cipp-groups — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cipp-groups (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Groups in CIPP cover all four Entra/M365 group types: Security, Microsoft 365 (unified), Distribution List, and Mail-Enabled Security. Most groups are managed through CIPP for delegation simplicity, but membership changes for individual users typically flow through cipp_list_user_groups (read) and the M365 plugin or graph-API for write operations.
cipp_list_groupscipp_list_groups(tenantFilter='contoso.onmicrosoft.com')Returns all groups in the tenant with id, displayName, groupTypes, mailEnabled, securityEnabled, and member count. Use to audit group sprawl, find candidate distribution lists for cleanup, or resolve group names to IDs.
cipp_create_groupcipp_create_group(tenantFilter, displayName, description?,
groupType='Security'|'Microsoft 365'|'Distribution'|'Mail-Enabled Security',
mailNickname?, members?)mailNickname is required for any mail-enabled group type. Members can be supplied at creation time as a list of UPNs or object IDs.
| Type | Mail-enabled | Use case |
|---|---|---|
| Security | No | RBAC, conditional access scoping, license assignment |
| Microsoft 365 | Yes | Teams, SharePoint, shared inbox + collaboration |
| Distribution | Yes | Email distribution only, no shared workspace |
| Mail-Enabled Security | Yes | Both: mail distribution AND security scoping |
Pick Security for permissions-only, Microsoft 365 for collaboration with a shared mailbox/Teams workspace, Distribution for plain mailing lists.
Find groups a user belongs to before offboarding
groups = cipp_list_user_groups(tenantFilter, userId='[email protected]')cipp_offboard_user with removeFromGroups=true handles this automatically; only do it manually when you need an explicit audit trail.
Audit large unmanaged groups
After cipp_list_groups, sort by member count and flag any with > 50 members and no description. These are usually historical distribution lists no one owns.
CIPP's group toolset is intentionally narrow — for membership changes (add/remove user), conditional access scoping, or license assignment via groups, use the M365 plugin or work directly against the Graph API. CIPP focuses on the multi-tenant CRUD surface.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.