> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CIPP

> Connect CIPP to Triggr with a CIPP-API client, so Triggr works in your clients' Microsoft 365 tenants through CIPP.

Triggr runs its Microsoft 365 user, mailbox and Conditional Access steps, tenant lookups and form dropdowns through your CIPP instance.

## Set up CIPP

If you self-host CIPP and first deployed it before v7.1, give the Function App the Contributor role first. See CIPP's [Pre Version 7.1 Self-Hosted Deployments](https://docs.cipp.app/user-documentation/cipp/integrations/cipp-api#pre-version-7.1-self-hosted-deployments).

<Steps>
  <Step title="Create the client">
    In CIPP, go to **CIPP > Integrations**, click CIPP-API, then on the Function Authentication card click **Actions > Create New Client**.
  </Step>

  <Step title="Fill in the client">
    Set App Name to `Triggr` (CIPP rate-limits each client separately) and Select Role to admin, or a narrower role that covers your workflows; readonly blocks every change. Leave Enter IP Ranges empty or include [Triggr's IP addresses](/security/ip-allowlist), turn on Enable this client and leave MCP Access Allowed off.
  </Step>

  <Step title="Submit and copy the secret">
    CIPP shows the application secret only once. If you lose it, choose Reset Application Secret from the three dots in the client's Actions column.
  </Step>

  <Step title="Save to Azure">
    Click **Actions > Save to Azure** and confirm. CIPP rejects the client until you do, and can take up to 60 seconds to apply it.
  </Step>

  <Step title="Copy the connection details">
    Copy API Url and Token URL from the Function Authentication card, and the client's ID from its row in CIPP-API Clients, then choose Copy API Scope from the three dots in its Actions column. Token URL can read Not Available for 5 to 15 minutes after your first client.
  </Step>
</Steps>

See CIPP's [CIPP-API & MCP](https://docs.cipp.app/user-documentation/cipp/integrations/cipp-api) guide.

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > CIPP** and click **Configure** on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the connection details">
    Enter the API Url as cippApiUrl, without `/api` or a trailing slash, then the client's ID, secret, API scope (`api://<client-id>/.default`) and Token URL in the other four fields. Click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/MwzXHG3UWzFixdSz/images/cipp/configure.png?fit=max&auto=format&n=MwzXHG3UWzFixdSz&q=85&s=8ed33eb14715aec325ec2633e27d957b" alt="The CIPP configuration window with cippApiUrl, cippAuthClientId, cippAuthClientSecret, cippAuthScope and cippAuthTokenUrl fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1618" data-path="images/cipp/configure.png" />
    </Frame>
  </Step>
</Steps>

## Run Microsoft 365 steps through CIPP

Go to **Settings > Org Variables**, click Setup Wizard and click CIPP under Preferred Microsoft Connection Method. Microsoft steps with Connection Type set to Automatic then use CIPP; to use CIPP for a single step, set its Connection Type to CIPP.

## Link each client to its Microsoft tenant

There's no client mapping: CIPP works in the tenant in the client's `microsoftTenantId` variable. To add it, open the client in Clients, click Manage Variables on the Variables card, then New Variable. In your own workflows and forms, set a CIPP action's `tenantFilter` to `{{ ctx.client.microsoftTenantId }}`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Triggr can't get an access token">
    cippAuthTokenUrl must use the tenant CIPP runs in, not a client's, and the ID in cippAuthScope must match cippAuthClientId. If Microsoft returns 400, add an Application ID URI under Expose an API on the client's app registration in Microsoft Entra.
  </Accordion>

  <Accordion title="CIPP rejects requests (401 or 403)">
    Check Enable this client and Microsoft Authentication Enabled are on, then click Save to Azure and wait 60 seconds. Check the client's IP ranges include Triggr's addresses and its role allows the action.
  </Accordion>

  <Accordion title="CIPP shows a permission error when creating the client">
    CIPP's CIPP-SAM application is missing the Microsoft Graph permissions named in the error. Add them to CIPP-SAM with admin consent, then try again.
  </Accordion>

  <Accordion title="Requests return 404 or a response Triggr can't parse">
    cippApiUrl must be the API Url from CIPP, not the web portal's address, without `/api`.
  </Accordion>

  <Accordion title="microsoftTenantId not found in tenant metadata">
    Add the client's `microsoftTenantId` variable.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.