CIPP.app

Manage Microsoft 365 tenants via CIPP.app

Actions619

Alert Actions
- Add
- Add Alert Rule
- Get Many
- Get Security Alerts
- Get Security Incidents
- List Audit Log Searches
- List Webhook Alerts
- Remove Queued Alert
- Search Audit Log
- Set Security Alert Status
- Set Security Incident Status
- Test Audit Log
Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App Repository
- List Apps Repository
- List Detected App Devices
- List Detected Apps
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
Autopilot Actions
- Add Configuration
- Add Device
- Add Enrollment
- Assign
- Get Configurations
- Get Many
- Remove
- Remove Configuration
- Rename Device
- Set Group Tag
- Sync
- Sync DEP
Backup Actions
- Get Many
- Restore
- Run
- Set Auto-Backup
CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
CIPP Core Actions
- Execute CIPP Function
- Execute GitHub Action
- Get App Status
- Get CIPP Alerts
- Get External Tenant Info
- Get Version
- List Function Parameters
- List Function Stats
- List GitHub Release Notes
- List Known IP Database
- List Logs
- Manage Durable Functions
- Offload Functions
CIPP v10.5 Actions
- Add Assignment Filter Template
- Add DLP Compliance Policy
- Add Enrollment
- Add Group Team
- Add Retention Compliance Policy
- Add Sensitive Info Type
- Add Sensitivity Label
- Add User Bulk
- Assign Policy
- Edit Assignment Filter
- Edit DLP Compliance Policy
- Edit Retention Compliance Policy
- Edit Sensitive Info Type
- Edit Sensitivity Label
- Execute Assignment Filter Delete
- Execute Mailbox Restore
- Execute MCP
- Execute SharePoint Version Cleanup
- List ActiveSync Devices
- List Android Enrollment Profiles
- List Apple Enrollment Profiles
- List Assignment Filter Templates
- List CSP SKU
- List DLP Compliance Policy
- List HVE Accounts
- List Licenses Report
- List Mailbox Restores
- List Retention Compliance Policy
- List Sensitive Info Type
- List Sensitivity Label
- List Snoozed Alerts
- Patch User
- Remove Admin Role
- Remove Assignment Filter Template
- Remove DLP Compliance Policy
- Remove Enrollment Profile
- Remove Retention Compliance Policy
- Remove Sensitive Info Type
- Remove Sensitivity Label
- Remove Snooze
- Set CAS Mailbox
- Set Package Tag
- Snooze Alert
CIPP v10.6 Actions
- Add Intune Policy Clone
- Execute Add CVE Exception
- Execute Backup Replication Config
- Execute Bulk Remove Sharing Links
- Execute Copilot Settings
- Execute GDAP Repair Role Mappings
- Execute Remove CVE Exception
- Execute Remove SharePoint External User
- Execute Remove Sharing Link
- Execute Remove Site User
- Execute Restore Deleted Site
- Execute Restore Recycle Bin Items
- Execute SAM Certificate
- Execute Set Library Permission
- Execute Set Site Properties
- Execute Shadow AI Sanction
- List Active Alert Results
- List Agent 365 Packages
- List Audit Log Coverage
- List Copilot Settings
- List Copilot Usage
- List CVE Management
- List Deleted Sites
- List Sensitive Info Type Rule Package
- List Shadow AI
- List SharePoint External Users
- List SharePoint Sharing
- List SharePoint Version Cleanup
- List Site Libraries
- List Site Properties
- List Site Recycle Bin
Conditional Access Actions
- Add Exclusion
- Add Named Location
- Add Policy
- Add Service Exclusion
- Add Template
- CA Policy Check
- Check Policy
- Edit Named Location
- Edit Policy
- List Named Locations
- List Policies
- List Policy Changes
- List Templates
- Manage Named Location
- Remove Policy
- Remove Template
Contact Actions
- Add Contact
- Add Contact Template
- Edit Contact
- Edit Contact Template
- List Contact Permissions
- List Contact Templates
- List Contacts
- Modify Contact Permissions
- Remove Contact
- Remove Contact Template
Device Actions
- Execute Action
- Get Details
- Get LAPS Password
- Get Many
- Get Recovery Key
- List Detected App Devices
- List Detected Apps
- Manage
- Set Cloud Managed
- Set Package Tag
Email Security Actions
- Add Connection Filter
- Add Exchange Connector
- Add Spam Filter
- Add Tenant Allow/Block List
- Add Transport Rule
- Edit Anti-Phishing Filter
- Edit Exchange Connector
- Edit Malware Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Connection Filters
- List Exchange Connectors
- List Malware Filters
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- List Tenant Allow/Block List
- List Transport Rules
- Remove Exchange Connector
- Remove Spam Filter
- Remove Tenant Allow/Block List
- Remove Transport Rule
Exchange Resource Actions
- Add Equipment Mailbox
- Add Room List
- Add Room Mailbox
- Edit Equipment Mailbox
- Edit Room List
- Edit Room Mailbox
- List Equipment
- List Room Lists
- List Rooms
GDAP Actions
- Add Role
- Auto-Extend
- Delete Relationship
- Delete Role Mapping
- Delete Role Template
- List Access Assignments
- List Approved Invites
- List Invites
- List Roles
- Manage Access Assignment
- Remove GA Role
- Send Invite
- Trace Access
Group Actions
- Add
- Add Team
- Add Template
- Delete
- Edit Members
- Get Many
- Hide From GAL
- List Sender Authentication
- List Templates
- Remove Template
- Set Delivery Management
