
The skill drives the cipp-cli and cipp-mcp binaries, authenticating to your self-hosted CIPP instance with a bearer token from CIPP_API_KEY (obtained via OAuth2 client credentials - ‘auth login’ performs and caches the exchange) read from the environment, never logged or sent anywhere except the CIPP API. CIPP is a read-write management API: read and rollup commands change nothing; bulk prints its plan and only writes with –execute; everything else (create/edit/offboard/delete, MFA and token actions) sends on run unless you pass –dry-run first. The real permission boundary is the scope you grant the API client in CIPP, so keep autonomous agents to reads plus previewed writes. Full details in governance.md.
Frequently asked questions
Is there an MCP server for CIPP + Microsoft 365?
Yes - this one. A free, open source MCP server and Claude Code Skill for CIPP + Microsoft 365, built for MSPs. It runs locally on your machine, works with Claude, ChatGPT, Copilot, and any MCP-capable agent, and installs in about 60 seconds.
Is the CIPP + Microsoft 365 MCP server safe for client data?
Yes, by design - and the exceptions are ones you switch on yourself. The CLI, the MCP server, and any local data mirror run on your own machine, and nothing is sent to MSP Skills or any third party unless you ask for it. Three paths can move data off the machine, all opt-in: --deliver webhook:<url> posts a command’s output to a URL you name; CIPP_FEEDBACK_AUTO_SEND=true posts feedback you typed to the URL in CIPP_FEEDBACK_ENDPOINT (with no endpoint set, feedback only writes a local file); --transport http opens a local MCP listener you then choose whether to expose. Credentials stay in your environment, and every command is safety-tiered (read, write, destructive) so your agent only gets the permissions you grant. Full policy in the safety model on this page.
Is this an MCP server for Microsoft Defender, Intune, Exchange Online and Entra ID too?
Yes, through your CIPP instance. CIPP manages Microsoft 365 for every client tenant, so this connector reaches what CIPP reaches: Entra ID users, MFA and Conditional Access (cipp-cli list-mfausers), Intune policies and Autopilot (cipp-cli list-intune-policy), Exchange Online mailboxes, rules and forwarding (cipp-cli list-mailbox-forwarding), Defender for Endpoint health, vulnerabilities and incidents (cipp-cli list-defender-state, cipp-cli list-defender-tvm, cipp-cli exec-incidents-list), Defender for Office 365 safe links and anti-phishing, SharePoint and Teams, and GDAP roles and relationships (cipp-cli list-gdaproles). If you don’t run CIPP, the Microsoft Graph connector talks to Graph directly.
Why not use Microsoft’s own Defender MCP server?
Because it only sees your own tenant. Microsoft’s Defender tools in the Sentinel MCP server can’t be used “as a guest in another tenant or with delegated access” (Microsoft Learn, Sentinel MCP triage tool), so an MSP can’t point them at client tenants. This connector reads Defender across every client tenant through the GDAP access your CIPP instance already holds.
Does this work with ChatGPT?
Not with this build. ChatGPT connects only to remote MCP servers over HTTPS, which means running cipp-mcp in HTTP mode, and in this build HTTP mode asks for no password, listens on every network interface, and can be reached by a web page you open. Do not run it or put it behind a tunnel until the connector is reprinted; the security note at the top of the install guide explains why. Until then, use Claude Desktop, Claude Code or Codex.
Do I need to know how to code?
No. Paste one sentence into Claude Code or Codex and your agent does the install, or run a one-line installer. You enter your credentials once.
Is my CIPP data safe?
Your data stays on your machine. The CLI, MCP server, and the local store are all local. The AI sees query results, not raw bulk data, and credentials are never bundled or transmitted by MSP Skills.
What does it cost?
Free. Apache-2.0 licensed. You pay only for whichever AI agent you already use.
Do I need my own CIPP instance to use this?
Yes - this drives your own self-hosted CIPP instance’s API. In CIPP you create an API client (it issues a client ID, secret, tenant ID, and token URL); the CLI authenticates with OAuth2 client credentials via ‘cipp-cli auth login’, or you save a bearer token with ‘cipp-cli auth set-token’. It reads and acts through your CIPP - it does not replace it.
Will this hit Microsoft Graph or CIPP rate limits?
The cross-tenant rollups (posture, licenses waste, users stale, standards drift) read the local store after one fan-out, so repeat questions cost zero API calls. fanout throttles with –concurrency and the client retries 429s with Retry-After; bulk checkpoints completed rows with –resume so a throttled batch continues instead of restarting.
Can this change my tenants, or only read?
Both. CIPP is a full management API, so the CLI can create users, offboard, set forwarding, and more. But the fleet rollups are read-only, and bulk prints its plan by default and only writes when you pass –execute. If you want reporting only, scope the API client to read-only in CIPP - the credential is the boundary.
Does it replace the CIPP portal?
No. CIPP stays your portal for deep single-tenant work. This skill adds the cross-tenant reporting layer and lets your AI agent drive CIPP from natural language.
More Security connectors
Run more than one Security tool, or comparing options? These connectors work the same way: Abnormal Security · Avanan · Bitdefender GravityZone · Blumira · Cisco Duo · ConnectSecure · Cork · CrowdStrike Falcon · Fortinet · Google Workspace · Huntress · KnowBe4 · Microsoft Graph · Proofpoint TAP · RocketCyber · runZero · SaaS Alerts · SentinelOne · SonicWall · Sophos Central · ThreatDown · ThreatLocker · WatchGuard Cloud
Status
Live-verified. Confirmed by Abhi Saini, Bearium Networks (MSP) against their own production tenant (receipt). The version it verified was not recorded. More MSPs run it live in our weekly Build Sessions.
Build Sessions are free and stay free - The Build Room is where the deep work happens.
Standards. Conforms to the open Agent Skills spec (Anthropic, Dec 2025; 40+ agents). MCP-compatible - works with any MCP-capable agent including Hermes. OpenClaw-ready (frontmatter pre-wired, awaiting OpenClaw launch).
Maintained by Servosity for the MSP community. Apache-2.0 licensed. Built with CLI Printing Press.