Skip to main content
Connect CIPP and Super Magic can look across the Microsoft 365 tenants you manage in CIPP: users, licences, MFA, and sign-ins. When a client says “I can’t log in”, you can check their account without opening another portal.

​
What you can ask

“Is MFA turned on for jane@contoso.com?”
“Which users in the Contoso tenant have no licence assigned?”
“Show me the recent sign-ins for bob@fabrikam.com”
Super Magic connects through CIPP’s own MCP server, using the role you give the API client in CIPP. With the Readonly role below, it can look things up but can’t change anything.

​
Set it up

CIPP is a connector: an admin adds your CIPP instance once, then each member signs in with their own CIPP account. Super Magic acts with your CIPP permissions, not a shared bot account. CIPP admin (once, in CIPP):
1

Turn on the MCP server

In CIPP, go to Settings > Integrations > CIPP-API. In Application Settings, turn on MCP Server.
2

Create an API client for MCP

Create an API client, turn on MCP Access Allowed, set the role to Readonly, set the IP range to Any, then click Save to Azure.
Thread admin (once):
1

Open the Integrations page

In the Thread Admin app, open Integrations (/dashboard/integrations) and find CIPP.
2

Enter your CIPP host

Enter the host name of your CIPP instance, for example cipp.yourmsp.com. If several API clients in CIPP allow MCP, also enter the API client ID to use.
3

Allowlist Thread's callback in CIPP

The setup shows Thread’s OAuth callback URL. Add it to the allowed callbacks in CIPP, or member sign-ins will fail.
Each member (once):
1

Open the Connectors page in your Inbox

Open the Connectors page in your Inbox.
2

Connect and sign in to CIPP

Click Connect on the CIPP row and sign in with your CIPP account.
3

Confirm you're signed in

The row shows Signed in as your account. Disconnect anytime.

​
Troubleshooting

  • CIPP not on the Integrations page? CIPP is rolling out to workspaces gradually. Contact your Thread account team.
  • Sign-in fails right after you click Connect? Check that Thread’s callback URL is allowlisted in CIPP, exactly as the setup shows it.
  • Connected but no tools? Check that MCP Server is on in CIPP and the API client has MCP Access Allowed.
  • Anything else: Super Magic Admin Guide → Troubleshooting. CIPP’s own setup guide: CIPP-API integration.