Connect CIPP to Conduit

This walkthrough connects CIPP (CyberDrain Improved Partner Portal, the open-source Microsoft 365 management platform for MSPs) to Conduit. CIPP uses Entra ID OAuth client credentials — you register an API client in CIPP, which creates an Entra app registration, and Conduit exchanges the resulting Tenant ID, Client ID, and Client Secret for access tokens automatically.

Menu labels can change

The CIPP-portal steps below reflect CIPP’s API Client Management flow at time of writing; menu labels can shift between CIPP releases. If a label differs, look for the nearest equivalent in the same area of CIPP’s Settings.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A CIPP deployment running in your Azure tenant, with Administrator access to CIPP’s Settings. Conduit talks to CIPP’s API (an Azure Function App), not the CIPP web UI — if you haven’t deployed CIPP yet, see the official CIPP docs for the Azure deploy.
• Note both URLs your CIPP deployment gives you, because Conduit needs the second one specifically:
  • The Static Web App (SWA) URL — the browser UI, e.g. https://your-cipp-name.azurestaticapps.net or a custom domain.
  • The Function App URL — the API host, e.g. https://cippXXXXX.azurewebsites.net (typically cipp followed by random characters, found in your Azure resource group).

The URL gotcha

This is the most common CIPP-integration mistake. Conduit’s CIPP Base URL field must be the Function App URL, not the SWA URL. The SWA enforces interactive browser sign-in and returns its login page to any Bearer-token API call — so pointing Conduit at the SWA URL doesn’t fail loudly, it just returns HTML where Conduit expects JSON.

Step 1 — Register a CIPP API client

1. Sign in to your CIPP SWA URL as an Administrator. Expected: the CIPP dashboard.
2. Open Settings → API Client Management. Expected: the API clients list.
3. Click Register API Client (or New, depending on your CIPP version). Expected: CIPP creates an Entra ID app registration in your CIPP tenant.
4. Scope the client’s permissions to what the AI actually needs — CIPP’s API Client Management lets you restrict what a registered client can do; grant only what you intend to use through Conduit.
5. Copy the three values CIPP shows after registration:
   • Tenant ID — the Entra tenant ID where CIPP is deployed.
   • Client ID — the app registration’s application ID.
   • Client Secret — shown only once.

Caution

Copy all three values now and store them somewhere safe. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If exposed, regenerate the Client Secret in CIPP (Settings → API Client Management) — the exposed value becomes useless immediately.

Step 2 — Connect CIPP in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find CIPP in the catalog and click Connect. Expected: a credential form with four fields — CIPP Base URL, Entra Tenant ID, API Client ID, API Client Secret.
3. Fill in:
   • CIPP Base URL — the Function App URL from “Before you start” (not the SWA URL — see the gotcha above).
   • Entra Tenant ID, API Client ID, API Client Secret — the three values from Step 1.
4. Click Connect. Expected: Conduit requests an access token directly from Entra ID, then calls CIPP’s tenant-list API with it to confirm the client is authorized. A green Connected status means both steps succeeded. A bad credential or wrong URL is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this CIPP connection.

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only CIPP tool, such as listing your CIPP tenants. You should get real data back, and the call appears in your audit log with the correct user, vendor (cipp), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with an HTML/login-page-shaped error instead of a clean rejection	CIPP Base URL is pointing at the SWA URL, not the Function App URL — the single most common CIPP mistake. Update the connection with the Function App URL (https://<function-app-name>.azurewebsites.net), found in the Azure portal under your CIPP resource group.
“Invalid CIPP OAuth credentials (Entra HTTP 400/401)”	The Tenant ID, Client ID, or Client Secret is wrong, or the Client Secret was regenerated in CIPP after Conduit stored it. Re-verify all three against CIPP’s API Client Management and re-enter.
“CIPP rejected the OAuth-issued token” (authenticated against Entra, but CIPP said no)	The credentials are valid against Entra, but CIPP’s API Client Management doesn’t recognize this app as authorized. Confirm the client is still registered and enabled in CIPP’s Settings.
Tool calls return 403 “no credentials for vendor”	CIPP isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has credentials.
First call after idle is slow (20–40 seconds)	CIPP’s Function App runs on Azure Functions’ Consumption plan by default, which cold-starts after idle. Subsequent calls are fast. If this is a persistent problem, upgrading the Function App to a Premium/Always-On plan removes the cold start — CIPP runs the same either way.
Need to rotate the Client Secret	Regenerate it in CIPP (Settings → API Client Management → your client), then update the credential at /org/catalog. Tenant ID and Client ID stay the same.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credentials you just stored.
• CIPP project docs — for CIPP-itself questions (deploying CIPP, tenant management, API client roles).