Skip to main content
Triggr runs its Microsoft 365 user, mailbox and Conditional Access steps, tenant lookups and form dropdowns through your CIPP instance.

​
Set up CIPP

If you self-host CIPP and first deployed it before v7.1, give the Function App the Contributor role first. See CIPP’s Pre Version 7.1 Self-Hosted Deployments.
1

Create the client

In CIPP, go to CIPP > Integrations, click CIPP-API, then on the Function Authentication card click Actions > Create New Client.
2

Fill in the client

Set App Name to Triggr (CIPP rate-limits each client separately) and Select Role to admin, or a narrower role that covers your workflows; readonly blocks every change. Leave Enter IP Ranges empty or include Triggr’s IP addresses, turn on Enable this client and leave MCP Access Allowed off.
3

Submit and copy the secret

CIPP shows the application secret only once. If you lose it, choose Reset Application Secret from the three dots in the client’s Actions column.
4

Save to Azure

Click Actions > Save to Azure and confirm. CIPP rejects the client until you do, and can take up to 60 seconds to apply it.
5

Copy the connection details

Copy API Url and Token URL from the Function Authentication card, and the client’s ID from its row in CIPP-API Clients, then choose Copy API Scope from the three dots in its Actions column. Token URL can read Not Available for 5 to 15 minutes after your first client.
See CIPP’s CIPP-API & MCP guide.

​
Connect it in Triggr

1

Open the integration

Go to Integrations > CIPP and click Configure on the Base Configuration card.
The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.
2

Enter the connection details

Enter the API Url as cippApiUrl, without /api or a trailing slash, then the client’s ID, secret, API scope (api://<client-id>/.default) and Token URL in the other four fields. Click Save Configuration.
The CIPP configuration window with cippApiUrl, cippAuthClientId, cippAuthClientSecret, cippAuthScope and cippAuthTokenUrl fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.

​
Run Microsoft 365 steps through CIPP

Go to Settings > Org Variables, click Setup Wizard and click CIPP under Preferred Microsoft Connection Method. Microsoft steps with Connection Type set to Automatic then use CIPP; to use CIPP for a single step, set its Connection Type to CIPP. There’s no client mapping: CIPP works in the tenant in the client’s microsoftTenantId variable. To add it, open the client in Clients, click Manage Variables on the Variables card, then New Variable. In your own workflows and forms, set a CIPP action’s tenantFilter to {{ ctx.client.microsoftTenantId }}.

​
Troubleshooting

cippAuthTokenUrl must use the tenant CIPP runs in, not a client’s, and the ID in cippAuthScope must match cippAuthClientId. If Microsoft returns 400, add an Application ID URI under Expose an API on the client’s app registration in Microsoft Entra.
Check Enable this client and Microsoft Authentication Enabled are on, then click Save to Azure and wait 60 seconds. Check the client’s IP ranges include Triggr’s addresses and its role allows the action.
CIPP’s CIPP-SAM application is missing the Microsoft Graph permissions named in the error. Add them to CIPP-SAM with admin consent, then try again.
cippApiUrl must be the API Url from CIPP, not the web portal’s address, without /api.
Add the client’s microsoftTenantId variable.