CIPP vs Lighthouse: which Microsoft 365 multi-tenant tool an MSP actually needs

Lighthouse is a free, Microsoft-run overview of your client tenants; CIPP is an open-source tool that actually changes things in them. In the CIPP vs Lighthouse choice, a small MSP with a handful of Business Premium tenants can live on Lighthouse alone, but most MSPs that have outgrown clicking through admin centres end up needing CIPP for standards and bulk changes. Many run both. Here is how to decide.

The real problem is not visibility

Every multi-tenant tool promises a single pane of glass. That is the easy part. The hard part is making twenty tenants behave the same way, and noticing when one quietly stops.

So judge both tools on three jobs, not one:

• See: which users are risky, which devices are non-compliant, which accounts lack MFA.
• Change: reset a password, offboard a leaver, push a policy, without signing into each tenant.
• Hold: define a standard once and have something tell you, or fix it, when a tenant drifts.

Lighthouse is strong on the first, partial on the second and limited on the third. CIPP is built around the second and third.

What Microsoft 365 Lighthouse covers

Lighthouse lives in the Microsoft partner world. You reach customer tenants through granular delegated admin privileges (GDAP), and Lighthouse surfaces those tenants in one portal. It costs nothing extra, which is its loudest argument.

In practice it gives you:

• A tenant overview: users, devices, risky sign-ins and threat detections across clients in one list.
• Baselines and deployment plans: Microsoft's recommended security configuration, with a view of which tenants have and have not applied each step.
• Day-to-day user tasks: password resets, blocking sign-in and similar actions without switching tenant.
• GDAP management: templates for which of your technicians get which roles in which customers.

The catches are structural. Lighthouse is built for tenants that carry qualifying business licences, so a client on a cheaper plan may appear with reduced features or not fully at all. The baselines are Microsoft's, not yours. And you get roughly the features Microsoft decides to ship, on its timetable, with support routed through the usual partner channels.

What open-source CIPP adds

CIPP, the CyberDrain Improved Partner Portal, started as a community project and is written by and for MSPs. It also connects through GDAP, but its centre of gravity is action rather than reporting.

• Your own standards: define settings such as audit logging, legacy authentication, mailbox defaults or sharing rules, then report on, alert on or enforce them across chosen tenants.
• Bulk and templated changes: conditional access policies, Intune profiles, transport rules and user onboarding or offboarding applied from templates rather than rebuilt by hand.
• Reporting that MSPs ask for: best-practice analysis, MFA status, licence use and domain health checks. Pair that with a proper MFA coverage report and you can see exactly which accounts are exposed.
• Coverage of tenants Lighthouse treats as second class: CIPP is less fussy about which licences a client holds.

It is, put plainly, the tool for people who would otherwise be writing PowerShell loops over Get-MgUser at eleven at night.

Hosting, support and who you call at 3am

This is where the CIPP vs Lighthouse decision usually gets made, because features are only half the cost.

Lighthouse: someone else's problem

Microsoft hosts it, patches it and secures it. There is nothing to deploy. The trade-off is that you cannot change it, and when it misbehaves your recourse is a support ticket with a very large company.

CIPP: self-hosted or sponsored

CIPP can be self-hosted in your own Azure subscription, typically as a static web app plus a function app, which means you own the updates, the app registration secrets and the Azure bill. CyberDrain also offers a hosted option through its sponsorship model, which removes the deployment work and adds a support route. Check CyberDrain's own pages for current terms rather than trusting any blog, this one included.

Either way, remember what CIPP is: an application holding delegated admin access to every client you have. Self-hosting it badly is a breach waiting for a date. Treat its app registration and the accounts that sign into it with the same seriousness as your domain admin credentials.

A self-hosted admin portal is a privileged access path wearing a convenience costume.

Where each falls short

Note the last row. Neither tool is an RMM or a PSA. Neither patches third-party software on a laptop, raises a ticket with an SLA clock or bills the time spent fixing a mailbox. For the wider field, including Augmentt and RMMs with Microsoft 365 modules, see our comparison of Microsoft 365 management tools for MSPs.

How to choose, or justify running both

Choose Lighthouse alone if you manage a small number of tenants, nearly all on qualifying business licences, and you are happy with Microsoft's idea of a secure baseline.

Choose CIPP if you have a written standard you want held across every client, clients on mixed licences, or onboarding and offboarding work that currently eats an afternoon each time. Its standards make a natural backbone for a security audit at client onboarding.

Run both when you want Microsoft's own risk signals and GDAP tooling alongside your own enforcement. They do not conflict, because both sit on GDAP. The one discipline required: decide which tool owns each setting, or two systems will fight over a conditional access policy and you will lose the afternoon working out why.

Where this fits with Helios

Lighthouse and CIPP manage tenants; Helios manages the rest of the estate around them, whether the machines belong to clients or to your own company. It includes Microsoft 365 and Defender monitoring alongside RMM, patching, a helpdesk with SLA clocks and billing, so a tenant alert can become a ticket and billable time in one place. It does not replace CIPP's tenant-standards engine, and we would not pretend otherwise. Every feature is on every plan, from £15 a month with no charge per technician; the pricing page has the detail.

Common questions about CIPP and Lighthouse

Is CIPP free to use?

CIPP's code is open source and free, but running CIPP is not quite free. Self-hosting means paying for the Azure resources it uses and maintaining updates yourself. CyberDrain's hosted sponsorship option removes that work for a fee. Check CyberDrain's current pages for terms, because they change over time.

Does Microsoft 365 Lighthouse need GDAP?

Yes, Microsoft 365 Lighthouse relies on granular delegated admin privileges to reach customer tenants, and it includes tools to build GDAP templates for your technicians. If a client relationship still depends on older delegated admin access, sort the GDAP relationship out first, because Lighthouse features will be limited or missing for that tenant.

Is it safe to self-host CIPP?

Self-hosting CIPP is as safe as your Azure hygiene. CIPP holds delegated admin access to every connected client, so protect its app registration, restrict who can sign in, enforce strong MFA and keep it updated. A neglected self-hosted CIPP instance is one of the most valuable targets an MSP can leave lying around.

Researched and written with Helio SEO, our AI writer for business blogs.