cipp-tenants — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cipp-tenants (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Tenants are the top-level scope in CIPP. Every operational tool — users, mailboxes, standards, security — takes a tenantFilter parameter that scopes the call to one tenant or to allTenants. Knowing how to enumerate tenants and resolve a friendly name to its tenant ID is the first step in almost every CIPP workflow.
cipp_list_tenantsList every tenant CIPP manages. Returns a list of tenant objects with customerId, defaultDomainName, displayName, and onboarding status.
cipp_list_tenants()Use this whenever a user refers to a client by name — the response gives you the defaultDomainName (or customerId) needed for tenantFilter on every other tool.
cipp_get_tenant_detailsRetrieve detailed information for one tenant: license count, domain list, GDAP relationship status, last refresh time.
cipp_get_tenant_details(tenantFilter='contoso.onmicrosoft.com')Use tenantFilter='allTenants' to get a portfolio-wide aggregate — useful for fleet reports.
Most CIPP tools accept any of these in tenantFilter:
| Format | Example | Notes |
|---|---|---|
| Default domain | contoso.onmicrosoft.com | Most readable, recommended |
| Custom domain | contoso.com | Works if CIPP has it cached |
| Tenant GUID | 00000000-0000-0000-0000-000000000000 | Most stable but opaque |
allTenants | allTenants | Portfolio-wide; only some tools support it |
When a user says "Acme", always run cipp_list_tenants first and resolve to the canonical defaultDomainName before calling other tools. Never guess the tenant identifier.
Resolve a friendly name → tenant filter
tenants = cipp_list_tenants()
acme = next(t for t in tenants if 'acme' in t['displayName'].lower())
tenant_filter = acme['defaultDomainName']Audit which tenants are stale in CIPP cache
cipp_get_tenant_details returns lastRefresh. Tenants not refreshed in >24h often signal a broken GDAP relationship or revoked consent — flag them before running standards or BPA checks against them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.