> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use CIPP with Super Magic

> Connect CIPP as a Super Magic connector to check Microsoft 365 users, licences, MFA, and sign-ins across your client tenants from inside any Thread ticket conversation.

Connect CIPP and Super Magic can look across the **Microsoft 365 tenants you manage in CIPP**: users, licences, MFA, and sign-ins. When a client says "I can't log in", you can check their account without opening another portal.

## What you can ask

> "Is MFA turned on for [jane@contoso.com](mailto:jane@contoso.com)?"

> "Which users in the Contoso tenant have no licence assigned?"

> "Show me the recent sign-ins for [bob@fabrikam.com](mailto:bob@fabrikam.com)"

Super Magic connects through CIPP's own MCP server, using the role you give the API client in CIPP. With the **Readonly** role below, it can look things up but can't change anything.

## Set it up

CIPP is a **connector**: an admin adds your CIPP instance once, then **each member signs in with their own CIPP account**. Super Magic acts with your CIPP permissions, not a shared bot account.

**CIPP admin (once, in CIPP):**

**1. Turn on the MCP server**

In CIPP, go to **Settings > Integrations > CIPP-API**. In **Application Settings**, turn on **MCP Server**.

**2. Create an API client for MCP**

Create an API client, turn on **MCP Access Allowed**, set the role to **Readonly**, set the IP range to **Any**, then click **Save to Azure**.

**Thread admin (once):**

**1. Open the Integrations page**

In the Thread Admin app, open **Integrations** (`/dashboard/integrations`) and find **CIPP**.

**2. Enter your CIPP host**

Enter the host name of your CIPP instance, for example `cipp.yourmsp.com`. If several API clients in CIPP allow MCP, also enter the API client ID to use.

**3. Allowlist Thread's callback in CIPP**

The setup shows Thread's OAuth callback URL. Add it to the allowed callbacks in CIPP, or member sign-ins will fail.

**Each member (once):**

**1. Open the Connectors page in your Inbox**

Open the **Connectors** page in your Inbox.

**2. Connect and sign in to CIPP**

Click **Connect** on the CIPP row and sign in with your CIPP account.

**3. Confirm you're signed in**

The row shows **Signed in as** your account. Disconnect anytime.

## Troubleshooting

* **CIPP not on the Integrations page?** CIPP is rolling out to workspaces gradually. Contact your Thread account team.
* **Sign-in fails right after you click Connect?** Check that Thread's callback URL is allowlisted in CIPP, exactly as the setup shows it.
* **Connected but no tools?** Check that **MCP Server** is on in CIPP and the API client has **MCP Access Allowed**.
* Anything else: [**Super Magic Admin Guide → Troubleshooting**](https://docs.getthread.com/super-magic/super-magic-admin-guide-setup-access-safety.md). CIPP's own setup guide: [CIPP-API integration](https://docs.cipp.app/user-documentation/cipp/integrations/cipp-api).


## Related topics

- [Use Liongard with Super Magic](https://docs.getthread.com/super-magic/use-liongard-with-super-magic.md)
- [Use IT Glue with Super Magic](https://docs.getthread.com/super-magic/use-it-glue-with-super-magic.md)
- [Use Linear with Super Magic](https://docs.getthread.com/super-magic/use-linear-with-super-magic.md)