Actions467
- Alert Actions
- Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App IDs
- List Apps Repository
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
- Autopilot Actions
- Backup Actions
- CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
- CIPP Core Actions
- Conditional Access Actions
- Contact Actions
- Device Actions
- Exchange Resource Actions
- GDAP Actions
- Group Actions
- Identity Actions
- Mailbox Actions
- Add Shared Mailbox
- Convert
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Hide From GAL
- List Calendar Permissions
- List Global Address List
- List Mailbox Client Access Settings
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Retention Policies
- Manage Retention Tags
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Send Org Message
- Set Calendar Processing
- Set Copy for Sent
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Quota
- Set Mailbox Retention Policies
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
- OneDrive Actions
- Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
- Quarantine Actions
- Safe Link Actions
- Scheduled Item Actions
- Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Spam Filter
- Remove Spam Filter Template
- Standard Actions
- Add BPA Template
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Get Domain Health
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
- Team Actions
- Teams Shift Actions
- Approve Offer Shift Request
- Approve Swap Shift Request
- Approve Time Off Request
- Create Offer Shift Request
- Create Open Shift
- Create Scheduling Group
- Create Shift
- Create Swap Shift Request
- Create Time Off Reason
- Create Time Off Request
- Decline Offer Shift Request
- Decline Swap Shift Request
- Decline Time Off Request
- Delete Open Shift
- Delete Scheduling Group
- Delete Shift
- Delete Time Off Reason
- List Offer Shift Requests
- List Open Shifts
- List Scheduling Groups
- List Shifts
- List Swap Shift Requests
- List Time Off Reasons
- List Time Off Requests
- Update Open Shift
- Update Scheduling Group
- Update Shift
- Update Time Off Reason
- Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action (Sherweb)
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses (Sherweb)
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List Admin Portal Licenses
- List App Consent Requests
- List CSP SKUs (Sherweb)
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
- Tool Actions
- Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
- User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
- Voice Actions
- Workflow Actions
Tool → Execute Breach Search
AI-generatedSummary
Queries the CIPP API for compromised account data within a specified tenant.
Inputs
- tenantFilter (required) — The tenant to perform the operation on. Can be selected from a list of tenants or entered as a domain name (e.g., contoso.onmicrosoft.com).
- normalizeNumbers — Whether to convert string values that contain numbers to actual numbers. Useful when the API returns inconsistent types.
Output shape
A list of items, each containing breach account details and metadata.
The API returns results newest-first. The normalizeNumbers parameter affects data types in the output.
Examples
Example 1: Search for breached accounts in a specific tenant by domain name.
Tenant filter set to 'contoso.onmicrosoft.com', normalize numbers enabled.
Example 2: Retrieve breach data using the tenant list selector.
Tenant selected from the list, normalize numbers disabled.