Actions619
- Alert Actions
- Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App Repository
- List Apps Repository
- List Detected App Devices
- List Detected Apps
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
- Autopilot Actions
- Backup Actions
- CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
- CIPP Core Actions
- CIPP v10.5 Actions
- Add Assignment Filter Template
- Add DLP Compliance Policy
- Add Enrollment
- Add Group Team
- Add Retention Compliance Policy
- Add Sensitive Info Type
- Add Sensitivity Label
- Add User Bulk
- Assign Policy
- Edit Assignment Filter
- Edit DLP Compliance Policy
- Edit Retention Compliance Policy
- Edit Sensitive Info Type
- Edit Sensitivity Label
- Execute Assignment Filter Delete
- Execute Mailbox Restore
- Execute MCP
- Execute SharePoint Version Cleanup
- List ActiveSync Devices
- List Android Enrollment Profiles
- List Apple Enrollment Profiles
- List Assignment Filter Templates
- List CSP SKU
- List DLP Compliance Policy
- List HVE Accounts
- List Licenses Report
- List Mailbox Restores
- List Retention Compliance Policy
- List Sensitive Info Type
- List Sensitivity Label
- List Snoozed Alerts
- Patch User
- Remove Admin Role
- Remove Assignment Filter Template
- Remove DLP Compliance Policy
- Remove Enrollment Profile
- Remove Retention Compliance Policy
- Remove Sensitive Info Type
- Remove Sensitivity Label
- Remove Snooze
- Set CAS Mailbox
- Set Package Tag
- Snooze Alert
- CIPP v10.6 Actions
- Add Intune Policy Clone
- Execute Add CVE Exception
- Execute Backup Replication Config
- Execute Bulk Remove Sharing Links
- Execute Copilot Settings
- Execute GDAP Repair Role Mappings
- Execute Remove CVE Exception
- Execute Remove SharePoint External User
- Execute Remove Sharing Link
- Execute Remove Site User
- Execute Restore Deleted Site
- Execute Restore Recycle Bin Items
- Execute SAM Certificate
- Execute Set Library Permission
- Execute Set Site Properties
- Execute Shadow AI Sanction
- List Active Alert Results
- List Agent 365 Packages
- List Audit Log Coverage
- List Copilot Settings
- List Copilot Usage
- List CVE Management
- List Deleted Sites
- List Sensitive Info Type Rule Package
- List Shadow AI
- List SharePoint External Users
- List SharePoint Sharing
- List SharePoint Version Cleanup
- List Site Libraries
- List Site Properties
- List Site Recycle Bin
- Conditional Access Actions
- Contact Actions
- Device Actions
- Email Security Actions
- Add Connection Filter
- Add Exchange Connector
- Add Spam Filter
- Add Tenant Allow/Block List
- Add Transport Rule
- Edit Anti-Phishing Filter
- Edit Exchange Connector
- Edit Malware Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Connection Filters
- List Exchange Connectors
- List Malware Filters
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- List Tenant Allow/Block List
- List Transport Rules
- Remove Exchange Connector
- Remove Spam Filter
- Remove Tenant Allow/Block List
- Remove Transport Rule
- Exchange Resource Actions
- GDAP Actions
- Group Actions
- Identity Actions
- Intune Actions
- Mailbox Actions
- Add Shared Mailbox
- Convert
- Copy for Sent
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Enable Auto-Expanding Archive
- Hide From GAL
- High Volume Email
- List Calendar Permissions
- List Contact Permissions
- List Global Address List
- List Mailbox CAS Settings
- List Mailbox Details
- List Mailbox Forwarding
- List Mailbox Mobile Devices
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Mobile Devices
- Manage Retention Policies
- Manage Retention Tags
- Modify Contact Permissions
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Schedule Mailbox Vacation
- Schedule OOO Vacation
- Send Org Message
- Set Calendar Processing
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Email Size
- Set Mailbox Locale
- Set Mailbox Quota
- Set Mailbox Retention Policy
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
- OneDrive Actions
- Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
- Quarantine Actions
- Safe Link Actions
- Scheduled Item Actions
- SharePoint Actions
- Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Quarantine Policy
- Remove Spam Filter
- Remove Spam Filter Template
- Standard Actions
- Add BPA Template
- Add Standard Template
- Add Standards Deploy
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Exec BPA
- Exec Domain Analyser
- Exec Drift Clone
- Get Domain Health
- List BPA
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Domain Health
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
- Team Actions
- Teams Shift Actions
- List Shifts
- Create Shift
- Update Shift
- Delete Shift
- List Open Shifts
- Create Open Shift
- Update Open Shift
- Delete Open Shift
- List Scheduling Groups
- Create Scheduling Group
- Update Scheduling Group
- Delete Scheduling Group
- List Time Off Reasons
- Create Time Off Reason
- Update Time Off Reason
- Delete Time Off Reason
- List Time Off Requests
- Create Time Off Request
- Approve Time Off Request
- Decline Time Off Request
- List Swap Shift Requests
- Create Swap Shift Request
- Approve Swap Shift Request
- Decline Swap Shift Request
- List Offer Shift Requests
- Create Offer Shift Request
- Approve Offer Shift Request
- Decline Offer Shift Request
- Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List App Consent Requests
- List CSP SKUs
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
- Testing Actions
- Tool Actions
- Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connection Filter Template
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
- User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- List Users and Groups
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
- Voice Actions
- Workflow Actions
User → BEC Check
AI-generatedSummary
Checks a selected tenant for business email compromise indicators, optionally narrowed to a user. It submits the tenant and any supplied GUID, user ID, username, or overwrite setting to CIPP’s BEC check endpoint.
Inputs
- Tenant (required) — Select a tenant from the list or enter its default domain.
- GUID — GUID to check.
- Overwrite — Whether to overwrite existing results; passed as a string.
- User ID — User ID to check.
- User Name — Username to check.
Output shape
A single API response item.
The operation sends the selected tenant and provided options to CIPP. The exact response fields and whether the check returns findings or status details are not shown in the supplied source.