CIPP.appInstall

Summary

Investigates a tenant for business email compromise signals by collecting sign-ins, mailbox rules and forwarding, OAuth apps, and—when a user is specified—BEC check results. It also checks available identity protection and Defender for Office 365 alerts, then returns findings with a risk score.

Inputs

• Tenant (required) — Tenant to investigate, selected from the list or entered by domain.
• Fail Mode — Best Effort continues after individual step failures and includes partial results; Fast Fail stops at the first step failure.
• User ID or UPN — Optionally scopes the investigation to a user. Without it, sign-ins and mailbox rules are checked tenant-wide; the user-specific BEC check runs only when this value is provided.
• Lookback Days — Number of days of sign-in history to analyze; defaults to 30, with a supported range of 1–365.

Output shape

A single composite result containing investigation findings, a risk score, and step status metadata.

Available checks can fail or return no data because of missing permissions or licensing. Best Effort returns partial findings; step metadata reports failures without including raw API responses.

Links

• n8n community nodes installation guide