Skip to main content
Connect CIPP (CyberDrain Improved Partner Portal) so the agent can grant admin consent across all your Microsoft 365 customer tenants at once and use Exchange tools in tenants where the Rallied app doesn’t hold the Exchange Administrator role.
CIPP is a companion to the Microsoft 365 integration — connect Microsoft 365 first. Without CIPP, Microsoft 365 still works fully; you’ll just grant consent and assign the Exchange role manually, one tenant at a time.

​
What it saves you

If your MSP already runs CIPP, connecting it is the fastest way to get every customer tenant ready:
  • Grant admin consent across all your tenants at once. No more clicking Grant admin consent on each row of the Companies tab. Per-row consent still works for any tenant CIPP can’t reach.
  • Use Exchange tools without assigning the Exchange Administrator role per tenant. The agent picks up distribution groups and shared mailboxes through CIPP automatically. Those tenants show Exchange: working (cipp) on the Companies tab.

​
How to connect

1

Get credentials from CIPP

In your CIPP instance, go to Application Settings → API Integration → + Add Application. Name it something like Rallied and give it the admin role.CIPP gives you four values to copy:
  • CIPP API URL — the URL of your CIPP instance (e.g. https://cipp-xxxxx.azurestaticapps.net, or your custom domain)
  • Tenant ID — the Microsoft tenant hosting your CIPP deployment
  • Client ID — the Application (Client) ID from the Entra ID app registration CIPP created
  • Application Secret — shown by CIPP once, right after you save the Azure configuration
Copy the Application Secret right away. CIPP only shows it once. If you miss it, generate a new one in Entra ID → App registrations → [your CIPP API app] → Certificates & secrets.
2

Connect in Rallied

Go to Settings → Integrations, find the CIPP card, and click Connect. Paste in all four values and click Connect again. Rallied checks the credentials with CIPP before saving. If anything’s wrong, you’ll see an inline error.
3

Refresh your tenants

For any customer tenant where you haven’t manually assigned the Exchange Administrator role, click Re-verify on the row in the Microsoft 365 Companies tab. The Exchange badge flips to working (cipp) and the agent can use distribution groups and shared mailboxes for that tenant. No further setup needed.

​
Editing or disconnecting

Edit any field from the CIPP detail page. Leave Application Secret blank to keep the existing one; type a new value to rotate it. To disconnect, click Disconnect. When you do:
  • Bulk consent goes away, and tenants that were using CIPP for Exchange drop back to pending.
  • If you still want Exchange tools to work there, assign the Exchange Administrator role in each tenant manually (Microsoft 365, Phase 3).
  • Everything else (user, password, and group management) keeps working as before.

​
Troubleshooting

The secret CIPP gave you has likely expired or been rotated. Generate a fresh one in Entra ID → App registrations → [your CIPP API app] → Certificates & secrets, paste it into the CIPP detail page, and click Save changes.
That button only appears once CIPP is connected. Connect it from Settings → Integrations, or click Connect CIPP for bulk grant on the Companies tab to jump straight there.
CIPP itself needs to be able to manage that tenant. Check that the tenant appears in CIPP’s Tenants list and is healthy. If CIPP can’t manage it either, assign the Exchange Administrator role to the Rallied app directly (Microsoft 365, Phase 3).

​
See also