CIPP.app

Manage Microsoft 365 tenants via CIPP.app

Actions619

Alert Actions
- Add
- Add Alert Rule
- Get Many
- Get Security Alerts
- Get Security Incidents
- List Audit Log Searches
- List Webhook Alerts
- Remove Queued Alert
- Search Audit Log
- Set Security Alert Status
- Set Security Incident Status
- Test Audit Log
Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App Repository
- List Apps Repository
- List Detected App Devices
- List Detected Apps
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
Autopilot Actions
- Add Configuration
- Add Device
- Add Enrollment
- Assign
- Get Configurations
- Get Many
- Remove
- Remove Configuration
- Rename Device
- Set Group Tag
- Sync
- Sync DEP
Backup Actions
- Get Many
- Restore
- Run
- Set Auto-Backup
CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
CIPP Core Actions
- Execute CIPP Function
- Execute GitHub Action
- Get App Status
- Get CIPP Alerts
- Get External Tenant Info
- Get Version
- List Function Parameters
- List Function Stats
- List GitHub Release Notes
- List Known IP Database
- List Logs
- Manage Durable Functions
- Offload Functions
CIPP v10.5 Actions
- Add Assignment Filter Template
- Add DLP Compliance Policy
- Add Enrollment
- Add Group Team
- Add Retention Compliance Policy
- Add Sensitive Info Type
- Add Sensitivity Label
- Add User Bulk
- Assign Policy
- Edit Assignment Filter
- Edit DLP Compliance Policy
- Edit Retention Compliance Policy
- Edit Sensitive Info Type
- Edit Sensitivity Label
- Execute Assignment Filter Delete
- Execute Mailbox Restore
- Execute MCP
- Execute SharePoint Version Cleanup
- List ActiveSync Devices
- List Android Enrollment Profiles
- List Apple Enrollment Profiles
- List Assignment Filter Templates
- List CSP SKU
- List DLP Compliance Policy
- List HVE Accounts
- List Licenses Report
- List Mailbox Restores
- List Retention Compliance Policy
- List Sensitive Info Type
- List Sensitivity Label
- List Snoozed Alerts
- Patch User
- Remove Admin Role
- Remove Assignment Filter Template
- Remove DLP Compliance Policy
- Remove Enrollment Profile
- Remove Retention Compliance Policy
- Remove Sensitive Info Type
- Remove Sensitivity Label
- Remove Snooze
- Set CAS Mailbox
- Set Package Tag
- Snooze Alert
CIPP v10.6 Actions
- Add Intune Policy Clone
- Execute Add CVE Exception
- Execute Backup Replication Config
- Execute Bulk Remove Sharing Links
- Execute Copilot Settings
- Execute GDAP Repair Role Mappings
- Execute Remove CVE Exception
- Execute Remove SharePoint External User
- Execute Remove Sharing Link
- Execute Remove Site User
- Execute Restore Deleted Site
- Execute Restore Recycle Bin Items
- Execute SAM Certificate
- Execute Set Library Permission
- Execute Set Site Properties
- Execute Shadow AI Sanction
- List Active Alert Results
- List Agent 365 Packages
- List Audit Log Coverage
- List Copilot Settings
- List Copilot Usage
- List CVE Management
- List Deleted Sites
- List Sensitive Info Type Rule Package
- List Shadow AI
- List SharePoint External Users
- List SharePoint Sharing
- List SharePoint Version Cleanup
- List Site Libraries
- List Site Properties
- List Site Recycle Bin
Conditional Access Actions
- Add Exclusion
- Add Named Location
- Add Policy
- Add Service Exclusion
- Add Template
- CA Policy Check
- Check Policy
- Edit Named Location
- Edit Policy
- List Named Locations
- List Policies
- List Policy Changes
- List Templates
- Manage Named Location
- Remove Policy
- Remove Template
Contact Actions
- Add Contact
- Add Contact Template
- Edit Contact
- Edit Contact Template
- List Contact Permissions
- List Contact Templates
- List Contacts
- Modify Contact Permissions
- Remove Contact
- Remove Contact Template
Device Actions
- Execute Action
- Get Details
- Get LAPS Password
- Get Many
- Get Recovery Key
- List Detected App Devices
- List Detected Apps
- Manage
- Set Cloud Managed
- Set Package Tag
Email Security Actions
- Add Connection Filter
- Add Exchange Connector
- Add Spam Filter
- Add Tenant Allow/Block List
- Add Transport Rule
- Edit Anti-Phishing Filter
- Edit Exchange Connector
- Edit Malware Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Connection Filters
- List Exchange Connectors
- List Malware Filters
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- List Tenant Allow/Block List
- List Transport Rules
- Remove Exchange Connector
- Remove Spam Filter
- Remove Tenant Allow/Block List
- Remove Transport Rule
Exchange Resource Actions
- Add Equipment Mailbox
- Add Room List
- Add Room Mailbox
- Edit Equipment Mailbox
- Edit Room List
- Edit Room Mailbox
- List Equipment
- List Room Lists
- List Rooms
GDAP Actions
- Add Role
- Auto-Extend
- Delete Relationship
- Delete Role Mapping
- Delete Role Template
- List Access Assignments
- List Approved Invites
- List Invites
- List Roles
- Manage Access Assignment
- Remove GA Role
- Send Invite
- Trace Access
Group Actions
- Add
- Add Team
- Add Template
- Delete
- Edit Members
- Get Many
- Hide From GAL
- List Sender Authentication
- List Templates
- Remove Template
- Set Delivery Management
Identity Actions
