See UserDesk in action (3 min)
CIPP's feature surface is familiar to MSP techs. UserDesk covers a different surface — the client's HR-facing portal — that's harder to picture without seeing it. Here's the 3-minute tour:
Side-by-side comparison
Same MSP, two very different daily users. The table below assumes an MSP managing 5–50 client M365 tenants.
| Feature | UserDesk | CIPP |
|---|---|---|
Target user Who actually uses it day-to-day | Client's HR / office manager / team lead (non-IT) | MSP tier-1 to tier-3 techs |
Hosting model | Multi-tenant SaaS, hosted by us | Self-hosted on Azure Static Web Apps + Functions |
Setup time per client tenant | ≈2 min (admin consent + portal) | Initial Azure setup ~hours; per-tenant via GDAP |
Multi-tenant management view (one login → all clients) | No | Yes |
Delegation to non-IT staff | Yes | No |
Deep admin (Conditional Access, Intune, security policies) | No | Yes |
Per-delegate audit log Who did what, when, in plain English | Yes | Per-tech, not per-end-user |
Scope limitation (delegate only sees what they can do) | Yes | No |
GDAP-native | Works alongside, doesn't replace | Yes |
Pricing model | Per-tenant SaaS, $79–149/mo | Free (OSS) + paid CIPP-Pro tier |
White-label | Not yet (partner-console waitlist) | Limited |
Learning curve | Minutes for HR; minutes for IT | Real curve for new MSP techs |
Comparison verified
When to choose CIPP
Pick CIPP when you need MSP-tech reach across client tenants.
CIPP genuinely wins on the things it was built for. If your MSP regularly does any of these across many client tenants, CIPP is the right tool:
- Conditional Access policy rollout + drift detection
- Intune device + app policy management
- Tenant-wide security baselines (MFA enforcement, legacy auth blocking, audit log retention)
- GDAP relationship setup + ongoing partner-admin work
- Cross-tenant reporting (security score, license usage)
- Bulk operations a tech does once and propagates
It's free, open-source, deeply featured, and beloved in the MSP community for good reasons. We use it ourselves for the work we describe above. Nothing on this page is "CIPP is bad."
When to choose UserDesk
Pick UserDesk when you want to deflect routine tickets back to your clients' own staff.
UserDesk handles a slice of M365 work CIPP doesn't — giving the client's HR person, office manager, or team lead a focused interface for routine ops:
- Password resets (HR unblocks the user, your tech never sees the ticket)
- New-hire account creation with onboarding templates
- License assignment / removal as headcount changes
- Teams + distribution list membership
- Account disable on offboarding
These are the requests that currently come into your queue from client HR even though IT shouldn't be the bottleneck. UserDesk takes them out of the queue without giving HR Global Admin. Three role tiers (Admin / Member / Viewer); scope is hard-limited by design — there's no Conditional Access surface, no Intune, no SSO settings exposed.
When to use both (most established MSPs)
Most MSPs we've talked to use CIPP + UserDesk together.
The split is clean: CIPP for things only techs should touch. UserDesk for things HR can safely own. Your tier-1 queue drops because routine HR requests go away. Your techs spend their hours on the policy / security / Intune work that's actually billable.
We don't replace CIPP and CIPP doesn't replace us. Different jobs.
Pricing comparison
CIPP itself is free (open-source under AGPL). The CIPP-Pro paid tier launched in 2024 and adds managed hosting, support, and additional features. Pricing varies by tenant count; check the CIPP pricing page for current rates.
UserDesk pricing is the same for everyone — no MSP volume discount, matching the M365 ISV ecosystem norm (Microsoft doesn't volume-discount; neither do AdminDroid, M365 Manager Plus, etc):
- Starter — $79/mo per tenant ($790/yr, ~$66/mo equivalent). Up to 50 M365 users, 3 portal admins. Full feature surface.
- Pro — $149/mo per tenant ($1,490/yr, ~$124/mo equivalent). Unlimited users + admins. Priority support.
- MSP margin comes from our referral program (20% recurring per active referral) or by marking up the bundled cost to your client as part of managed services.
Pricing verified
Migration or coexistence?
Neither. There's nothing to migrate from CIPP to UserDesk — they don't overlap on the workflows they handle. Same the other direction. They coexist. Your existing CIPP GDAP setup keeps working; UserDesk uses delegated permissions scoped to whoever's signed in, and doesn't require any change to your CIPP relationships.
Deeper read
We wrote a longer essay on this comparison for our blog — CIPP vs UserDesk: when to use each → — which goes into the philosophy behind the split and includes quotes from MSPs running both.
Frequently asked questions
Q01Do I still need CIPP if I have UserDesk?
Yes, probably. CIPP handles MSP-tech work — Conditional Access policies, Intune, GDAP, cross-tenant reporting — that UserDesk doesn't touch. UserDesk handles delegation to your clients' non-IT staff, which CIPP isn't built for. Different audiences, different scopes. Most established MSPs run both.
Q02Does UserDesk work alongside my existing CIPP GDAP setup?
Yes. UserDesk uses delegated permissions scoped to the signed-in user (the client's HR person, office manager, etc.) — it doesn't share or modify your GDAP relationships. Your CIPP partner-admin setup keeps working unchanged.
Q03Can my clients see UserDesk while I'm in CIPP?
They don't see each other at all. CIPP is your MSP-side tool — clients never log into it. UserDesk is the client-side tool — they log into their tenant's UserDesk portal. Same tenant, different applications, different audit trails.
Q04What about CIPP-Pro? Does that change the comparison?
CIPP-Pro adds managed hosting + support to CIPP — useful if you don't want to maintain the Azure Static Web Apps deployment yourself. It doesn't change the underlying scope: CIPP-Pro is still MSP-tech focused. UserDesk and CIPP-Pro coexist the same way UserDesk and OSS CIPP do.
Q05How does using UserDesk affect my MSP margin?
Two paths. Either earn 20% recurring commission via our referral program (kept by your MSP, not passed to client), or bill the cost through to the client at your normal markup as part of managed services. Same per-tenant price either way — no Microsoft-ecosystem-style volume discount, by design.
For MSPs evaluating
15-min walkthrough with the founder
Bring your hardest delegation question. We'll either solve it together or admit it's not the right tool for your stack. Direct calendar booking — no sales script.
Book a slotFree rollout guide
MSP Rollout Checklist
Tenant setup order, client onboarding script, pricing-conversation template — distilled from real MSP rollouts.