CIPP Inspector Summary
Summary
| Property | Value |
|---|---|
| Production Status | Preview |
| Category | Cloud |
| Discovers | One child launchpoint per managed Microsoft 365 tenant, mapped to that Customer's Liongard Environment |
Description
The CIPP Inspector monitors a Partner's self-hosted CIPP (CyberDrain Improved Partner Portal) instance and every Microsoft 365 tenant that instance manages. The parent enumerates the managed tenants and reports the health of the GDAP delegated-admin relationships that grant access to them; each child reports one managed tenant's Microsoft Secure Score, license utilization, Conditional Access policies, standards compliance, MFA coverage, users, inactive accounts, and open Microsoft 365 Defender security incidents.
Asset Mapping: No asset mappings ship with this Inspector.
Data View Information
Parent Overview Table
- CIPP Instance Overview
- Total Managed Tenants
- GDAP Relationships
- GDAP Relationships Expiring Soon
- Discovered Child Count
Parent Data Tab Headers
- Overview
- Tenants — 4 columns
- GDAP Relationships — 5 columns
Child Overview Table
- Tenant Overview
- Tenant Name
- Secure Score Percentage
- License SKUs
- Conditional Access Policies (Total / Enabled)
- Standards Non-Compliant
- Total Users
- MFA Coverage Percentage
- Inactive Accounts
- Open Security Incidents
Child Data Tab Headers
- Overview
- Licenses — 4 columns
- Conditional Access — 5 columns
- Standards — 4 columns
- Users — 5 columns
- MFA — 4 columns
- Inactive Accounts — 3 columns
- Security Incidents — 5 columns
Metrics
| Metric | Description |
|---|---|
| CIPP: Total Managed Tenants | Total M365 tenants managed by this CIPP instance. Tenants whose record carries no usable default domain name are counted here but cannot become child launchpoints, so this can exceed the number of children. |
| CIPP: GDAP Relationships | Total delegated admin (GDAP) relationships with Customer tenants. |
| CIPP: GDAP Relationships Expiring Soon | Delegated admin relationships expiring within 30 days, including any already expired. An expired GDAP relationship removes CIPP's — and this Inspector's — access to that tenant. |
| CIPP: Tenant Domains | Default domain names of all managed tenants, used for new/removed tenant detection. |
| CIPP: Secure Score Percentage | Microsoft Secure Score for this tenant, as a percentage of the maximum achievable score. |
| CIPP: License SKUs | Number of distinct Microsoft 365 license SKUs assigned to this tenant. |
| CIPP: Conditional Access Policies | Total Conditional Access policies configured for this tenant. |
| CIPP: Conditional Access Policies Enabled | Conditional Access policies currently in the enabled state (excludes report-only and disabled). |
| CIPP: Standards Non-Compliant | CIPP Standards currently reporting a non-compliant state for this tenant. |
| CIPP: Total Users | Total Entra ID users in this tenant. |
| CIPP: Users Without MFA | Users whose legacy per-user MFA state is not enabled or enforced. This reads Entra's per-user MFA setting, not MFA registration. |
| CIPP: MFA Coverage Percentage | Percentage of reported users whose legacy per-user MFA state is enabled or enforced. Not MFA registration coverage. |
| CIPP: Inactive Accounts | User accounts with no sign-in activity in the last 180 days. |
| CIPP: Open Security Incidents | Microsoft 365 Defender security incidents not in a resolved or closed state. |
Actionable Alerts
| Rule | Trigger | Severity |
|---|---|---|
| CIPP | Secure Score Below Threshold | Secure Score Percentage drops below 50% | High |
| CIPP | MFA Coverage Below Threshold | MFA Coverage Percentage drops below 90% | High |
| CIPP | Open Security Incidents Changed | Open Security Incidents count changes | High |
| CIPP | Users Without MFA Changed | Users Without MFA count changes | Medium |
| CIPP | Conditional Access Policy Count Changed | Conditional Access Policies count changes | Medium |
| CIPP | Conditional Access Enabled Count Changed | Conditional Access Policies Enabled count changes | Medium |
| CIPP | Standards Non-Compliant Changed | Standards Non-Compliant count changes | Medium |
| CIPP | GDAP Relationship Expiring Soon | GDAP Relationships Expiring Soon rises above 0 | Medium |
| CIPP | Inactive Account Count Changed | Inactive Accounts count changes | Low |
| CIPP | Tenant Added or Removed | Tenant Domains (the set of managed tenants) changes | Low |
All alerts ship disabled and can be enabled per your thresholds.
Updated about 3 hours ago
Did this page help you?