cipp-mailboxes

CIPP Mailboxes

Exchange Online mailbox operations through CIPP. The four supported tools cover the highest-frequency MSP mailbox tasks: listing mailboxes for inventory, auditing permissions during BEC investigations, setting OOO for leave/offboarding, and configuring forwarding for transition periods.

Anti-triggers

• The BEC investigation report itself — cipp_bec_check is in cipp-users. This skill covers the mailbox layer of the remediation that follows it.
• A whole offboard — cipp_offboard_user in cipp-users sets OOO, forwarding, and shared-mailbox conversion in one call; reach for the individual tools here only when you need step-by-step control.
• Inbox rules, transport rules, mail flow, or quarantine — none are in CIPP's MCP surface. Use the m365 plugin (Microsoft 365 Mailboxes) or Exchange Online PowerShell.
• Who signed in to or accessed a mailbox — that is unified audit log territory; use cipp-alerts.

Tools

cipp_list_mailboxes

cipp_list_mailboxes(tenantFilter='contoso.onmicrosoft.com')

Returns all mailboxes (User, Shared, Resource, Equipment, Room) with userPrincipalName, recipientTypeDetails, archiveStatus, litigationHoldEnabled, and storage usage. Use as the entry point for any mailbox audit.

cipp_list_mailbox_permissions

cipp_list_mailbox_permissions(tenantFilter, userPrincipalName='[email protected]')

Lists all delegates and full-access trustees on a mailbox. Critical during BEC investigations — attackers commonly grant themselves Full Access or add a forwarding rule. Always run this on a compromised mailbox before remediation.

cipp_set_out_of_office

cipp_set_out_of_office(tenantFilter, userPrincipalName,
                       enabled=true|false,
                       internalMessage?, externalMessage?,
                       startTime?, endTime?)

Use during offboarding (permanent), planned leave (scheduled), or as a tactical control after disabling an account so external senders get a clear bounce-equivalent.