- List App Consent Requests
- List Audit Logs
- List Azure AD Connect Status
- List Azure AD Directory Objects
- List Basic Auth
- List Deleted Items
- List Domains
- List Org
- List Partner Relationships
- List Roles
- Restore Deleted
- Set Cloud Managed
Intune Actions
- Add Assignment Filter
- Add Intune Reusable Setting
- Add Win32 Script App
- Edit Intune Script
- List App Protection Policies
- List Assignment Filters
- List Compliance Policies
- List Intune Reusable Settings
- List Intune Scripts
- List Intune Templates
- Remove Intune Reusable Setting
- Remove Intune Script
Mailbox Actions
- Add Shared Mailbox
- Convert
- Copy for Sent
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Enable Auto-Expanding Archive
- Hide From GAL
- High Volume Email
- List Calendar Permissions
- List Contact Permissions
- List Global Address List
- List Mailbox CAS Settings
- List Mailbox Details
- List Mailbox Forwarding
- List Mailbox Mobile Devices
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Mobile Devices
- Manage Retention Policies
- Manage Retention Tags
- Modify Contact Permissions
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Schedule Mailbox Vacation
- Schedule OOO Vacation
- Send Org Message
- Set Calendar Processing
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Email Size
- Set Mailbox Locale
- Set Mailbox Quota
- Set Mailbox Retention Policy
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
OneDrive Actions
- Add Shortcut
- Provision
Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
Quarantine Actions
- Deny
- Get Many
- Get Message
- Release
Safe Link Actions
- Add Policy
- Add Policy From Template
- Add Template
- Create Template (Full)
- Delete Policy
- Deploy From Template
- Edit Policy
- Edit Template
- Get Policy Details
- Get Template Details
- List Templates
- Remove Template
Scheduled Item Actions
- Get Details
- Get Many
- Remove
- Trigger Billing Run
SharePoint Actions
- Delete Site
- List Admin URL
- List Quota
- List Settings
Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Quarantine Policy
- Remove Spam Filter
- Remove Spam Filter Template
Standard Actions
- Add BPA Template
- Add Standard Template
- Add Standards Deploy
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Exec BPA
- Exec Domain Analyser
- Exec Drift Clone
- Get Domain Health
- List BPA
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Domain Health
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
Team Actions
- Add
- Add SharePoint Site
- Add Sites Bulk
- Delete SharePoint Site
- Get Activity
- Get Admin URL
- Get Many
- Get SharePoint Quota
- Get SharePoint Settings
- Get Sites
- Manage Site Member
- Manage Site Permissions
Teams Shift Actions
- List Shifts
- Create Shift
- Update Shift
- Delete Shift
- List Open Shifts
- Create Open Shift
- Update Open Shift
- Delete Open Shift
- List Scheduling Groups
- Create Scheduling Group
- Update Scheduling Group
- Delete Scheduling Group
- List Time Off Reasons
- Create Time Off Reason
- Update Time Off Reason
- Delete Time Off Reason
- List Time Off Requests
- Create Time Off Request
- Approve Time Off Request
- Decline Time Off Request
- List Swap Shift Requests
- Create Swap Shift Request
- Approve Swap Shift Request
- Decline Swap Shift Request
- List Offer Shift Requests
- Create Offer Shift Request
- Approve Offer Shift Request
- Decline Offer Shift Request
Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List App Consent Requests
- List CSP SKUs
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
Testing Actions
- Add Test Report
- Delete Test Report
- Execute Test Run
- List Available Tests
- List Test Reports
- List Tests
Tool Actions
- Breach Search (Account)
- Breach Search (Tenant)
- CIPP API Request
- Exec Graph Request
- Execute Breach Search
- GeoIP Lookup
- Get Version
- Graph Request (Exec)
- Graph Request (List)
- List All Tenant Device Compliance
- Send Test Email
- Universal Search
- Universal Search V2
Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connection Filter Template
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- List Users and Groups
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
Voice Actions
- Assign Number
- Get Emergency Locations
- Get Phone Numbers
- Unassign Number
Workflow Actions
- BEC Investigation
- Cross-Tenant Sweep
- License Audit
- Security Posture
- User 360

Identity → List Audit Logs

AI-generated

Summary

Lists audit log entries for a selected tenant. Choose the tenant from the list or enter its domain, then return up to the configured limit or all available results.

Inputs

Tenant (required) — Select a tenant from the list or enter its domain, such as contoso.onmicrosoft.com.
Return All — When enabled, requests all results; otherwise returns up to the Limit.
Limit — Maximum number of results when Return All is disabled; defaults to 50 and accepts values from 1 to 500.

Output shape

A list of audit log records.

The source pack omits the Identity action implementation body, so the exact API response fields and pagination behavior are not shown.

CIPP.appInstall