/standards

name: "cipp-standards"
description: "CIPP's tenant-baseline enforcement model: the Report/Alert/Remediate standards modes and how to roll them out, on-demand standards evaluation, Best Practice Analyser reports, and SPF/DKIM/DMARC domain health results with their remediation actions."
when_to_use: >-
  When auditing standards compliance, running BPA reports, checking domain authentication health,
  or detecting tenants drifting from configured baselines. Use when: cipp standards, bpa, best
  practice analyser, best practice analyzer, run standards check, domain health, dmarc, dkim, spf,
  tenant baseline, compliance drift, or secure score.

CIPP Standards & BPA

Standards are CIPP's mechanism for declaring "this is what every tenant we manage should look like" and continuously enforcing it. The Best Practice Analyser (BPA) is the read side — it shows you where current tenant state diverges from CIPP's recommended baseline. Domain health is a complementary check focused on email authentication.

Anti-triggers

• **Drift against an Inforcer baseline** — Inforcer and CIPP both say

"baseline", "drift", and "secure score" but measure different things against different templates; a tenant can be CIPP-compliant and Inforcer-drifted at once. Use `inforcer-baseline-alignment`.

• **Inspecting Conditional Access policies** — CA policies are not CIPP

standards and do not appear in BPA output; use `cipp-security`.

• **Triaging what an `Alert`-mode standard actually raised** — the

queue those alerts land in is `cipp-alerts`.

• **Drift measured across more than the CIPP-managed estate** — the

cross-vendor method for comparing tenants to a baseline and deciding what to remediate is `compliance-pack-standards-drift`; this skill is the CIPP standards engine it reads.

Tools

`cipp_list_standards`

cipp_list_standards(tenantFilter='contoso.onmicrosoft.com')

Returns the list of standards configured for the tenant: which standards are enabled, what action each takes (`Report`, `Alert`, `Remediate`), and current compliance status. Use `tenantFilter='allTenants'` for a portfolio-wide view.

`cipp_run_standards_check`

cipp_run_standards_check(tenantFilter='contoso.onmicrosoft.com')

Triggers an on-demand standards evaluation. CIPP runs this on a schedule, but force a fresh run after deploying a new standard or remediating a finding to confirm the fix took.

`cipp_list_bpa`

cipp_list_bpa(tenantFilter='contoso.onmicrosoft.com')

Returns the latest Best Practice Analyser report — every CIPP-recommended check with `Pass`/`Fail`/`Warn` status across categories (Security, Identity, Mail, SharePoint, Teams, Intune). The most useful single call for tenant health.

`cipp_list_domain_health`

cipp_list_domain_health(tenantFilter='contoso.onmicrosoft.com')

Per-domain SPF, DKIM, DMARC, MX, and DNSSEC results. Run for any tenant where mail authentication is suspect or before/after migrating mail.

`cipp_get_tenant_alignment` / `cipp_get_tenant_drift`

cipp_get_tenant_alignment()                                   # all tenants
cipp_get_tenant_drift(tenantFilter='contoso.onmicrosoft.com')

Alignment is each tenant's percentage match with its assigned Standards Templates, the signal for deciding which standards are safe to promote to Remediate. Drift lists the individual settings that deviate. Omit `tenantFilter` for the whole estate. Both are admin-tier in Conduit.

Standards Templates: `cipp_list_standard_templates`, `cipp_create_standard_template`, `cipp_delete_standard_template`

cipp_list_standard_templates()
cipp_create_standard_template(template={...})   # upsert by GUID; must include tenantFilter
cipp_delete_standard_template(templateId='<guid>')

Listing is read. Creating/updating and deleting are **admin** and high-impact: a template assigned to tenants with any Remediate-action standard changes those tenants on the next standards run, and deleting a template removes the standards it enforced from every tenant assigned to it. Always show the full template JSON (or the template being deleted and its tenants) and get explicit approval first.

Standards model

A "standard" in CIPP has three modes:

| Mode | Behavior | |------|----------| | `Report` | Check only; show in BPA | | `Alert` | Check + raise alert when out of compliance | | `Remediate` | Check + auto-fix when out of compliance |

The progression for an MSP rolling out a new baseline is typically `Report` → `Alert` → `Remediate` over weeks, with the longest dwell in `Alert` to validate that auto-remediation will be safe.

Workflow patterns

Tenant health snapshot

bpa = cipp_list_bpa(tenantFilter)
fails = [check for check in bpa if check['status'] == 'Fail']
domain = cipp_list_domain_health(tenantFilter)
broken_dmarc = [d for d in domain if d.get('dmarcPass') is not True]

A tenant with > 5 BPA failures or any broken DMARC needs a remediation plan, not just a report.

Standards drift detection

all_tenants_standards = cipp_list_standards(tenantFilter='allTenants')

Compare the standards each tenant has enabled against the MSP's master baseline list. Tenants missing a baseline standard usually mean the standard was deployed *after* the tenant onboarded and never backfilled.

Pre-change validation

Before you change a tenant's identity or mail config:

1. `cipp_list_bpa` — capture current state 2. Make the change 3. `cipp_run_standards_check` to force a fresh evaluation 4. `cipp_list_bpa` again — diff against pre-change capture

Domain health interpretation

| Result | Meaning | Action | |--------|---------|--------| | SPF: missing | No SPF record at all | Add `v=spf1 include:spf.protection.outlook.com -all` | | SPF: too many lookups | Record exceeds 10-DNS-lookup limit | Flatten or consolidate `include:` directives | | DKIM: not configured | Default DKIM signing disabled | Enable in Defender / Exchange Admin | | DMARC: `p