Identity Actions
- List App Consent Requests
- List Audit Logs
- List Azure AD Connect Status
- List Azure AD Directory Objects
- List Basic Auth
- List Deleted Items
- List Domains
- List Org
- List Partner Relationships
- List Roles
- Restore Deleted
- Set Cloud Managed
Intune Actions
- Add Assignment Filter
- Add Intune Reusable Setting
- Add Win32 Script App
- Edit Intune Script
- List App Protection Policies
- List Assignment Filters
- List Compliance Policies
- List Intune Reusable Settings
- List Intune Scripts
- List Intune Templates
- Remove Intune Reusable Setting
- Remove Intune Script
Mailbox Actions
- Add Shared Mailbox
- Convert
- Copy for Sent
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Enable Auto-Expanding Archive
- Hide From GAL
- High Volume Email
- List Calendar Permissions
- List Contact Permissions
- List Global Address List
- List Mailbox CAS Settings
- List Mailbox Details
- List Mailbox Forwarding
- List Mailbox Mobile Devices
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Mobile Devices
- Manage Retention Policies
- Manage Retention Tags
- Modify Contact Permissions
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Schedule Mailbox Vacation
- Schedule OOO Vacation
- Send Org Message
- Set Calendar Processing
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Email Size
- Set Mailbox Locale
- Set Mailbox Quota
- Set Mailbox Retention Policy
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
OneDrive Actions
- Add Shortcut
- Provision
Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
Quarantine Actions
- Deny
- Get Many
- Get Message
- Release
Safe Link Actions
- Add Policy
- Add Policy From Template
- Add Template
- Create Template (Full)
- Delete Policy
- Deploy From Template
- Edit Policy
- Edit Template
- Get Policy Details
- Get Template Details
- List Templates
- Remove Template
Scheduled Item Actions
- Get Details
- Get Many
- Remove
- Trigger Billing Run
SharePoint Actions
- Delete Site
- List Admin URL
- List Quota
- List Settings
Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Quarantine Policy
- Remove Spam Filter
- Remove Spam Filter Template
Standard Actions
- Add BPA Template
- Add Standard Template
- Add Standards Deploy
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Exec BPA
- Exec Domain Analyser
- Exec Drift Clone
- Get Domain Health
- List BPA
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Domain Health
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
Team Actions
- Add
- Add SharePoint Site
- Add Sites Bulk
- Delete SharePoint Site
- Get Activity
- Get Admin URL
- Get Many
- Get SharePoint Quota
- Get SharePoint Settings
- Get Sites
- Manage Site Member
- Manage Site Permissions
Teams Shift Actions
- List Shifts
- Create Shift
- Update Shift
- Delete Shift
- List Open Shifts
- Create Open Shift
- Update Open Shift
- Delete Open Shift
- List Scheduling Groups
- Create Scheduling Group
- Update Scheduling Group
- Delete Scheduling Group
- List Time Off Reasons
- Create Time Off Reason
- Update Time Off Reason
- Delete Time Off Reason
- List Time Off Requests
- Create Time Off Request
- Approve Time Off Request
- Decline Time Off Request
- List Swap Shift Requests
- Create Swap Shift Request
- Approve Swap Shift Request
- Decline Swap Shift Request
- List Offer Shift Requests
- Create Offer Shift Request
- Approve Offer Shift Request
- Decline Offer Shift Request
Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List App Consent Requests
- List CSP SKUs
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
Testing Actions
- Add Test Report
- Delete Test Report
- Execute Test Run
- List Available Tests
- List Test Reports
- List Tests
Tool Actions
- Breach Search (Account)
- Breach Search (Tenant)
- CIPP API Request
- Exec Graph Request
- Execute Breach Search
- GeoIP Lookup
- Get Version
- Graph Request (Exec)
- Graph Request (List)
- List All Tenant Device Compliance
- Send Test Email
- Universal Search
- Universal Search V2
Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connection Filter Template
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- List Users and Groups
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
Voice Actions
- Assign Number
- Get Emergency Locations
- Get Phone Numbers
- Unassign Number
Workflow Actions
- BEC Investigation
- Cross-Tenant Sweep
- License Audit
- Security Posture
- User 360

Tenant → List Defender State

AI-generated

Summary

Lists Microsoft Defender state for the selected tenant by calling CIPP’s tenant Defender state endpoint. Choose the tenant, then optionally limit how many results are returned.

Inputs

tenantFilter (required) — Tenant to query. Select it from the list or enter its domain, such as contoso.onmicrosoft.com.
returnAll — When enabled, return all results; otherwise return up to the configured limit.
limit — Maximum results when Return All is disabled. Defaults to 50; allowed range is 1–500.

Output shape

A list of Defender state records.

Results are limited by default; enable Return All to request all results.

CIPP.appInstall