# CIPP MCP - Microsoft 365, Entra ID, Intune, Exchange, Defender, GDAP

Links AI agents to the CIPP API to inspect Microsoft 365 and Intune tenants. Useful for MSP engineers running fleet-wide posture audits.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/cipp
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/cipp-mcp-microsoft-365-entra-id-intune-exchange-defender-gdap

## What it does

The server bridges your AI agent to the CIPP API across managed customer environments. It surfaces Microsoft 365 and Exchange Online settings inside a single prompt workspace. Under the hood, the installer drops two binaries: `cipp-cli` for terminal tasks and `cipp-mcp` for agent communication. The package also maintains an offline cache for fleet posture lookups.

Take precautions with API permissions. The built-in `cipp_execute` tool exposes 299 write actions without interactive confirmation prompts. Grant the connector an API token with read-only roles so the model cannot make unprompted changes to client settings.

Never launch the connector using `--transport http`. That mode listens on all network interfaces without authentication or browser rebinding protection. Stick strictly to the standard `stdio` transport to keep your environment secure.

## Requirements
- Environment variables: `CIPP_API_KEY`, `CIPP_BASE_URL`, `CIPP_NO_CONFIG_WRITE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- audit Entra ID and Intune configurations across multiple tenants
- inspect Microsoft 365 security posture without opening admin portals
- query Defender alerts and Exchange settings across GDAP accounts
- scan client tenants for non-compliant policies from the CLI

## Example prompts
- List active Defender alerts across all client tenants managed through CIPP
- Find devices failing Intune compliance rules in our tenant fleet
- Compare conditional access policies across connected Microsoft 365 accounts

## Similar
- [mcp-server](https://affpapa.org/en/nevibecode/mcp/mcp-server.md) — MCP server · ★ 43902
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17191
- [firebase-mcp](https://affpapa.org/en/nevibecode/mcp/firebase-mcp.md) — MCP server · ★ 4482
- [Radar Kubernetes MCP Server](https://affpapa.org/en/nevibecode/mcp/radar-kubernetes-mcp-server.md) — MCP server · ★ 3918
- [Supabase](https://affpapa.org/en/nevibecode/mcp/supabase.md) — MCP server · ★ 2974
- [Microsoft Fabric MCP Server](https://affpapa.org/en/nevibecode/mcp/microsoft-fabric-mcp-server.md) — MCP server · ★ 3804

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md