Skip to main content
To connect CIPP (CyberDrain Improved Partner Portal), you create an API client in CIPP and paste four of its values into Rallied. You need the Microsoft 365 integration connected first.
Microsoft 365 works fully without CIPP. You approve consent yourself, one click per tenant, and Rallied handles the roles. See Microsoft 365, Phase 3.

​
What CIPP adds

Forwarding and inbox rule tools and the licensed shared mailbox check don’t go through CIPP. They need the Exchange Administrator role on the Rallied app. See assign the roles manually.

​
How CIPP retries user changes

Password resets, user enable and disable, and user deletion try Microsoft Graph first. Microsoft refuses with 403 Authorization_RequestDenied when the Rallied app holds no role that allows the change (which roles count). Rallied then retries the change through CIPP, under your GDAP roles.
  • CIPP generates its own password. The agent shares the password (or one-time link) from CIPP’s result, not the one it proposed.
  • Only a 403 triggers a retry. A timeout or server error is never retried, because the first change may already have landed.
  • End-user self-service resets aren’t retried. The end user can’t be shown the generated password, so a technician runs that reset instead.
  • If CIPP also fails, the step fails. The failure comes after the technician’s approval. The agent escalates the ticket and names the tenant and the role to assign.

​
How to connect

1

Get credentials from CIPP

  1. In your CIPP instance, go to Integrations → CIPP-API, then Actions → Create New Client.
  2. Name the client something like Rallied, give it the admin role, and enable the client. Rallied pushes admin consent and runs Exchange actions through this client, so CIPP rejects those calls under a restricted role. IP ranges and MCP access can stay as they are.
  3. Click Actions → Save to Azure so CIPP’s function app accepts the new client. The Tenant ID on that page can take 5 to 15 minutes to populate.
Copy these four values from the CIPP-API page:
Copy the Application Secret right away. CIPP only shows it once. If you miss it, generate a new one in Entra ID → App registrations → [your CIPP API app] → Certificates & secrets.
2

Connect in Rallied

Go to Settings → Integrations, find the CIPP card, and click Connect. Paste in all four values and click Connect again. Rallied checks the credentials with CIPP before saving and shows an inline error if anything’s wrong.
3

Watch the Companies tab

Rallied checks CIPP’s Tenants list and pushes admin consent into every Not yet consented tenant that CIPP manages. Every later Sync from Microsoft does the same for new tenants.
  • Rows turn Processing…, then Ready. CIPP applies grants in the background, so this can take a few minutes. Rallied looks again after 15 minutes, an hour later, and on its daily check.
  • A tenant that isn’t in CIPP’s list reads Not in CIPP. See Troubleshooting.
  • Rallied routes tenants that already had consent through CIPP for Exchange on its next daily check or Sync.

​
Editing or disconnecting

Edit any field from the CIPP detail page. Leave Application Secret blank to keep the existing one, or type a new value to rotate it. When you click Disconnect:
  • Rallied stops pushing consent through CIPP. Tenants that used CIPP for Exchange read Finishing setup… or Needs access method until the Exchange role is in place another way.
  • Consent already granted stays granted. For new tenants, switch to Approve yourself in the Companies tab guide (Microsoft 365, Phase 3). Rallied then assigns the Exchange role itself, or you can assign it manually.
  • User, password, and group management keep working as before.

​
Troubleshooting

The secret has likely expired or been rotated. Generate a fresh one in Entra ID → App registrations → [your CIPP API app] → Certificates & secrets, paste it into the CIPP detail page, and click Save changes.
The tenant isn’t in CIPP’s Tenants list, or is marked excluded there. Add it to CIPP with an active GDAP relationship, and Rallied pushes the approval on its next check. Or click Grant admin consent on the row to open the Microsoft consent page directly. Then approve as a Global Administrator of that tenant.
CIPP accepted Rallied’s request and nothing landed. The status names the cause Rallied found:
  • CIPP’s GDAP role in that tenant can’t add applications.
  • There’s no working GDAP relationship.
  • CIPP added the app but couldn’t grant its permissions. Its GDAP relationship lacks Privileged Role Administrator, which Microsoft requires for application permissions.
Details → History on the row shows what Rallied asked for and the lines CIPP’s logbook wrote for that tenant (Logs, API “Add Multitenant App”). It also shows CIPP’s access check for the relationship, so you don’t have to search CIPP yourself.Fix it in CIPP, and Rallied looks again an hour later and on its daily check. Or approve the tenant yourself from the row. Once a CIPP push has gone nowhere, the row opens the Microsoft page directly.
The retry through CIPP failed too. Check that the tenant is in CIPP’s Tenants list and that your GDAP relationship includes User Administrator. Resetting that user from the CIPP UI is the quickest check.
With CIPP connected, this is never about the Exchange Administrator role. CIPP is re-applying an approval that predates a new permission, and everything already approved keeps working. If it stays, check that the tenant is in CIPP’s Tenants list with a working GDAP relationship, or click Grant admin consent on the row and approve again.