CIPP AdvancedInstall

Summary

Investigate business email compromise (BEC) indicators for a tenant by combining sign-in, mailbox, OAuth app, and—when scoped to a user—BEC check data. Return a risk score and findings, with configurable handling of failed steps.

Inputs

• Tenant (required) — Select a tenant from the list or enter its domain. The domain is also used to identify external forwarding destinations.
• Fail Mode — Best Effort (default) continues after step failures and includes partial results; Fast Fail stops at the first failure.
• User ID or UPN — Optionally scope the investigation to a user. Without it, the investigation uses tenant-wide sign-ins and mailbox rules; the user-specific BEC check is skipped.
• Lookback Days — Sign-in history window in days, from 1 to 365; defaults to 30.
• Normalize Numeric Strings — Convert plain decimal numeric strings to numbers in returned data; defaults to false.

Output shape

A single composite result containing summarized investigation findings, a risk score, and step status metadata.

The workflow checks sign-ins, mailbox rules and SMTP forwarding, OAuth apps, and best-effort identity protection risky users and MDO security alerts. When a user ID or UPN is provided, it also runs the BEC check. Best Effort can return partial findings when steps fail; step metadata includes errors but omits raw API response data.

Links

• n8n community nodes installation guide