/standards

name: "cipp-standards"
description: "CIPP's tenant-baseline enforcement model: the Report/Alert/Remediate standards modes and how to roll them out, on-demand standards evaluation, Best Practice Analyser reports, and SPF/DKIM/DMARC domain health results with their remediation actions."
when_to_use: >-
  When auditing standards compliance, running BPA reports, checking domain authentication health,
  or detecting tenants drifting from configured baselines. Use when: cipp standards, bpa, best
  practice analyser, best practice analyzer, run standards check, domain health, dmarc, dkim, spf,
  tenant baseline, compliance drift, or secure score.

CIPP Standards & BPA

Standards are CIPP's mechanism for declaring "this is what every tenant we manage should look like" and continuously enforcing it. The Best Practice Analyser (BPA) is the read side — it shows you where current tenant state diverges from CIPP's recommended baseline. Domain health is a complementary check focused on email authentication.

Anti-triggers

• **Drift against an Inforcer baseline** — Inforcer and CIPP both say

"baseline", "drift", and "secure score" but measure different things against different templates; a tenant can be CIPP-compliant and Inforcer-drifted at once. Use `inforcer-baseline-alignment`.

• **Inspecting Conditional Access policies** — CA policies are not CIPP

standards and do not appear in BPA output; use `cipp-security`.

• **Triaging what an `Alert`-mode standard actually raised** — the

queue those alerts land in is `cipp-alerts`.

• **Drift measured across more than the CIPP-managed estate** — the

cross-vendor method for comparing tenants to a baseline and deciding what to remediate is `compliance-pack-standards-drift`; this skill is the CIPP standards engine it reads.

Tools

`cipp_list_standards`

cipp_list_standards(tenantFilter='contoso.onmicrosoft.com')

Returns the list of standards configured for the tenant: which standards are enabled, what action each takes (`Report`, `Alert`, `Remediate`), and current compliance status. Use `tenantFilter='allTenants'` for a portfolio-wide view.

`cipp_run_standards_check`

cipp_run_standards_check(tenantFilter='contoso.onmicrosoft.com')

Triggers an on-demand standards evaluation. CIPP runs this on a schedule, but force a fresh run after deploying a new standard or remediating a finding to confirm the fix took.

`cipp_list_bpa`

cipp_list_bpa(tenantFilter='contoso.onmicrosoft.com')

Returns the latest Best Practice Analyser report — every CIPP-recommended check with `Pass`/`Fail`/`Warn` status across categories (Security, Identity, Mail, SharePoint, Teams, Intune). The most useful single call for tenant health.

`cipp_list_domain_health`

cipp_list_domain_health(tenantFilter='contoso.onmicrosoft.com')

Per-domain SPF, DKIM, DMARC, MX, and DNSSEC results. Run for any tenant where mail authentication is suspect or before/after migrating mail.

Standards model

A "standard" in CIPP has three modes:

| Mode | Behavior | |------|----------| | `Report` | Check only; show in BPA | | `Alert` | Check + raise alert when out of compliance | | `Remediate` | Check + auto-fix when out of compliance |

The progression for an MSP rolling out a new baseline is typically `Report` → `Alert` → `Remediate` over weeks, with the longest dwell in `Alert` to validate that auto-remediation will be safe.

Workflow patterns

Tenant health snapshot

bpa = cipp_list_bpa(tenantFilter)
fails = [check for check in bpa if check['status'] == 'Fail']
domain = cipp_list_domain_health(tenantFilter)
broken_dmarc = [d for d in domain if d.get('dmarcPass') is not True]

A tenant with > 5 BPA failures or any broken DMARC needs a remediation plan, not just a report.

Standards drift detection

all_tenants_standards = cipp_list_standards(tenantFilter='allTenants')

Compare the standards each tenant has enabled against the MSP's master baseline list. Tenants missing a baseline standard usually mean the standard was deployed *after* the tenant onboarded and never backfilled.

Pre-change validation

Before you change a tenant's identity or mail config:

1. `cipp_list_bpa` — capture current state 2. Make the change 3. `cipp_run_standards_check` to force a fresh evaluation 4. `cipp_list_bpa` again — diff against pre-change capture

Domain health interpretation

| Result | Meaning | Action | |--------|---------|--------| | SPF: missing | No SPF record at all | Add `v=spf1 include:spf.protection.outlook.com -all` | | SPF: too many lookups | Record exceeds 10-DNS-lookup limit | Flatten or consolidate `include:` directives | | DKIM: not configured | Default DKIM signing disabled | Enable in Defender / Exchange Admin | | DMARC: `p=none` | Reporting only, no enforcement | Move to `p=quarantine` after monitoring | | DMARC: missing | No DMARC record | Add `v=DMARC1; p=none; rua=mailto:dmarc@...` to start |

Caveats

• BPA results reflect the last scheduled run; run `cipp_run_standards_check` for fresh data.
• Standards `Remediate` mode can change tenant configuration without an additional confirmation — scope carefully and stage `Alert` first.
• Domain health doesn't catch every email-auth issue (it doesn't validate ARC, BIMI, MTA-STS) — for full mail forensics, supplement with external tools.