Turning on Baselines shuts off classic Standards and Drift. We migrate your templates, build the overrides, and stage the rollout so nothing gets "fixed" across every tenant at once.
ZenTop is an authorized CIPP consultant and code contributor.
Migrate from Standards converts your templates. The originals are never modified.
Every standard comes across with auto-fix off. You see the deviations first.
Built per tenant from the Alignment page, once the import has run.
Auto-fix goes back on one standard at a time, stage by stage.
Tenant overrides cannot be prepared before migrating, so the order matters.
CIPP is running. The tenant list looks great. The baseline is a handful of toggles someone added during onboarding, and nobody remembers which tenants got exceptions or why. Now Baselines changes how all of it works, and the migration button is one click away.
Move from classic Standards and drift templates to Baselines without surprise remediation. We import report-only, review alignment tenant by tenant, build the overrides your clients actually need, then turn on auto-fix one standard at a time.
A real M365 baseline, not four toggles. Conditional Access, Intune compliance, Exchange protection, audit logging, and the rest, staged so the 8-person dental office keeps working while the bigger clients get the full stack.
New to CIPP or running a half-finished install? We get it deployed, tenants connected, permissions sorted, and the team trained on running it day to day.
We talk through your CIPP setup, tenant count, and what's already in place. Nothing touches your tenants yet.
Defined scope, signed before any work starts.
Report-only first. You see what would change before anything changes.
Auto-remediation goes on in stages, with your sign-off.
Your team owns it, with documentation of every override and why it exists.
ZenTop's partners founded and ran an MSP before moving into consulting. We contribute code to the open source CIPP project, speak at MSP events, and work in the same stack you do:
We also implement ImmyBot, NinjaOne, and Hudu, and wire them together with CIPP. Ask about it on the call.
The Autopilot profile standard no longer re-remediates self-deploying profiles in an endless loop.
Scheduled offboardings were failing silently and reporting success. They run again.
Autopilot profile changes log under their own name in the logbook, not as Enrollment Status Page entries.
The tenant selector stopped putting "undefined" in admin portal links and looping API calls.
The MFA report flags admin accounts, so you can filter straight to them.
%OrganizationId% resolves like %TenantId%, so Open Intune Baseline templates stop writing the raw variable to endpoints.
Creating a distribution group no longer returns a false error after it succeeds.
The local development template uses the exact variable casing the functions expect.
Corrected the policy JSON behind OneDrive Silent Login.
Updated the default OneDrive policy CIPP deploys through Intune.
Intune wipe can keep or remove enrollment data, with prompts that say which.
It starts with a scoping call about your setup, tenant count, and what's already in place. Nothing touches your tenants before a signed agreement.
