cipp-standards — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cipp-standards (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Standards are CIPP's mechanism for declaring "this is what every tenant we manage should look like" and continuously enforcing it. The Best Practice Analyser (BPA) is the read side — it shows you where current tenant state diverges from CIPP's recommended baseline. Domain health is a complementary check focused on email authentication.
cipp_list_standardscipp_list_standards(tenantFilter='contoso.onmicrosoft.com')Returns the list of standards configured for the tenant: which standards are enabled, what action each takes (Report, Alert, Remediate), and current compliance status. Use tenantFilter='allTenants' for a portfolio-wide view.
cipp_run_standards_checkcipp_run_standards_check(tenantFilter='contoso.onmicrosoft.com')Triggers an on-demand standards evaluation. CIPP runs this on a schedule, but force a fresh run after deploying a new standard or remediating a finding to confirm the fix took.
cipp_list_bpacipp_list_bpa(tenantFilter='contoso.onmicrosoft.com')Returns the latest Best Practice Analyser report — every CIPP-recommended check with Pass/Fail/Warn status across categories (Security, Identity, Mail, SharePoint, Teams, Intune). The most useful single call for tenant health.
cipp_list_domain_healthcipp_list_domain_health(tenantFilter='contoso.onmicrosoft.com')Per-domain SPF, DKIM, DMARC, MX, and DNSSEC results. Run for any tenant where mail authentication is suspect or before/after migrating mail.
A "standard" in CIPP has three modes:
| Mode | Behavior |
|---|---|
Report | Check only; show in BPA |
Alert | Check + raise alert when out of compliance |
Remediate | Check + auto-fix when out of compliance |
The progression for an MSP rolling out a new baseline is typically Report → Alert → Remediate over weeks, with the longest dwell in Alert to validate that auto-remediation will be safe.
bpa = cipp_list_bpa(tenantFilter)
fails = [check for check in bpa if check['status'] == 'Fail']
domain = cipp_list_domain_health(tenantFilter)
broken_dmarc = [d for d in domain if d.get('dmarcPass') is not True]A tenant with > 5 BPA failures or any broken DMARC needs a remediation plan, not just a report.
all_tenants_standards = cipp_list_standards(tenantFilter='allTenants')Compare the standards each tenant has enabled against the MSP's master baseline list. Tenants missing a baseline standard usually mean the standard was deployed after the tenant onboarded and never backfilled.
Before you change a tenant's identity or mail config:
cipp_list_bpa — capture current statecipp_run_standards_check to force a fresh evaluationcipp_list_bpa again — diff against pre-change capture| Result | Meaning | Action |
|---|---|---|
| SPF: missing | No SPF record at all | Add v=spf1 include:spf.protection.outlook.com -all |
| SPF: too many lookups | Record exceeds 10-DNS-lookup limit | Flatten or consolidate include: directives |
| DKIM: not configured | Default DKIM signing disabled | Enable in Defender / Exchange Admin |
DMARC: p=none | Reporting only, no enforcement | Move to p=quarantine after monitoring |
| DMARC: missing | No DMARC record | Add v=DMARC1; p=none; rua=mailto:dmarc@... to start |
cipp_run_standards_check for fresh data.Remediate mode can change tenant configuration without an additional confirmation — scope carefully and stage Alert first.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.