> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CIPP

> Skip per-tenant role assignments: use CIPP to grant Rallied bulk admin consent across all your Microsoft 365 customer tenants and Exchange tools at once.

Connect CIPP (CyberDrain Improved Partner Portal) so the agent can grant admin consent across all your Microsoft 365 customer tenants at once and use Exchange tools in tenants where the Rallied app doesn't hold the Exchange Administrator role.

<Note>
  CIPP is a companion to the [Microsoft 365 integration](/integrations/microsoft-365) — connect Microsoft 365 first. Without CIPP, Microsoft 365 still works fully; you'll just grant consent and assign the Exchange role manually, one tenant at a time.
</Note>

## What it saves you

If your MSP already runs [CIPP](https://docs.cipp.app), connecting it is the fastest way to get every customer tenant ready:

* **Grant admin consent across all your tenants at once.** No more clicking **Grant admin consent** on each row of the Companies tab. Per-row consent still works for any tenant CIPP can't reach.
* **Use Exchange tools without assigning the Exchange Administrator role per tenant.** The agent picks up distribution groups and shared mailboxes through CIPP automatically. Those tenants show **Exchange: working (cipp)** on the Companies tab.

<Note>
  [Mailbox forwarding and inbox rule tools](/integrations/microsoft-365#email-forwarding-and-inbox-rules) don't route through CIPP yet. To use them in a tenant, assign the Exchange Administrator role directly ([Microsoft 365, Phase 3](/integrations/microsoft-365#step-3-assign-the-exchange-administrator-role)).
</Note>

## How to connect

<Steps>
  <Step title="Get credentials from CIPP">
    In your CIPP instance, go to **Application Settings → API Integration → + Add Application**. Name it something like `Rallied` and give it the **admin** role.

    CIPP gives you four values to copy:

    * **CIPP API URL** — the URL of your CIPP instance (e.g. `https://cipp-xxxxx.azurestaticapps.net`, or your custom domain)
    * **Tenant ID** — the Microsoft tenant hosting your CIPP deployment
    * **Client ID** — the Application (Client) ID from the Entra ID app registration CIPP created
    * **Application Secret** — shown by CIPP once, right after you save the Azure configuration

    <Warning>
      Copy the **Application Secret** right away. CIPP only shows it once. If you miss it, generate a new one in **Entra ID → App registrations → \[your CIPP API app] → Certificates & secrets**.
    </Warning>
  </Step>

  <Step title="Connect in Rallied">
    Go to **Settings → Integrations**, find the **CIPP** card, and click **Connect**. Paste in all four values and click **Connect** again. Rallied checks the credentials with CIPP before saving. If anything's wrong, you'll see an inline error.
  </Step>

  <Step title="Refresh your tenants">
    For any customer tenant where you haven't manually assigned the Exchange Administrator role, click **Re-verify** on the row in the Microsoft 365 **Companies** tab. The Exchange badge flips to **working (cipp)** and the agent can use distribution groups and shared mailboxes for that tenant. No further setup needed.
  </Step>
</Steps>

## Editing or disconnecting

Edit any field from the CIPP detail page. Leave **Application Secret** blank to keep the existing one; type a new value to rotate it.

To disconnect, click **Disconnect**. When you do:

* Bulk consent goes away, and tenants that were using CIPP for Exchange drop back to **pending**.
* If you still want Exchange tools to work there, assign the Exchange Administrator role in each tenant manually ([Microsoft 365, Phase 3](/integrations/microsoft-365#step-3-assign-the-exchange-administrator-role)).
* Everything else (user, password, and group management) keeps working as before.

## Troubleshooting

<AccordionGroup>
  <Accordion title="'Invalid client secret' when connecting">
    The secret CIPP gave you has likely expired or been rotated. Generate a fresh one in Entra ID → **App registrations → \[your CIPP API app] → Certificates & secrets**, paste it into the CIPP detail page, and click **Save changes**.
  </Accordion>

  <Accordion title="'Grant all pending via CIPP' button is missing">
    That button only appears once CIPP is connected. Connect it from **Settings → Integrations**, or click **Connect CIPP for bulk grant** on the Companies tab to jump straight there.
  </Accordion>

  <Accordion title="Tenant still shows Exchange pending after Re-verify">
    CIPP itself needs to be able to manage that tenant. Check that the tenant appears in CIPP's **Tenants** list and is healthy. If CIPP can't manage it either, assign the Exchange Administrator role to the Rallied app directly ([Microsoft 365, Phase 3](/integrations/microsoft-365#step-3-assign-the-exchange-administrator-role)).
  </Accordion>
</AccordionGroup>

## See also

* [Microsoft 365](/integrations/microsoft-365) — the integration CIPP accelerates
* [CIPP documentation](https://docs.cipp.app)
* [Setting up the CIPP API integration](https://docs.cipp.app/setup/api)
* [Integrations overview](/integrations/overview)